As we previously reported the EU and Japan reached a tentative deal last summer to ease data transfer restrictions between them. That deal has now been approved by both the European Commission and by Japan and is effective immediately. When the tentative deal was reached, Japan promised to add several new data protection safeguards. Those included new individual rights and limits on further transfers to third countries. Japan also agreed to limit government access to personal data, and to give Europeans a way to complain about government access. Japan has now implemented those safeguards. As a result, the European Commission has decided that Japan provides an adequate level of protection for personal data under the EU’s General Data Protection Regulation. This means that personal data can now be transferred freely between the EU and Japan. The decision will be jointly reviewed in two years, and then every four years thereafter. It is the first adequacy decision under GDPR.

The EU has recognized very few countries as having adequate protections for personal data. Those countries are Andorra, Argentina, Canada (commercial organizations only), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, and Uruguay.

The recognition of Japan is notable as the first mutual recognition. The new free exchange of personal data between the EU and Japan is a part of the EU-Japan trade agreement which is expected to come into effect in February 2019.

Putting it Into Practice: companies transferring data between EU and Japan will find this new recognition extremely helpful. Keep in mind also that several other countries have been deemed “adequate” by the EU.