The Realization of Mutual Adequacy Recognition Between Japan and the EU and Issues Raised in the Process

Abstract

On 23 January 2019, the safe and smooth transborder transfer of personal data was realized between Japan and the European Union (EU). This mutual adequacy decision was the first in the world, and Japan was the first to be certified under Article 45 of the General Data Protection Regulation (GDPR). The EU and European Economic Area (EEA) (Iceland, Liechtenstein and Norway) were also the first in the world to be certified by Japan under Article 24 of the 2015 Amended Act on the Protection of Personal Information (APPI). It is the first mutual adequacy decision in the world and in the history of data protection. The PPC’s dialogue and cooperation with the European Commission started in 2016 and further dialogue continued in 2017. In the first half of 2018, two important issues were raised. One was how to bridge differences between two systems, and the other was how to deal with access and use of personal data transferred from the EU by public authorities in Japan. The APPI only covers the private sector and the PPC does not deal with the handling of personal data by public authorities. These solutions are explained in the article. adequacy decision, mutual recognition, cross-border data flows, independent institution, Personal Information Protection Act, Waseda University, Benesse Data Breach