EU and Japan sign off on data adequacy agreement

Today the EU College of Commissioners will adopt an adequacy decision for Japan’s data protection rules. In a response announcement at the World Economic Forum in Davos, Japan’s Prime Minister Shinzo Abe announced that Japan will formalise the agreement which deems EU data protection laws ‘equivalent’.

This mutual adequacy arrangement will, at the point of implementation in autumn, create the world's largest area of safe transfers of data based on a high level of protection for personal data.

The overall EU-Japan trade agreement took more than 5 years to agree, with adequacy discussions running throughout that time. Reaching this level of agreement was not without difficulty. Among other things, Japan’s own data protection law – the Act on Protection of Personal Information – had to be amended comprehensively to lie in accordance with the EU’s GDPR. Similarly, assurances of Japanese citizens’ personal privacy protections had to be demonstrated.

This has implications for the UK’s prospect of reaching an adequacy agreement with the EU in light of Brexit. While the UK has announced it will recognise EU data protection laws as equivalent on the Brexit date, the EU needs to do the same in order for the free-flow of data to continue on the current basis as the UK has endorsed.

It is not expected that adequacy recognition should take a long time, especially given that the UK already conforms to the GDPR and has ratified it in UK law in the form of the Data Protection Act 2018. Nonetheless, the EU has to officially evaluate the UK’s wider data protection policies which take into account security aspects. The UK’s security policy has been previously considered to be too intrusive to conform to EU data protection laws. As such, the UK may need to evidence that UK policies do not unduly breach individual privacy in order to obtain an adequacy agreement. If it cannot do this satisfactorily, this could be a barrier to gaining equivalence status from the EU.

In the case that the EU does not immediately offer adequacy to the UK, you will need to prepare your business for handling data transfers using new legal bases. The DMA has provided advice on how to do this here.