In a move that signals the European Union’s (EU) intention to establish trade agreements with Asia Pacific partners, the EU has formally recognised Japan as having an adequate level of data protection to that of EU countries.

The decision by the EU and finalised last month, will allow personal data to flow unhindered between EU countries and Japan, without being subject to any further safeguards or authorisations.

Japan’s new EU data protection status – also known as “EU adequacy” because it indicates the data protection framework offers an adequate standard of data protection for the purposes of European law - means Japan has achieved the same recognition given to New Zealand in 2012.

Like New Zealand and 11 other countries, the ‘adequacy’ decision establishes Japan as a safe place for the processing of data belonging to EU citizens and covers the flows of personal information for commercial purposes between the EU and Japanese businesses.

South Korea next

The next country on the EU’s list for adequacy status is South Korea. It is all part of a strategy set out in a European Commission 2017 document Exchanging and Protecting Personal Data in a Globalised World which you can find here.

The document expresses the intention to “actively engage with key trading partners in East and South-East Asia, starting from Japan and Korea in 2017”. It explains:

“Under EU law, one way to transfer personal data abroad is on the basis of a Commission "adequacy decision" establishing that a non-EU country provides a level of data protection that is "essentially equivalent" to that in the EU. The effect of such a decision is to enable the free flow of personal data to that third country without the need for the data exporter to provide further safeguards or obtain any authorisation.”

More countries to come

The document adds that adequacy status will be explored with many more countries in the coming months – India (“depending on progress towards the modernisation of its data protection laws”), Latin America, and non-EU countries in the “European neighbourhood”.

While the link between data flows and trade are obvious, the document emphasises that EU data protection rules cannot be the subject of negotiations in a free trade agreement:

“While dialogues on data protection and trade negotiations with third countries have to follow separate tracks, an adequacy decision, including a partial or sector-specific one, is the best avenue to build mutual trust, guaranteeing uninhibited flow of personal data, and thus facilitate commercial exchanges involving transfers of personal data to the third country in question. Such decisions can therefore ease trade negotiations or may complement existing trade agreements, thus allowing them to amplify their benefits.”

The big idea is to foster a regulatory convergence towards EU standards and facilitating trade relations with countries by first negotiating adequacy status in data protection and processing.

Data protection and trade

For New Zealand, it means that having adequacy status gives us a strategic advantage in seeking a free trade agreement with the EU. Those negotiations have begun. But a degree of vigilance is required. The Privacy Commissioner and European Commission officials have an agreement for our office to provide six monthly update reports as part of the EU’s ongoing monitoring of our adequacy status. You can read the update reports provided by our office here.

These updates are against a backdrop of change. The EU’s much-heralded General Data Protection Regulation (GDPR) took effect in May and New Zealand’s privacy legislation is currently being reformed with a new Privacy Act.

The European Commission will naturally be concerned that any country judged to meet European standards at one point in time continues to meet those standards in the years ahead. Israel’s EU adequacy, for instance, is currently being re-evaluated. The head of the country’s privacy watchdog noted that “we are doing all we can to ensure that this status, which has had very significant economic implications, is preserved”.

New Zealand

New Zealand will find itself in a similar situation in the year ahead when the EU undertakes a re-evaluation of our adequacy status. As we noted in this earlier post, any weakening of our Privacy Act would risk our favourable trade status. The converse is also true and strengthening our Privacy Act should enhance our trade status with the EU, and it could have a significant bearing on our economic advantage with the European Union.

Image credit: Flag of Japan by Dominic Alves (Creative Commons via Flickr)

Europe, IPP12 - disclosure outside NZ, data