Adequacy ruling from EU in relation to Japan

The European Commission announced that it has adopted an ‘adequacy decision’ concerning Japan in relation to private sector organisations. This simplifies the process for transferring personal data between the EU and Japan.

The GDPR applies to controllers and processors located in the European Economic Area, with some exceptions. If personal data is transferred outside of the EEA then individuals risk losing the protection that GDPR offers. For this reason the GDPR restricts the transfers of personal data unless the rights of the individuals in respect of their personal data is protected in another way, or one of a limited number of exceptions applies.

Now that the European Commission has adopted an adequacy decision concerning Japan, whilst the UK remains within the EU, any UK organisation will find the process to transfer personal data to Japan much simpler. This is because it will no longer need to adopt binding corporate rules or use the Commission’s standard contractual clauses and will mean that data subjects in the EU will benefit from new rights and processes relating to managing complaints. This ruling will also make it easier for Japanese companies seeking to transfer personal data to the EU.

The UK Government has indicated that UK organisations should be able to continue benefiting from the Japanese adequacy decision post Brexit. Whether Japan would automatically extend its adequacy decision in respect of the UK post Brexit is, as yet, unclear.

You can find out more about international transfers and adequacy here.