European UnionJapan Adequacy Decision, Commission Implementing Decision (EU) 2019/419
Commission Implementing Decision (EU) 2019/419
In force since .
A cross border transfer rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Transfer
- Audit expectation
- periodic
- Who audits it
- Regulator
As of .
What it requires
- A transfer of personal data from the European Union to a personal information handling business operator in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules in Annex I may take place on the basis of Article 1(1) of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).
- The finding does not cover a transfer to a broadcasting institution, newspaper publisher, communication agency or other press organization, a person engaged in professional writing, a university or other academic organization, a religious body or a political body, to the extent the purposes of processing correspond to the purpose listed for that category (Article 1(2)).
Who enforces it
Enforcement body
The competent authorities of the Member States, which exercise their powers under Article 58 of Regulation (EU) 2016/679 and inform the Commission of any suspension or definitive ban of data flows to a business operator in Japan (Article 2), and the Commission, which monitors the application of the legal framework and may suspend, amend or repeal the Decision (Article 3).
What this law does
Article 1(1) provides that, for the purposes of Article 45 of Regulation (EU) 2016/679, Japan ensures an adequate level of protection for personal data transferred from the European Union to personal information handling business operators in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules set out in Annex I, together with the official representations, assurances and commitments contained in Annex II.
Article 1(2) provides that the Decision does not cover personal data transferred to broadcasting institutions, newspaper publishers, communication agencies or other press organizations, persons engaged in professional writing, universities and other academic organizations, religious bodies or political bodies, to the extent the purposes of processing correspond to the press, writing, academic, religious or political purposes listed.
Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 leading to the suspension or definitive ban of data flows to a specific business operator in Japan within the scope of Article 1 to inform the Commission without delay.
Article 3(4) requires the Commission, within two years from the date of the notification of the Decision to the Member States and subsequently at least every four years, to evaluate the finding in Article 1(1) on the basis of all available information, including the information received as part of the Joint Review carried out together with the relevant Japanese authorities.
Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent Japanese authorities and, if necessary, may decide to suspend, amend or repeal the Decision, or limit its scope, in particular where business operators in Japan do not comply with the additional safeguards in the Supplementary Rules in Annex I or there is insufficient oversight and enforcement in this regard.
Article 4 provides that the Decision is addressed to the Member States. The Commission's report on the first review of the functioning of the Decision (COM(2023) 275 final) concludes that Japan continues to ensure an adequate level of protection for personal data from the European Union to personal information handling business operators in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings or processes biometric data.