- On 12 February 2020
Japan has taken steps to ensure that the UK will continue to be treated as an “adequate” destination for transfers of personal data now that the UK has formally left the EU. The Personal Information Protection Commission of Japan (“PPC”) announced on 31 January 2020 its decision (under ordinance No. 2 of 2020) to extend the PPC’s designation of the EU under Article 24 of the Act on the Protection of Personal Information (“APPI”) to the UK.
A designation under Article 24 of the APPI is made by the PPC if the country establishes a personal information protection system recognized to have equivalent standards to that in Japan in regard to the protection of an individual’s rights and interests. According to the ordinance No. 2 of 2020, the Supplementary Rules under the APPI for the Handling of Personal Data Transferred from the EU based on an Adequacy Decision applies to personal data transferred from UK to Japan after the UK’s departure.
From the UK perspective, during the transition period (up to and including 31 December 2020, but subject to possible extension), the effect of the adequacy decision to Japan made by the EU will continue. Following the end of the transition period, the UK has already announced that it will extend the adequacy decisions previously granted by the EU, including in relation to Japan, to transfers from the UK. However, it will keep this position under review and will reserve the right to revisit these adequacy decisions, as part of its independent power to make its own adequacy decisions under the “UK GDPR”.
Based on these circumstances, the PPC announced that the framework for mutual and smooth transfer of personal data between Japan and UK is ensured, for at least the foreseeable future post-Brexit.
Tomomi Fujikouge and James Clark, Senior Associates, DLA Piper