The European Commission has, on the 23rd of January 2019, adopted an adequacy decision on Japan, creating the world's largest area of safe data flows.
An adequacy decision is a decision taken by the European Commission establishing that a third country provides a comparable level of protection of personal data to that in the European Union. It is one of the tools provided for under the General Data Protection Regulation to transfer personal data from the EU to third countries. In fact, Article 45 of the latter Regulation now specifies that companies will be able to transfer personal data from the EU to Japan.
The procedure for the assumption of an adequacy decision is as follows:
- a proposal from the EU Commission;
- a opinion of the EU data protection board;
- an approval from representatives of the EU countries;
- the adoption of the decision by the EU Commission.
Adequacy decisions are closely monitored, adapted or even withdrawn in case of developments affecting the level of protection in the third country that had been found adequate.
The Commission has adopted adequacy decisions for the following countries and Territories: Andorra, Argentina, Canada, Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the United States (EU-U.S. Privacy Shield), and now Japan.