The European Parliament adopted by 516 votes to 26 with 11 abstentions a resolution tabled by the Committee on Civil Liberties, Justice and Home Affairs on the adequacy of the protection of personal data afforded by Japan.

Recalling that the EU and Japan launched discussions in January 2017 to facilitate personal data transfers for commercial purposes by means of the first ever ‘mutual adequacy finding’, Parliament noted the detailed analysis provided by the Commission in its draft adequacy implementing decision in relation to the safeguards applicable to the processing of data by commercial operators as well as to access to data by Japanese public authorities, in particular in the area of law enforcement and national security. It pointed out that Japan is also preparing the recognition of the level of protection of personal data transferred from Japan to the EU pursuant to its amended Act on Protection of Personal Information (APPI), which would result in the first ever ‘two-way’ adequacy finding worldwide leading to the creation of the world’s largest area of free and safe data flows.

Parliament considered that, following the adoption of the amendments on the APPI, which entered into force in 30 May 2017, and of the GDPR in 2016, the Japanese and EU data protection systems share a high degree of convergence in terms of principles, safeguards and individual rights, as well as oversight and enforcement mechanisms. It highlighted the creation of an independent supervisory authority, the Personal Information Protection Commission (PPC), through the amended APPI.

However, Members pointed to the concerns expressed by the European Data Protection Board in its opinion of 5 December 2018, such as the protection of personal data transferred from the EU to Japan throughout their life cycle. They also highlighted several aspects of the draft decision that require further clarification, or for which concerns remain.

Clarifications required:

Parliament noted that the definition of ‘personal data’ in the APPI excludes data ‘prescribed by cabinet order as having little possibility of harming an individual’s rights and interests considering their utilisation method’. Whilst noting also that this approach would apply in very limited situations, it urged the Commission to assess whether this harm-based approach is compatible with the EU approach under which all processing of personal data falls within the scope of data protection law. Parliament felt further in-depth clarifications were needed as regards direct marketing , given the lack of specific provisions in the APPI, in order to demonstrate the Japanese equivalent level of personal data protection. As regards automated decision-making and profiling , Parliament noted that in contrast to EU law, neither the APPI nor the PPC Guidelines contain legal provisions and that there is no comprehensive overall legal framework with substantial and strong protections against automated decision-making and profiling. It called on the Commission to demonstrate how this is addressed in the Japanese data protection framework in such a way as to ensure an equivalent level of protection, an issue it felt was especially relevant given the recent Facebook/Cambridge Analytica profiling cases. Being aware of media reports about the Japanese Directorate for Signals Intelligence’s indiscriminate mass surveillance , which is not even mentioned in the draft implementing decision, Parliament called on the Commission to provide more information and stated that it was seriously worried that this mass surveillance will not stand the test of the criteria established by the European Court of Justice in the Schrems judgment (Case C-362/14).

Conclusions: Members asked the Commission to provide further evidence and explanation regarding the above-mentioned matters, including those identified by the European Data Protection Board in its opinion of 5 December 2018, in order to demonstrate that the Japanese data protection legal framework ensures an adequate level of protection that is essentially equivalent to that of the European data protection legal framework.

Lastly, the resolution stressed the importance of this adequacy decision as a precedent for future partnerships with other countries that have adopted modern data protection laws, stating that the decision could send out a strong signal to countries around the world that convergence with the EU’s high data protection standards offers very tangible results.