On 17 July 2018, the EU and Japan concluded their discussions on personal data transfers and recognised that the data protection regimes between the two are equivalent, which means that personal data will be able to flow freely between them once each side has completed the necessary procedures to adopt an adequacy decision.
The agreement is good news for businesses which transfer data from the EU to Japan as transfers outside of the European Economic Area are, at present, generally prohibited by the General Data Protection Regulation 2016/679. There are ways around this prohibition, though often they involve the data exporter and importer entering into additional contracts, which can be an added cost, complexity and administrative burden for organisations.
Once the adequacy decision is adopted by the EU, the transfer of personal data to controllers and processors in Japan will no longer be prohibited and can be undertaken without data transfer contracts. There may still be a need for data sharing or processing agreements, but this is often the case even for domestic transfers between two parties established in the EU. According to the terms agreed between the EU and Japan, where data is exported from the EU it will be subject to additional safeguards and affected individuals will have access to a special complaints mechanism.
The next step in the EU’s adoption process will be to obtain an opinion on the decision from the European Data Protection Board, after which the decision will need to be approved by a committee made up of the EU Member States later this year. The EU has issued a press release which has more information about the agreement, and links to information about the EU-Japan Economic Partnership Agreement which will complement the adequacy decision: http://europa.eu/rapid/press-release_IP-18-4501_en.htm