As part of its wider agreement on trade, the EU and Japan have agreed to recognise each other’s data protection regimes as equivalent, enabling personal data to flow between them easily. This is good news for EU businesses that send personal data to Japan, including intra-group.
EU data protection law prohibits the export of personal data from the EEA to countries that don’t provide ‘adequate’ data protection. There are certain exceptions to this, including where the data exporter and importer agree to comply with obligations in the EU’s model contract clauses on data protection. The EU Commission has previously declared that certain other countries’ data protection laws are ‘adequate’ -including partial adequacy decisions for Canada and the US. The Commission says it will adopt its formal adequacy decision in relation to Japan later this year. This is the first time the EU has agreed a reciprocal adequacy arrangement, meaning Japanese and EU businesses can mutually exchange personal data.
This is a welcome step – especially at a time when the US adequacy decision and the model clauses are under threat.