Statement 1/2023 on the first review of the functioning of the adequacy decision for Japan

1 Statement 1/2023 on the first review of the functioning of the adequacy decision for Japan Adopted on 18 July 2023 The European Data Protection Board has adopted the following statement: On 3 April 2023, the European Commission issued the report on the first review of the functioning of the adequacy decision for Japan adopted on 23 January 2019, along with a Commission Staff Working Document (SWD(2023) 75) 1 . In its Implementing Decision (EU) 2019/419, the European Commission found, pursuant to Article 45 of Regulation (EU) 2016/679 (GDPR), that Japan ensures an adequate level of protection for personal data transferred from the European Union to businesses handling personal information in Japan 2 . To that end, a review meeting between the Japanese and the EU delegations – preceded and followed-up by numerous exchanges between the Japanese delegation and the European Commission – took place on 26 October 2021.

Three EDPB representatives participated in the meeting, alongside members of the European Commission, and have been consulted on the draft Commission Staff Working Document accompanying the Report to the European Parliament and the Council. uri=SWD:2023:75:FIN 2 According to Article 16(2) of the amended Japanese Act on the Protection of Personal Information (APPI), a business handling personal information is defined as “a person that uses a personal information database or the equivalent for business”, with the exclusion of the government and administrative agencies at both central and local level. 2 Version 1 - Adopted The EDPB welcomes that its representatives have been involved in the review meeting and consulted on the draft Commission Staff Working on which they have provided input, also taking into account the previous opinion 28/2018 regarding the European Commission Draft Implementing Decision on the adequate protection of personal data in Japan adopted by the EDPB on 5 December 2018.

The EDPB focused mainly on the assessment of the commercial aspects of the Japanese adequacy decision considering that some amendments have been passed in the Japanese legal framework that are relevant on them 3 . On the aspects relating to access and use of personal data by Japanese public authorities, the EDPB acknowledges that there are not substantial changes in the relevant legislation and recalls the considerations already made in the aforementioned opinion 28/2018. On the commercial aspects of the adequacy decision, the EDPB welcomes several recent amendments in the Japanese data protection legislation that have brought further convergence with the GDPR . It welcomes in particular the revised definition of “personal data the business holds” introduced by the 2020 APPI amendment so that it no longer excludes those personal data that are “set to be deleted” within a period of six months (Article 16(4) of the amended APPI) 4 , implying that every data subject (irrespective of nationality or residence) now benefits from the enhanced protection which had previously only applied to personal data transferred from the European Economic Area according to the Supplementary Rule (2).

The EDPB also welcomes the 2020 APPI amendment in that it extended the right to object , which is now set out in Article 35 of the amended APPI (previously Article 30), as well as the information provided by the European Commission on ‘the possibility to oppose data processing for direct marketing’ in light of these amendments and of the explanations provided for in the PPC Guidelines (General Rules), Chapter 3-8-5-1. By the same token, it appreciates the clarifications provided with regard to the introduction of measures aimed at addressing the absence in the Japanese legislation of a dedicated provision on automated individual decision-making, including profiling 5 . In this respect the EDPB at the same time encourages the European Commission to thoroughly monitor the practical application of these amendments in order to assess their envisaged positive impact on the level of protection afforded to personal data transferred from the European Economic Area, in particular as regards any processing of personal data for the purpose of automated individual decision-making, including profiling.

As regards the data security principle, the EDPB welcomes the introduction in the APPI of a duty to notify promptly the PPC and the data subjects on any data breach that is “likely to harm individual rights and interest” (see new Article 26 APPI), which contributes to increasing the degree of convergence between the EU and Japanese data protection systems. 3 The APPI was amended twice: on 5 June 2020, through the Amendment Act of the Act on the Protection of Personal Information of 2020 (2020 APPI amendment) and on 12 May 2021, through the Act on the Arrangement of Related Acts for the Formation of a Digital Society. Consequently, and in consultation with the European Commission, the Supplementary Rules were adapted to reflect these amendments and the revised Supplementary Rules were adopted by the PPC on 15 March 2023 (and entered into force on 1 April 2023). 4 In the previous version of the APPI, the notion of “retained personal data” (to which only apply the provisions relating to the data subject’s rights) included the personal data ‘other than those that (i) are set to be deleted within a period of no longer than 6 months or that (ii) fall under the exceptions of Article 4 of the Cabinet Order’.

Retained personal data are now defined as: ‘personal data which a personal information handling business operator has the authority to disclose, correct, add or delete the contents of, cease the utilization of, erase, and cease the third-party provision of, and which is other than those prescribed by Cabinet Order as likely to prejudice the public or other interests if their presence or absence is made known’. , page 8. 3 Version 1 - Adopted With regards to onward transfers of personal data, the EDPB would like to recall its opinion 28/2018, in which it had invited the European Commission to ensure that the information to be provided to the data subject “on the circumstances surrounding the transfer” should include information about the possible risks of transfers arising from the absence of adequate protection in the third country and of the absence of appropriate safeguards, or in the case of sectorial exclusions, of the absence of protections of the Supplementary Rules and of the APPI.

Against this background, the EDPB appreciates the amendments in the new Article 28(2) APPI and the indications provided in the PPC Guidelines (see Article 17(2) of the Enforcement Rules) in relation to the enhanced requirements for informed consent when it is used as a legal ground for (onward) transfers to third countries. g. in case of employees’ personal data). While some examples in the PPC Guidelines on international transfers refer to cases of transfers of employee data to a mother company in a third country as cases in which different transfer tools are used (see Case 2 in the examples 4-2-1 to 4-2-20), some clear guideline on this would be helpful to ensure that the level of protection for personal data transferred to Japan from the EEA would not be undermined in case of onward transfers on the basis of consent. The EDPB therefore calls on the European Commission to take this consideration into account for the next adequacy review.

The EDPB takes note of the introduction in the APPI of the new category of “ pseudonymized personal information ” and the explanations provided by the European Commission in this regard, in particular on the fact that the new Supplementary Rule (4) stipulates that “pseudonymized personal information” may only be used for statistical purposes (defined as processing for statistical surveys or the production of statistical results) to produce aggregate data, and that the result of the processing will not be used in support of measures or decisions regarding any specific individual. g. from the duty to report a data breach (Article 26 APPI), while the examples of measures that the business handling personal information should take according to Article 41(2) APPI and to the PPC Guidelines (Pseudonymized personal information and Anonymously Processed Information, Chapter 2-2-2-2) include “necessary and appropriate measures” to prevent “unauthorized access from outside” and “leakage of deleted information”.

e. to produce aggregate data) are exempted from the provisions regarding data subject rights , as they are prohibited from collating the pseudonymised information with other information for the purpose of identifying data subjects. The EDPB notes that this situation is different from the one in which a controller is practically not in a position to identify the data subject, as foreseen in the GDPR 6 . In this regard and considering the new nature of the concept of “pseudonymized personal information” in the APPI, the EDPB welcomes the European Commission’s commitment to closely monitor the practical implementation of Article 41 APPI and to pay particular attention to its application as part of the following review of the adequacy decision 7 . In this regard the EDPB would like to encourage the 6 While Articles 11 and 89 of the GDPR envisage similar exemptions, Article 11 applies to cases where the processing of data by the controller does not or no longer require the identification of the data subject and, as regards statistical data, is subject to specific conditions and safeguards referred to in Article 89(2) .

, page 18. 4 Version 1 - Adopted European Commission to also pay particular attention to corresponding case law, if any, in order to ensure that Article 41 APPI and its practical implementation do not negatively impact on the level of protection for personal data transferred from the EEA to Japan. Furthermore and also with regard to onward transfers the EDPB recognizes the importance of clarifying in the PPC Guidelines on international transfers that where the business handling personal information in Japan and the third-party recipient intend to frame their onward transfers of EEA transferred personal data they have to put in place implementing measures providing a level of protection equivalent to the APPI, read together with the Supplementary Rules and that, to this end, the APEC Cross Border Privacy Rules (CBPR) certification scheme cannot be used. The EDPB welcomes and shares the attention paid to this aspect by the European Commission and fully supports its recommendation to have this aspect clarified in the PPC Guideline on transfers.

Furthermore, the EDPB shares the European Commission’s view that the development of model clauses could strengthen the safeguards for onward transfers of EEA transferred personal data when those onward transfers will be based on safeguards aimed at ensuring a level of protection equivalent to that afforded by the APPI together with the Supplementary Rules. For this reason, the EDPB welcomes the idea of possible future cooperation of the European Commission with Japan in the development of such clauses and will be ready to provide any helpful contribution to that end. In light of the outcome of the review, the EDPB agrees on the proposal of the European Commission to consult the Committee established under Article 93(1) of the GDPR in order to move to a four years- cycle review of the adequacy decision of Japan pursuant to Article 45(3) of the GDPR. For the European Data Protection Board The Chair (Anu Talus)