EU Data Adequacy and Digital Trade
In January 2019, the EU’s European Commission granted adequacy to Japan for its data protection laws, allowing personal data to flow freely between the EU and Japan. The adequacy decision relies partly on guarantees by Japan to ban certain onwards transfers of EU data. However, the European Commission’s decision ignores Japan’s pre-existing commitments to the free flow of data in global trade agreements outside the EU – agreements that would likely take precedence over the guarantees given to the bloc. This means that Japan could be sued under trade law for stopping onwards transfers of EU personal to countries using weaker privacy regimes, including to the Unites States. This undermines the legal certainty required for the EU adequacy decision.
Public Citizen Foundation and members of the Digital Trade Alliance believe the EU’s adequacy decision fails to protect personal data from the EU; encourages other countries to adopt similar, insufficient privacy protections as Japan; lowers global data standards and places vulnerable people at risk while making it harder for them to obtain redress. Public Citizen and the Digital Trade Alliance sought to determine the viability of, and optimal approaches to, challenging the European Commission’s adequacy decision for Japan.
EU Data Adequacy and Digital Trade
Organisation Name
Public Citizen, with members of the Digital Trade Alliance
Country/Jurisdiction
Regional
Grant Amount
EUR 34,294
Current Status
Research Complete
Grant type
Pre-litigation Research Support
Description
In January 2019, the European Commission granted adequacy to Japan for its data protection laws, allowing personal data to flow freely between the EU and Japan. The adequacy decision relies partly on guarantees by Japan to ban certain onwards transfers of EU data. However, the European Commission’s decision ignores Japan’s pre-existing commitments to the free flow of data in global trade agreements outside the EU – agreements that would likely take precedence over the guarantees given to the bloc. This means that Japan could be sued under trade law for stopping onwards transfers of EU personal data to countries using weaker privacy regimes, including to the United States. This undermines the legal certainty required for the EU adequacy decision.
Public Citizen Foundation and members of the Digital Trade Alliance believe the EU’s adequacy decision fails to protect personal data from the EU; encourages other countries to adopt similar, insufficient privacy protections as Japan; lowers global data standards and places marginalised people at risk while making it harder for them to obtain redress. Public Citizen and the Digital Trade Alliance sought to determine the viability of, and optimal approaches to, challenging the European Commission’s adequacy decision for Japan.
Under this grant, Professor Hiroshi Miyashita of Chuo University showed that the Japanese standards and enforcement for regulating cross-border data transfers are weaker than the EU standard and create risks for individuals while enabling “seemingly incompatible” trade agreements. Also supported by this grant, Dr. Svetlana Iakovleva of the University of Amsterdam found that countries like the US could subject Japan to a successful legal challenge — a trade dispute — for restricting data flows. If successful, such a trade dispute would create precedent for future trade disputes to favour weakened, regressive privacy regimes globally.
The results of the legal research were complemented with extensive work to engage with policymakers and civil society in Europe, Japan and Asia-Pacific to build sustainable relationships to carry the project forward and improve the exchange of information between the regions. The Alliance is considering whether a legal challenge to the EU adequacy decision on Japan by a Euro-Pacific coalition of privacy and consumer groups could help raise privacy standards in the region.
Reports, blogs, webinars, and other documents from this project are made available by the Digital Trade Alliance.
"the EU’s adequacy decision fails to protect personal data from the EU; encourages other countries to adopt similar, insufficient privacy protections as Japan; lowers global data standards and places marginalised people at risk while making it harder for them to obtain redress"
Strategic Goals
- To prevent alternative data flow regimes from being introduced in trade deals that lower standards to data protection around the world.
- To restrict the transfer of personal information to jurisdictions where data rights cannot be guaranteed, ensuring that people around the world have control over their personal information.