EU-Japan deal on data flows enters into force: A New Era of Digital Economic Cooperation
- Background and the Realization of Free Cross-Border Data Flow
The European Union and Japan (individually “Party” and collectively “Parties”), successfully concluded their talks on reciprocal adequacy on 17 July 2018; they agreed to recognize each other’s data protection systems as adequate, allowing personal data to be transferred safely between the EU and Japan.
Subsequently, each Party initiated internal procedures for the adoption of the “Adequacy Decision”. The Adequacy Decision is a European Commission decision within a third country that may be declared as offering an adequate level of protection; meaning that data can be transferred with another company in that third country without the data exporter being required to provide further safeguards or being subject to additional conditions. In other words, the transfers to an adequate third country will be comparable to a transmission of data within the EU.
For the European Union, these procedures included obtaining the opinion of the European Data Protection Board and the approval of a committee composed of representatives of the Member States.
Before the Commission could formally adopt this Adequacy Decision, Japan was required to commit to implementing a series of rules that would provide additional safeguards for individuals in the EU whose personal data is transferred to Japan. These measures aimed to address the differences between the two data protection systems and included a complaint handling mechanism for the review and resolution of complaints made by European citizens regarding access to their data by Japanese public authorities.
On January 23, 2019, the European Commission formally adopted the Adequacy Decision.
On July 1, 2024, a revised protocol including rules on cross-border data flows in the EU-Japan Economic Partnership Agreement (“EPA” or “Agreement”) finally entered into force. The first version of the Agreement, which entered into force in February 2019, realized extensive economic cooperation between the two regions However, while the first version of the EPA included provisions on e-commerce, it did not include provisions to ensure the free flow of data across borders, only a general obligation to regulate this matter in the future. In fact, the first version of Article 8.81 stipulated that the EU and Japan were to re-evaluate, within three years of the EPA’s effective date, the need to conclude provisions on the free flow of data in this agreement. Negotiations began in October 2022 and reached an agreement in principle in November 2023. This is a major step forward in deepening digital economic cooperation between Japan and the EU and is expected to serve as a model case for similar cooperation in the future.
This paper describes the contents of the EPA and its prospects.
- Contents of the EPA Amendment: Liberalization of Data Flow to Accelerate Business
The Amendment adds two main articles to the EPA between Japan and EU, in addition to specifying the definition of the term “Covered Person”.
- “Covered person”: means: (i) a covered enterprise; (ii) an entrepreneur of a Party; and (iii) a service supplier of a Party;
- “Cross-border transfer of information by electronic means” (New version of Article 8.81).
- “Protection of personal data” (New Article 8.82).
New version of Article 8.81: The European Union and Japan commit to ensuring the cross-border transfer of information by electronic means when such transfer is necessary for the business activities of a covered person. To this end, a Party shall not adopt or maintain measures that prohibit or restrict such transfer through various restrictions, such as the requirement to use computing facilities or network elements within its territory, the localization of information, or the need for prior approval for the transfer of information. However, nothing prevents a Party from adopting measures contrary to the above if such measures are necessary to achieve a legitimate public policy objective, provided that they are not discriminatory or unjustifiably restrictive and do not impose greater restrictions than necessary. Additionally, the Parties may adopt measures for the protection of personal data and privacy, provided that such measures allow for the transfer of information under conditions of general application. This article does not apply to the cross-border transfer of information held or processed by or on behalf of a Party.
New Article 8.82: The Parties acknowledge the significance of protecting individuals personal data and privacy in accordance with their respective laws and regulations. Such high standards are essential for fostering trust in the digital economy and promoting trade. Each Party retains the right to establish the appropriate level of protection for personal data and privacy through its own legislative measures. Both Parties are committed to ensuring that individuals are protected from violations of personal data protection occurring within their jurisdictions, without discrimination based on nationality or residence. Each Party shall adopt and maintain a legal framework that safeguards personal data in the context of electronic commerce. In developing these frameworks, each Party should consider the principles and guidelines issued by relevant international bodies. The Parties also recognize that maintaining high standards of privacy and data protection, including those specified in the OECD Principles for Government Access to Personal Data held by Private Sector Entities, is crucial for upholding trust in digital trade. Moreover, each Party shall publicly disclose information regarding the protection of personal data and privacy provided to users of electronic commerce. This disclosure must include details on how individuals can seek remedies for breaches of data protection or privacy and guidance for businesses on compliance with applicable legal requirements for data protection.
- Characteristics of the EPA: The Concept of “Data Free Flow with Trust (DFFT)”
This agreement is based on the concept of Data Free Flow with Trust “(DFFT)” and is aimed at promoting the free flow and exchange of information between the European Union and Japan, balancing it with personal data protection.
In particular, the provisions on domestic storage and processing mandates are more advanced than those of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (“CPTPP”), promoting freer data flow. The free flow of information and data between the EU and Japan is a central objective of the entire structure of the EPA. However, the EU, in agreement with Japan, intends to pursue this goal while maintaining high standards of personal data protection. On this evidence, New Article 8.11(e)(f) restricts only prohibiting the transfer of information into the territory of the Party or requiring the approval of the Party prior to the transfer of information to the territory of the other Party. This is generally more limited than Article 14.11(2) of the CPTPP, which seeks to permit cross-border transfers of data made for the conduct of business. In other words, the Agreement is designed to facilitate cross-border data transfers between the EU and Japan, where trust is ensured, while leaving room for restrictions on cross-border data transfers to third countries, where trust is not ensured. The Agreement, in fact, upholds the framework of adequacy decisions and incorporates provisions on governmental access to data.
- Impact of this EPA: Expanding Business Opportunities and International Influence
This agreement will not only deepen economic relations between Japan and the EU but will also significantly impact international discussions on data governance.
For businesses, this agreement is expected to increase legal certainty regarding cross-border data transfers between Japan and the EU and expand business opportunities. For example, in areas such as financial services, transportation, machinery, and e-commerce, more efficient data processing will be possible, eliminating the need for cumbersome administrative procedures and storage requirements.
- Future Expectations: Towards a New Standard for Digital Trade
This agreement is an important step in strengthening cooperation between Japan and the EU under the DFFT concept. The EU has stated that this agreement is a “strong signal against digital protectionism.” As negotiations in the WTO’s Joint Statement Initiative on Electronic Commerce are proving difficult, the Japan-EU EPA has the potential to serve as a model case for achieving DFFT.
This agreement is expected to contribute to promoting digital trade not only in both regions but also in the international community, and to become a new standard.
The official website of the European Commission makes several useful links available for consultation, to better understand the iter by which the EPA was enacted, and the principles on which it is based:
EU trade relations with Japan;
EU-Japan Economic Partnership Agreement, (main page, where you will find general information and useful links);
EU-Japan agreement chapter-by-chapter.
