Law.com Subscribers SAVE 30%
Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.
Will the EU-Japan Data Transfer Partnership Agreement Have Global Influence?
On Jan. 23, 2019, the European Union (EU) issued an adequacy decision regarding free flow of sensitive data with Japan. This is the first adequacy agreement since the General Data Protection Regulation (GDPR) went into effect last May. With countries around the world examining and strengthening their data protection laws, this agreement could be the first of many.
Under the GDPR, the EU can assess other countries' data security initiatives and, if sufficient, issue an adequacy decision that allows uninhibited data transfer between the EU and the other country. This is no small task, as the European Commission has to research the other country's data security measures and submit a proposal, receive input from the European Data Protection Board, gain approval from all EU countries, and ultimately adopt the parameters of the agreement. The other country also has to agree that the EU's system is adequate.
Overview of Japan Agreement
Since the GDPR has stringent data privacy regulations, it is important for other countries seeking data transfer partnerships with the EU to know what constitutes adequacy. While the other country's system does not need to be the same as the GDPR, it needs to be essentially equivalent to pass the test. To meet this bar, Japan implemented extra safeguards including:
- Creating supplementary rules that address the differences between Japan and EU data security measures. These rules are binding on Japanese organizations and enforceable by Japan's regulatory body and courts. While Japan recently updated their privacy laws to provide more individual protections, these supplementary rules were necessary to cover any areas not consistent with the GDPR. For example, one rule supplements the definition of “sensitive data” to include sex life, sexual orientation, and trade union membership status to better reflect the GDPR's protections.
- Promising that any personal data obtained for law enforcement or national security will be limited to only what is necessary under the specific circumstances.
- Creating a procedure for investigating and resolving complaints that Europeans make about a Japanese organization accessing their personal data. Japan now has an independent agency that can monitor these complaints, called the Personal Information Protection Commission.
Benefits and Challenges
All of these things ensure that data flowing to and from Japan will enjoy protections in line with the principles of the GDPR, thus protecting individual privacy. Business in both Japan and EU countries will also greatly benefit from this partnership, which further strengthens their economic relationship. Benefits from the adequacy decision include:
- Free and safe data transfers between organizations situated in Japan and EU countries;
- Direct access to consumers living in Japan and the EU;
- Data access and rights for EU consumers with data in Japan. This includes the right to find out how organizations use their data, the right to request access to their data, and the ability to change errors; and
- Potential for global data governance.
However, there may also be some challenges associated with this partnership. For example, Japan may have to deal with data subject access requests (DSARs) — requests individuals can make to any organization to identify, change and/or delete their personal data. While the adequacy decision does not specifically address DSARs, it does ensure that EU consumers will have similar procedures to make complaints about how Japan uses their personal data and seek redress, if necessary.
Another challenge could be ensuring consistent compliance with the terms of the adequacy decision. The EU will be monitoring the situation closely to ensure that Japan satisfies the terms of the agreement. In two years, there will be a joint review to see how well data transfers are operating. This will include a comprehensive review of the adequacy decision and how it was applied in practice for the first two years. Subsequently there must be a review at least every four years. It is unclear what would trigger a review to take place before each four year mark, however, a significant change in Japan's privacy standards or a large data breach would probably cause the need for an earlier review. The EU can even choose withdraw the adequacy decision if Japan's data privacy model changes or anything comes up that affects the data privacy promised under the agreement.
This premium content is locked for Entertainment Law & Finance subscribers only
ENJOY UNLIMITED ACCESS TO THE SINGLE SOURCE OF OBJECTIVE LEGAL ANALYSIS, PRACTICAL INSIGHTS, AND NEWS IN ENTERTAINMENT LAW.
- Stay current on the latest information, rulings, regulations, and trends
- Includes practical, must-have information on copyrights, royalties, AI, and more
- Tap into expert guidance from top entertainment lawyers and experts
Already a have an account? Sign In Now Log In Now
For enterprise-wide or corporate acess, please contact Customer Service at [email protected] or 877-256-2473
Yachts, Jets, Horses & Hooch: Specialized Commercial Leasing Models
Defining commercial real estate asset class is essentially a property explaining how it identifies — not necessarily what its original intention was or what others think it ought to be. This article discusses, from a general issue-spot and contextual analysis perspective, how lawyers ought to think about specialized leasing formats and the regulatory backdrops that may inform what the documentation needs to contain for compliance purposes.
Hyperlinked Documents: The Latest e-Discovery Challenge
As courts and discovery experts debate whether hyperlinked content should be treated the same as traditional attachments, legal practitioners are grappling with the technical and legal complexities of collecting, analyzing, and reviewing these documents in real-world cases.
Identifying Your Practice's Differentiator
How to Convey Your Merits In a Way That Earns Trust, Clients and Distinctions Just as no two individuals have the exact same face, no two lawyers practice in their respective fields or serve clients in the exact same way. Think of this as a "Unique Value Proposition." Internal consideration about what you uniquely bring to your clients, colleagues, firm and industry can provide untold benefits for your law practice.
Risks and Ad Fraud Protection In Digital Advertising
The ever-evolving digital marketing landscape, coupled with the industry-wide adoption of programmatic advertising, poses a significant threat to the effectiveness and integrity of digital advertising campaigns. This article explores various risks to digital advertising from pixel stuffing and ad stacking to domain spoofing and bots. It will also explore what should be done to ensure ad fraud protection and improve effectiveness.
Turning Business Development Plans Into Reality
This article offers practical insights and best practices to navigate the path from roadmap to rainmaking, ensuring your business development efforts are not just sporadic bursts of activity, but an integrated part of your daily success.