Key takeaways from the European Commission (EC) decision holding Japan as providing adequate protection to personal data:
- Japan ensures an adequate level of protection for personal data transferred from the EU Japan pursuant to the Japanese Act on the Protection of Personal Information (APPI) as complemented by the stricter Supplementary Rules and official representations, assurances and commitments received from Japan.
- The Personal Information Protection Commission (PPC) is empowered to adopt “Guidelines” for the actions to be taken by a business operator under the data protection rules.
- To comply with the Supplemental Rules, Japanese business operators receiving and/or further processing personal data from the EU need to ensure (e.g. by technical (“tagging”) or organisational means (storing in a dedicated database)) that they can identify such personal data throughout their “life cycle.”
Excluded from the adequacy decision are:
- broadcasting institutions, newspaper publishers, communication agencies or other press organisations
- professional writers
- universities and academic institutions
- religious bodies
- political bodies
Read the full text of the decision.