As the trade tensions rise between the United States and China, Japan and the EU signed a “reciprocal adequacy agreement” that recognizes each other’s data protection regimes as equivalent, which will allow personal data to flow safely between them, creating the world’s largest region of secure data flows.
Why is this agreement so important? Cross-border data transfers are indispensable for the business activities of multinational companies. This often involves transferring data to third countries located outside of the EU. However, ensuring an adequate level of privacy in these processing situations has created complex issues for data privacy law.
EU lawmakers have imposed numerous safeguards on cross-border data transfers to ensure an adequate level of data privacy and protection for personal information. Specifically, the GDPR allows the export of personal data from the European Economic Area (“EEA”) to countries whose legal regime is deemed by the European Commission to provide for an “adequate” level of protection. Absent an adequacy decision, personal data may also be transferred outside the EEA through other means such as standard contractual clauses, binding corporate rules, or if an exemption applies.
Despite the EU’s adequacy decisions with several other countries, its agreement with Japan marks the first time that the EU and a third country agreed on reciprocal recognition of the adequate level of data privacy. The president of the European Commission stated, “[w]e are shaping global standards and upholding the fundamental right of data protection.” This new deal with Japan represents how the GDPR continues to shape data protection laws around the world.