Agreement Reached on Framework for Smooth Transfer of Personal Data Between Japan and the EU
Jul 19, 2018
Overview
Japan’s Personal Information Protection Committee and the European Commission have finished discussion and reached an agreement concerning establishing a framework to facilitate a mutual smooth transfer of personal data between Japan and the EU.
Both Japan and the EU plan to complete necessary domestic procedures in order to make the personal data transfer framework operable by autumn of this year.
https://www.ppc.go.jp/news/press/2018/20180717/
Important Points
This means that what previously was feared as a violation of Article 44 will no longer be an issue due to satisfaction of Article 45.
Previously:
1) Relocation of personal data from within the EEA to outside the region
2) The relocation destination has not received accreditation of adequacy (Article 45)
3) Not implementing protective measures (SCC, BCR, etc.) (Article 46), not falling under the exception under Article 49 (1)
Result: Article 44 violation
However, from now on satisfying domestic procedures means clearing point (2) above.
As stated in the following public notice, the Japan side will acknowledge the EU data protection regime under Article 24 of the Personal Information Protection Act.
https://www.ppc.go.jp/files/pdf/300717_eusitei.pdf
Also, guidelines regarding the handling of personal data transferred from within the EU by certified means will be prepared.
The following is the general direction of the guideline with marking the changes.
https://www.ppc.go.jp/files/pdf/300209_siryou1.pdf
① Scope of personal information
Currently, information on ‘sexual life’, ‘sexual orientation’ and ‘labor union’ are considered as sensitive personal data in the EU, but not treated as personal data requiring special consideration in Japan.
Japan will treat information on ‘sexual life’, ‘sexual orientation’ and ‘labor union’ transferred from the EU as sensitive personal data in a similar manner as the EU.
② Scope of retained personal data
In the EU, the right to demand disclosure, correction, suspension of use and others is permitted for all personal information regardless of holding period, but in Japan the right to request disclosure is not applicable for personal data to be deleted within 6 months (such data not considered as personal data granted the right to claim).
Personal data that will be deleted within 6 months shall be treated as retained personal data if transferred from the EU.
③ Identification of purpose of use
The purpose of using personal information provided by a third party in the EU is restricted to the purpose of use specified at the time of acquisition, whereas Japan’s law is silent on this point and require clarification.
For personal data relocated from the EU, the purpose of use shall be specified and consented upon according to obligated confirmation procedures, and the personal data shall be used within that specified range.
④ Additional transfer of personal data from Japan to other foreign countries
The EU calls for clarifying the data protection level for the transfer of personal data from Japan to other foreign countries.
When transferring personal data relocated from the EU on the basis of the consent of the data subject, information on the relocation destination shall be provided to data subject for consent. Protection framework of the destination should be set up and by contract or other means offer the same protection level as the Personal Information Protection
⑤ Anonymous processing information
In the EU, data is not considered anonymized if it is possible to be re-identified even if the data is safely separated and stored.
In the case of dealing with personal data transferred from the EU as anonymized information under the Personal Information Protection Law, information on the processing method shall be deleted and re-identification shall be impossible.
Please keep in mind that these areas will be the main points of the guidelines.
Is it sufficient to have accreditation of adequacy?
It is limited to data transfer between the EEA regions and Japan. It does not cover other countries when the data is relocated.
You are welcome to contact us via the Contact Form to discuss and for more information.
