26 Amendments of Daniel DALTON related to 2018/2904(RSP)
Amendment 1 #
Recital D
D. whereas Japan is one of the EU’s key trading partners, with which it has recently concluded an Economic Partnership Agreement (EPA) that enshrines shared values and principles while safeguarding the sensitivities of both partners; whereas the common recognition of fundamental rights, including privacy and data protection, constitutes an important basis for the Adequacy Decision which will provide the legal basis for the transfer of personal data from the EU to Japan;
Amendment 2 #
Recital I
I. whereas Japan has recently modernised and strengthened its data protection legislation to align it with international standards, in particular with the safeguards and individual rights provided by the new European data protection legislative framework; whereas the Japanese data protection legal framework is composed of various pillars, with the Act on Protection of Personal Information (APPI) being the central piece of legislation;
Amendment 5 #
Recital J
J. wWhereas the Commission reports that with, as regards a view to facilitating international data transfers, the Cabinet of Japan adopted a Cabinet Decision on 12 June 2018 that delegates to the Personal Information Protection Commission (PPC), as the authority competent for administering and implementing the APPI, ‘the power to take the necessary action to bridge differences of the systems and operations between Japan and the concerned foreign country based on Article 6 of the Act in view of ensuring appropriate handling of personal information received from such country’; whereas this decision stipulates that this includes the power to establish enhanced protections through the adoption by the PPC of stricter rules supplementing and going beyond those laid down in the APPI and the Cabinet Order; whereas pursuant to this decision, these stricter rules would be binding and enforceable on Japanese business operators; whereas the Commission has not provided the text of this decision as part of the elements on which it has based its evaluation;
Amendment 8 #
Recital K
K. whereas the draft Commission implementing decision on the adequate protection of personal data by Japan is accompanied by, as Annex I thereto, the Supplementary Rules adopted by the PPC on 15 June 2018, which are based on Article 6 of the APPI, which explicitly allows the PPC to adopt stricter rules, including for the purpose of facilitating international data transfers; whereas the version of the Supplementary Rules provided by the Commission does not bear any official signature of the PPC; whereas the Supplementary Rules are not available on the official PPC websitewere adopted by the PPC on 15 June 2018 further to a public consultation and will be published upon the adoption of the adequacy decision;
Amendment 10 #
Recital M
M. whereas the Commission states that the Supplementary Rules would bSupplementary Rules stipulate that they are legally binding on any personal information-handling business operator which receives personal data transferred from the EU on the basis of an adequacy decision and is therefore required to comply with those rules and any related rights and obligations, and that they would be enforceable by both the PPC and the Japanese courts; whereas some Japanese experts question whether the Supplementary Rules are binding;
Amendment 12 #
Recital O
O. whereas the Japanese data protection legal framework makes a distinction between ‘personal information’ and ‘personal data’ and refers, for some cases, to a specific category of personal data, namely ‘retained personal data’; whereas this distinction differs from the notion of ‘personal data’ under the GDPR but these differences are, to the extent that they are relevant in the context of international transfers, fully addressed by the Supplementary Rules;
Amendment 13 #
Recital P
P. whereas, according to Article 2(1) of the APPI, the concept of ‘personal information’ includes any information relating to a living individual which enables the identification of that individual; whereas the definition distinguishes two categories of personal information: (i) individual identification codes, and (ii) other personal information whereby a specific individual can be identified; whereas the latter category includes information which by itself does not enable identification but can, when ‘readily collated’ with other information, allow the identification of a specific individual; whereas according to the PPC guidelines the situation and the efforts required, inter alia in terms of time and cost, have to be assessed for each individual case and therefore, the approach is similar to that under the GDPR;
Amendment 14 #
Recital Q
Q. whereas, according to Article 2(6) of the APPI, ‘personal data’ means personal information constituting a personal information database, etc. defined in Article2(4) of the APPI as a "collective body of information" that is systematically organised which is similar to the concept of a structured"filing system" under Article 2(1) of the GDPR read in combination with its Recital 15; whereas according to Article 4(1) of the GDPR, ‘personal data’ means any information relating to an identified or identifiable natural person; whereas an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; whereas in order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person, to identify the natural person directly or indirectly;
Amendment 16 #
Recital R
R. whereas, according to Article 2(7) of the APPI, ‘retained personal data’ means personal data which a personal information-handling business operator has the authority to disclose, correct, add or delete the contents of, cease the utilisation of, erase, or cease the third-party provision of, and which shall be neither those prescribed by cabinet order as likely to harm the public or other interests if their presence or absence is made known, nor those set to be deleted within a period of no longer than one year that is prescribed by cabinet order; whereas the Supplementary Rules align the notion of 'retained personal data' with the notion of 'personal data' to ensure that certain limitations to individual rights attached to the former will not apply to data transferred from the EU;
Amendment 17 #
Recital S
S. wWhereas, the Japanese data protection law, which is the object of the draft implementing dDecision excludes from itsthe scope of the Act several sectors when they process personal data for specific purposes, as well as personal data that are not part of an electronicbut all filing system (i.e.s, manual filing systems); whereas the draft implementing decision would not apply to the transfer of personal data from the EU to a recipient falling within anyor electronic, are covered by Art. 2(4) of the APPI in combination with Art. 3(2) of the Cabove-mentioned exceptions provided for by Japanese data protection law;inet Order.
Amendment 21 #
Recital V
V. whereas the discussions and assessment of the Japanese data protection legislation have been conducted on the basis of English translations of the Japanese acts provided by the Japanese authorities, with the Japanese language version remaining the official/authentic tex that have been systematically verified by the Commission's translation services to ensure legal certainty, with the Japanese language version remaining the official/authentic text due to the fact that Japanese is the official language of Japan while English is not; whereas the publicly available English version of the main data protection act (the APPI) bears the notice that it is a tentative translation which has not been checked either by a native English speaker or by a legal language editor, and thus may be subject to change, being presented for non-Japanese speakers’ ease of understanding and reference; whereas several other Japanese legal references made in the draft implementing decision to demonstrate the adequacy of the data protection framework concern texts that are not publicly available in English;
Amendment 22 #
Paragraph 4
4. Points out that, in this regard, the European Court of Justice has ruled in the Schrems case that ‘even though the means to which that third country has recourse, in this connection, for the purpose of ensuring such a level of protection may differ from those employed within the European Union in orthat “the term ‘adequate level of protection’ does not require an identical level of protection that that guaranteed in the EU, but must be under sto ensureod as requiring thate the requirements stemmird country ing from Directive 95/46 [the GDPR] read in the light of the Charter are complied with, those means must nevertheless prove, in practice, effective in order to ensure protectionact to ensure, by reason of its domestic law or its international commitments, a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union’ by virtue of the GDPR read in the light of the Charter”;
Amendment 25 #
Paragraph 5
5. Notes that the right to privacy and to the protection of personal data is guaranteed at constitutional level both in Japan and in the EU, but that a complete alignment of the rules of the EU and Japan will not be possible given the differences in constitutional structure, legal traditions as well as culture and associated societal choices;
Amendment 26 #
Paragraph 7
7. Notes that the material scope of the adequacy finding is not sufficiently defined in Article 1 of the draft implementing decision, owing to the fact that the APPI excludes from its material scope several categories of business and processing activities; calls on the Commission to provide further and detailed clarifications on the impact of such exclusions on EU personal data transferred to Japan, and to clearly specify in Article 1 of the draft implementing decision which transfers of EU personal data are covered by the adequacy decision, indicating that for transfers of personal data by manual processing, the processing operations concerned would have to be covered where they are subject to further electronic processing in Japancategories of business and processing activities that are excluded from the material scope of the APPI have been expressly excluded from the scope of the Adequacy finding;
Amendment 29 #
Paragraph 10
10. Notes that no official English translation of the Supplementary Rules had been made publicly available before the Commission’s announcement of the draft adequacy decision on 17 July 2018; stresses the importance of (draft) third- couthe text of the Supplementary Rules is annexed to the draft adequacy decision, moreover the Supplementary legislation being publicly available in official English translation before any draft adequacy decisions based on the documents concerned can be announced; calls on the Commission to put forward draft adequacy decisions for third countries only after an official English translation of the key (draft) legislation in the third country has been made publicly available and after the translated documents have been shared withRules have been negotiated in English between the European Commission and PPC, and their Japanese translation has been verified by the Commission's translation services; these are available to stakeholders, in order to ensure legal certainty and transparency;
Amendment 31 #
Paragraph 11
Amendment 36 #
Paragraph 13
13. Considers that as the additional protections of the Supplementary Rules cover only transfers under adequacy decisions, personal data transferred from the EU pursuant to any other GDPR basis (i.e. Articles 46 to 49) would not benefit from those protections; believes this would create a different level of protection for EU citizens, thus undermining the other mechanisms that can be used to transfer personal data; recalls that in view of the scope of the adequacy decision, some data transfers will be conducted under these other available mechanisms;
Amendment 44 #
Paragraph 15
15. Notes that the definition of ‘personal data’ in the APPI excludes data ‘prescribed by cabinet order as having little possibility of harming an individual’s rights and interests considering their utilisation method’; is concerned that this harm-based approach is in clear contradiction with the EU approach under which all processing of personal data falls within the scope of data protection law; but also notes that this concerns very limited situations;
Amendment 45 #
Paragraph 16
16. Notes further that the definition of ‘personal information’ in the APPI is limited toncludes information ‘whereby a specific individual can be identified’; also notes that this definition does not include the clarification provided by the GDPR that personal information should also be considered personal data when it can be merely used to ‘single out’ a person, as clearly established by the European Court of Justice;
Amendment 47 #
Paragraph 17
Amendment 50 #
Paragraph 18
Amendment 54 #
Paragraph 21
21. Considers that regarding onward transfers, although the combination of the APPI rules and the Supplementary Rules would ensure a level of protection higher than that provided under the APEC CBPR, the solution provided in the Supplementary Rules, which consists of requiring prior consent on the part of EU data subjects for approval of onward transfer to a third party in a foreign country lacks certain essential elements that would enable data subjects to formul; and that the consequence of a refusal to consent would be thate their consent, as it does not expressly define what is covered by the notion of ‘information on the circumstances surrounding the transfer necessary for the [data subject] to make a decision on his/her consent’, in line with Article 13 of the GDPR, such as the third country of destination of the onward transfer; notes that in addition, the draft implementing decision does not explain the consequences for the data subject in case of refusal of consent for onward transfer of his or her personal data Japanese business operator would be prohibited for onward transferring the personal data in question;
Amendment 58 #
Paragraph 22
Amendment 60 #
Paragraph 23
Amendment 68 #
Paragraph 25
25. Notes that under the Japanese Act on the Protection of Personal Information held by Administrative Organs (APPIHAO), business operators can also hand data over to law enforcement authorities on a ‘voluntary basis’; points out that this is not foreseen in the GDPR or the Police Directive and is concerned that it might not be compliant with the standard of being ‘essentially equivalent’ to the GDPR;
Amendment 72 #
Paragraph 27
27. RegretNotes that the document ‘Collection and use of personal information by Japanese public authorities for criminal law enforcement and national security purposes’, which forms part of Annex II to the draft implementing decision, does not have the same legally binding effect as the Supplementary Ruleprovides representations and assurances on the rules applying to government access to data, and contains commitments such as regarding concerning the creation of a specific mechanism, administrated and supervised by PPC, to handle and resolve complaints;