MEPs assess data protection level in Japan
In their assessment of the Commission’s draft adequacy decision on Japan, MEPs demand further clarifications to ensure safe data transfers to Japan.
In the resolution, adopted by 516 to 26, with 11 abstentions, MEPs give their input to the draft adequacy decision on the protection of personal data afforded by Japan. This decision, to be taken by the Commission, would allow the free flow of personal data from the EU to Japan without further safeguards or authorisations.
The adequacy decision would further facilitate commercial exchanges between Japan and the EU and complement the benefits of the Economic Partnership Agreement approved by the European Parliament yesterday.
Further clarifications needed
MEPs consider that the Japanese and EU data protection systems share a high degree of convergence in terms of principles, safeguards and individual rights, as well as oversight and enforcement mechanisms.
However, they note that there are some relevant differences between the two systems especially in regards to the definition of ‘personal data’ and ‘personal information’, rules on automated decision-making and profiling, direct marketing, onward transfers and on sanctions for infringements. MEPs call on the Commission to provide further clarifications on these topics. If necessary, Japanese authorities should be requested to provide additional binding rules in order to ensure that the level of data protection in Japan is comparable to that in the EU.
In their resolution, MEPs also express worry over Japanese mass surveillance facilities “that eavesdrop around the clock on phone calls, emails, and other communications” and call on the Commission to provide more information about this.
Finally, MEPs highlight that the adequacy decision can send out a strong signal to countries around the world that convergence with the EU’s high data protection standards and that it acts as a precedent for future partnerships.
Civil Liberties Committee Chair and rapporteur Claude Moraes (S&D, UK) said: "With the simultaneous development of an agreement on personal data transferred from Japan to the EU, this would result in the first ever “two-way” adequacy finding leading to the creation of the world’s largest area of free and safe data flows. This is to be welcomed, particularly as new developments in big data, robotics, and artificial intelligence make it increasingly important that strong data protection systems in place. As such, we call on the Commission to provide further clarifications in order to ensure that all personal data are protected when transferred to Japan under the definitions of the GDPR.”
An adequacy decision is a decision taken by the European Commission establishing that a third country provides a comparable level of data protection to that in the EU. As a result of such a decision, personal data can flow safely from the EU and the European Economic Area to that non-EU country, without further safeguards or authorisations.
The Commission aims to take the adequacy decision on the protection of personal data by Japan towards the end of this year. Japan is also preparing the recognition of the level of protection of personal data transferred from Japan to the EU.