30 Amendments of Michał BONI related to 2018/2904(RSP)
Amendment 1 #
Recital D
D. whereas Japan is one of the EU’s key trading partners, with which it has recently concluded an Economic Partnership Agreement (EPA) that enshrines shared values and principles while safeguarding the sensitivities of both partners; whereas the common recognition of fundamental rights, including privacy and data protection, constitutes an important basis for the Adequacy Decision which will provide the legal basis for the transfer of personal data from the EU to Japan;
Amendment 2 #
Recital I
I. whereas Japan has recently modernised and strengthened its data protection legislation to align it with international standards, in particular with the safeguards and individual rights provided by the new European data protection legislative framework; whereas the Japanese data protection legal framework is composed of various pillars, with the Act on Protection of Personal Information (APPI) being the central piece of legislation;
Amendment 4 #
Recital J
J. whereas the Commission reports that with a view to facilitatinge international data transfers, the Cabinegovernment of Japan adopted a Cabinet Decision on 12 June 2018 that delegates to the independent Personal Information Protection Commission (PPC), as the authority competent for administering and implementing the APPI, ‘the power to take the necessary action to bridge differences of the systems and operations between Japan and the concerned foreign country based on Article 6 of the Act in view of ensuring appropriate handling of personal information received from such country’; whereas this decision stipulates that this includes the power to establish enhanced protections through the adoption by the PPC of stricter rules supplementing and going beyond those laid down in the APPI and the Cabinet Order; whereas pursuant to this decision, these stricter rules would be binding and enforceable on Japanese business operators; whereas the Commission has notso far only provided the text of this decision as part of the elements on which it has based its evaluation to the EDPB but not to the Parliament;
Amendment 6 #
Recital K
K. whereas the draft Commission implementing decisionPPC, pursuant to Article 6 onf the adequate protection of personal data by Japan is accompanied by, as Annex I thereto, theAPPI which explicitly empowers it to establish stricter rules, adopted Supplementary Rules adopted by the PPC on 15 June 2018, which are based on Article 6 of the APPI, which explicitly allows the PPC to adopt stricter rules, including for the purpoprovide for a higher level of protection of personal data received from the EU based of facilitating international data transfers; whereas the versn an adequacy decision; whereas an English translation of these Supplementary Rules, which was provided byto the Commission does not bear any official signature of the PPC; whereas the Supplementary Rules are not available on the official PPC websiteby the PPC and subsequently verified by the Commission services, is annexed to the Commission draft implementing decision on the adequate protection of personal data; whereas the Japanese authorities intend to make the Rules available on the official PPC website upon the adoption of the adequacy decision by the Commission;
Amendment 11 #
Recital M
M. whereas the Commission states thatit is explicitly stated in the Supplementary Rules would bthat they are legally binding on any personal information- handling business operator which receives personal data transferred from the EU on the basis of an adequacy decision and that any such business is therefore required to comply with those rules and any related rights and obligations, and that theyse rules would be enforceable by both the PPC and the Japanese courts; whereas some Japanese experts question whether the Supplementary Rules are binding;
Amendment 12 #
Recital O
O. whereas the Japanese data protection legal framework makes a distinction between ‘personal information’ and ‘personal data’ and refers, for some cases, to a specific category of personal data, namely ‘retained personal data’; whereas this distinction differs from the notion of ‘personal data’ under the GDPR but these differences are, to the extent that they are relevant in the context of international transfers, fully addressed by the Supplementary Rules;
Amendment 13 #
Recital P
P. whereas, according to Article 2(1) of the APPI, the concept of ‘personal information’ includes any information relating to a living individual which enables the identification of that individual; whereas the definition distinguishes two categories of personal information: (i) individual identification codes, and (ii) other personal information whereby a specific individual can be identified; whereas the latter category includes information which by itself does not enable identification but can, when ‘readily collated’ with other information, allow the identification of a specific individual; whereas according to the PPC guidelines the situation and the efforts required, inter alia in terms of time and cost, have to be assessed for each individual case and therefore, the approach is similar to that under the GDPR;
Amendment 15 #
Recital Q
Q. whereas, according to Article 2(64) of the APPI, ‘personal data’ means personal information constituting a personal information database, etc., whereby Article 2(1) of the APPI specifies that the information in such databases is systematically arranged, which is similar to the concept of a filing system under Article 2(1)of the GDPR; whereas according to Article 4(1) of the GDPR, ‘personal data’ means any information relating to an identified or identifiable natural person; whereas an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; whereas in order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person, to identify the natural person directly or indirectly;
Amendment 16 #
Recital R
R. whereas, according to Article 2(7) of the APPI, ‘retained personal data’ means personal data which a personal information-handling business operator has the authority to disclose, correct, add or delete the contents of, cease the utilisation of, erase, or cease the third-party provision of, and which shall be neither those prescribed by cabinet order as likely to harm the public or other interests if their presence or absence is made known, nor those set to be deleted within a period of no longer than one year that is prescribed by cabinet order; whereas the Supplementary Rules align the notion of 'retained personal data' with the notion of 'personal data' to ensure that certain limitations to individual rights attached to the former will not apply to data transferred from the EU;
Amendment 19 #
Recital S
S. whereas the Japanese data protection law which is the object of the draft implementing decision excludes from its scope several sectors when they process personal data for specific purposes, as well as personal data that are not part of an electronic filing system (i.e. manual filing systems); whereas the draft implementing decision would not apply to the transfer of personal data from the EU to a recipient falling within any of the above-mentioned exceptions provided for by Japanese data protection law;
Amendment 21 #
Recital V
V. whereas the discussions and assessment of the Japanese data protection legislation have been conducted on the basis of English translations of the Japanese acts provided by the Japanese authorities, with the Japanese language version remaining the official/authentic tex that have been systematically verified by the Commission's translation services to ensure legal certainty, with the Japanese language version remaining the official/authentic text due to the fact that Japanese is the official language of Japan while English is not; whereas the publicly available English version of the main data protection act (the APPI) bears the notice that it is a tentative translation which has not been checked either by a native English speaker or by a legal language editor, and thus may be subject to change, being presented for non-Japanese speakers’ ease of understanding and reference; whereas several other Japanese legal references made in the draft implementing decision to demonstrate the adequacy of the data protection framework concern texts that are not publicly available in English;
Amendment 23 #
Paragraph 4
4. Points out that, in this regard, the European Court of Justice (ECJ) ruled in the Schrems case that ‘even though the means to which that third country has recourse, in this connection, for the purpose of ensuring such a level of protection may differ from those employed within the European Union in order to ensure that the requirements stemming from Directive 95/46 [the GDPR] read in the light of the Charter are complied with, those means must nevertheless prove, in practice, effective in order to ensure protection essentially equivalent to that guaranteed within the European Union’; recalls that the notion of 'essential adequacy' as defined by the ECJ does not require the rules of the third country to be identical to the European rules;
Amendment 25 #
Paragraph 5
5. Notes that the right to privacy and to the protection of personal data is guaranteed at constitutional level both in Japan and in the EU, but that a complete alignment of the rules of the EU and Japan will not be possible given the differences in constitutional structure, legal traditions as well as culture and associated societal choices;
Amendment 26 #
Paragraph 7
7. Notes that the material scope of the adequacy finding is not sufficiently defined in Article 1 of the draft implementing decision, owing to the fact that the APPI excludes from its material scope several categories of business and processing activities; calls on the Commission to provide further and detailed clarifications on the impact of such exclusions on EU personal data transferred to Japan, and to clearly specify in Article 1 of the draft implementing decision which transfers of EU personal data are covered by the adequacy decision, indicating that for transfers of personal data by manual processing, the processing operations concerned would have to be covered where they are subject to further electronic processing in Japancategories of business and processing activities that are excluded from the material scope of the APPI have been expressly excluded from the scope of the Adequacy finding;
Amendment 30 #
Paragraph 10
10. Notes that no official English translation of the Supplementary Rules had been made publicly available before the Commission’s announcement of the draft adequacy decision on 17 July 2018; stresses the importance of (draft) third- country legislation being publicly available in official English translation before any draft anotes however that the official version has been made available in September, when the negotiations for the Adequacy dDecisions based on the documents concerned can be announced; calls on the Commission to put forward draft adequacy decisions for third countries only after a were concluded; stresses the importance of (draft) third-country legislation being publicly available in official English translation of the kebefore any (draft) legislation in the third country has been made publicly available and after the translated documents have been shared with stakeholders, in order to ensure legal certainty and adequacy decisions based on the documents concerned can be announced in order to ensure transparency;
Amendment 32 #
Paragraph 11
Amendment 38 #
Paragraph 13
13. Considers that as the additional protections of the Supplementary Rules cover only transfers under adequacy decisions, personal data transferred from the EU pursuant to any other GDPR basis (i.e. Articles 46 to 49), would not benefit from those protections; believes this would create a different level of protection for EU citizens, thus undermining the other mechanisms that can be used to transfer personal datahich foresee inter alia safeguards such as oversight by EU DPAs, will apply only in limited cases once the adequacy decision is in place; recalls that in view of the scope of the adequacy decision, some data transfers will be conducted under these other available mechanisms;
Amendment 40 #
Paragraph 14
14. Acknowledges that the additional protections stipulated in the Supplementary Rules are limited to personal data transferred from Europe and therefore do not seem applicable to Japanese personal data or to personal data transferred from other third countries, hence creating practical problems for business operators who have to simultaneously process Japanese and European personal data, forcing them to create dual databases and procedures; invites the Commission to assess whether this dual degree of protectio, hence business operators who have to simultaneously process Japanese and European personal data will be obliged to comply with the Supplementary Rules, by ensuring e.g. technical ("tagging") or organisational means (e.g. storing in a dedicated database) in for Japanese and third-country data subjects is in line with the GDPR requirements and the ‘essential equivalence’ standard set by the Court of Justice and to assess ifder to be able to identify such personal data throughout their "life cycle"; calls on the Commission to monitor thise situation might lead to ato prevent potential loopholes whereby operators circumvent the obligations laid down in the Supplementary Rules by transferring data via third countries; calls on the Commission, therefore, to address these issues as soon as possible;
Amendment 42 #
Paragraph 15
15. Notes that the definition of ‘personal data’ in the APPI excludes data ‘prescribed by cabinet order as having little possibility of harming an individual’s rights and interests considering their utilisation method’; is concerned that this harm-based approach is in clear contradiction with the EU approach under which all processing of personal data falls withrecalls however that this exception concerns very limited situations and is further specified in Article 3(1) of the Cabinet Order, according to which strict cumulative conditions must be fulfilled; notes that according to the explanations the Commission received from the PPC, this circumscribed exception was introduced with the aim of excluding the scope of data protection law; elephone books or similar type of directories;
Amendment 46 #
Paragraph 16
16. Notes further that the definition of ‘personal information’ in the APPI is limited tocovers all information ‘whereby a specific individual can be identified’; also notes therefore that this definition does not include the clarification provided by the GDPRis in line with the GDPR which foresees that personal information should also be considered personal data when it can be merely used to ‘single out’ a person, as clearly established by the European Court of Justice;
Amendment 49 #
Paragraph 17
17. Is concerned that the narrower definition of ‘personal data’ (based on the definition of ‘personal information’) in the APPI might not meet the standard of being ‘essentially equivalent’ to the GDPR and to the case law of the European Court of Justice; questions, therefore, the statement in the draft implementing decision that ‘EU data will always fall into the category of “personal data” under the APPI’; calls on the Commission to closely monitor the practical implications of the different concepts in the course of the application of the adequacy decision and its periodic review;
Amendment 52 #
Paragraph 18
18. Calls on the Commission to require further clarifications, including further binding sand the Japanese authorities to monitor the application of the Supplementary rRules, from the Japanese authorities in order to ensure that all personal data in the meaning of the GDPR are protected when transferred to Japan from the EU;
Amendment 53 #
Paragraph 19
19. Notes with concern that as regards automated decision-making and profiling, differently from EU law, neither the APPI nor the Guidelines contain legal provisions, and that only certain sectoral rules address this matter, without providing a comprehensive overall legal framework with substantial and strong protections against automated decision-making and profiling; recalls on the Commission to demonstrate how this is addressed in the Japanese data protection framework in such a way as to ensure an equivalent level of protection; considers that this is especiallyhowever that these sectoral rules concern the sectors in which such type of processing is most relevant givein the recent Facebook/Cambridge Analytica profiling casescontext of international transfers, such as the financial sector;
Amendment 55 #
Paragraph 21
21. Considers that regarding onward transfers, although the combination of the APPI rules and the Supplementary Rules would ensure a level of protection higher than that provided under the APEC CBPR,; notes that the solution provided in the Supplementary Rules, which consists of requiring prior consent on the part of EU data subjects for approval of onward transfer to a third party in a foreign country lacks certain essential elements that would enable data subjects to formulate their consent, as it does not expressly define what is covered by the notion of ‘information on the circumstances surrounding the transfer necessary for the [data subject] to make a decision on his/her consent’, in line with Article 13 of the GDPR, such as the third country of destination of the onward transfer; notes that in addition, the draft implementing decision does not explain t, requires that the data subject is provided information on the fact that his/her data is being transferred to a third country and which is the country of destination in order to be able to express his/her consequences for the data subject in case of refusal of consent for onward transfer of his or her personal datant in an informed manner, in line with Article 13 of the GDPR;
Amendment 59 #
Paragraph 22
22. Calls on the Commission to further assess and demonstrate whether the independence of the PPC fully complies with the requirements developed through the case law of the European Court of Justice and reflected in the GDPRNotes that the independence of the PPC is guaranteed by the APPI and is subject to safeguards as regards inter alia the appointment and dismissal of its members;
Amendment 62 #
Paragraph 23
23. RegretNotes that, as regards effective enforcement of the APPI, the level of possible fines that would be imposed by the penal authorities is insufficient to ensure effective compliance with the Act, as it does not seem to be proportionate, effective or dissuasive in relation to the gravity ofsignificantly lower than under the GDPR; notes, however, that the APPI provides for other types of sanctions not required by the GDPR, such as criminal sanctions, which are an equivalent deterrent; recalls theat infringement; calls accordance with the case law onf the Commission to ensure that the level of fines should be aligned with the GDPREuropean Court of Justice ‘essential adequacy’ does not require the rules of the third country to be identical to the European rules;
Amendment 64 #
Paragraph 24
24. Regrets that there is no independent authority overseeingTakes note that while the PPC has no oversight of the data processing activities of the law enforcement sector; points out that the PPC has no competence over this, other supervision mechanisms exist, including oversight by the independent Prefectural Public Safety Commission; notes that the Information Disclosure and Personal Information Protection Review Board has also some competences in this field, including reviewing access requests and publishing opinions, but points out that these powers are not legally binding; welcomes that the EU and Japan have agreed to put in place a specific redress mechanism, administered and supervised by the PPC, which will apply to the processing of personal data in law enforcement and national security sectors;
Amendment 69 #
Paragraph 25
25. Notes that under the Japanese Act on the Protection of Personal Information held by Administrative Organs (APPIHAO), business operators can also hand data over to law enforcement authorities on a ‘voluntary basis’; points out that this is not foreseen in the GDPR or the Police Directive and is concerned that it might not be compliant with the standard of being ‘essentially equivalent’ to the GDPR, subject to adequate conditions, limitations and safeguards, such as inter alia a proportionality test;
Amendment 71 #
Paragraph 26
26. Is aware of media reports about the Japanese Directorate for Signals Intelligence (DFS), ‘which employs about 1 700 people and has at least six surveillance facilities that eavesdrop around the clock on phone calls, emails, and other communications’6 ; is worri, and is the intelligence agency of the Japanese military forces whose main task is to monitor among others radio and satellite communications of hostile military forces; is concerned that this element of indiscriminate mass surveillance is not even mentioned in the draft implementing decision; calls on the Commission to provide more information about Japanese mass surveillance; is seriously worried that this mass surveillance will not stand the test of the criteria established by the European Court of Justice in the Schrems judgment; notes however that the Japanese government has rules out any form of mass and indiscriminate collection and access to personal information handled by a business operator following a transfer; _________________ 6 Ryan Gallagher, ‘The Untold Story of Japan’s Secret Spy Agency’, The Intercept, 19 May 2018, https://theintercept.com/2018/05/19/japan- dfs-surveillance-agency/
Amendment 73 #
Paragraph 27
27. RegretsTakes note that the document ‘Collection and use of personal information by Japanese public authorities for criminal law enforcement and national security purposes’, which forms part of Annex II to the draft implementing decision, does not have the same legally biforesees putting in place a specific mechanism for handling effect as the Supplementary Rulesand resolving complaints made by Europeans, which will be administered and supervised by PPC;