Data transfers to countries outside the European Economic Area are only legal if –in addition to the requirement of a legal basis or the data subject’s consent– an adequate level of data protection in that country can be guaranteed. One way this can be achieved is an Adequacy Decision of the European Commission. The Commission has in the past issued such decisions for Andorra, Argentina, Canada (commercial organizations), Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay. Now, the EU Commission may include Japan in its Adequacy Decision.
On May 30, 2017, the new Japanese Act on Protection of Personal Information (APPI) has entered into force, which brings about considerable changes. Interestingly, Japanese Data Protection Law now requires that, without the data subject’s consent, personal data may only be transferred to “safe countries” as per the newly introduced white-list ...Zum vollständigen Artikel