Commission Implementing Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information (Text with EEA relevance)

1 For the purposes of Article 45 of Regulation (EU) 2016/679, Japan ensures an adequate level of protection for personal data transferred from the European Union to personal information handling business operators in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules set out in Annex I, together with the official representations, assurances and commitments contained in Annex II.

2 This decision does not cover personal data transferred to recipients falling within one of the following categories, to the extent all or part of the purposes of processing of the personal data corresponds to one of the listed purposes, respectively: (a) broadcasting institutions, newspaper publishers, communication agencies or other press organisations (including any individuals carrying out press activities as their business) to the extent they process personal data for press purposes; (b) persons engaged in professional writing, to the extent this involves personal data; (c) universities and any other organisations or groups aimed at academic studies, or any person belonging to such an organisation or group, to the extent they process personal data for the purpose of academic studies; (d) religious bodies to the extent they process personal data for purposes of religious activity (including all related activities); and (e) political bodies to the extent they process personal data for the purposes of their political activity (including all related activities).

Whenever the competent authorities in Member States, in order to protect individuals with regard to the processing of their personal data, exercise their powers pursuant to Article 58 of Regulation (EU) 2016/679 leading to the suspension or definitive ban of data flows to a specific business operator in Japan within the scope of application set out in Article 1, the Member State concerned shall inform the Commission without delay.

1 The Commission shall continuously monitor the application of the legal framework upon which this Decision is based, including the conditions under which onward transfers are carried out, with a view to assessing whether Japan continues to ensure an adequate level of protection within the meaning of Article 1.

2 The Member States and the Commission shall inform each other of cases where the Personal Information Protection Commission, or any other competent Japanese authority, fails to ensure compliance with the legal framework upon which this Decision is based.

3 The Member States and the Commission shall inform each other of any indications that interferences by Japanese public authorities with the right of individuals to the protection of their personal data go beyond what is strictly necessary, or that there is no effective legal protection against such interferences.

4 Within two years from the date of the notification of this Decision to the Member States and subsequently at least every four years, the Commission shall evaluate the finding in Article 1(1) on the basis of all available information, including the information received as part of the Joint Review carried out together with the relevant Japanese authorities.

5 Where the Commission has indications that an adequate level of protection is no longer ensured, the Commission shall inform the competent Japanese authorities. If necessary, it may decide to suspend, amend or repeal this Decision, or limit its scope, in particular where there are indications that: (a) business operators in Japan that have received personal data from the European Union under this Decision do not comply with the additional safeguards set out in the Supplementary Rules contained in Annex I to this Decision, or there is insufficient oversight and enforcement in this regard; (b) the Japanese public authorities do not comply with the representations, assurances and commitments contained in Annex II to this Decision, including as regards the conditions and limitations for the collection of and access to personal data transferred under this Decision by Japanese public authorities for criminal law enforcement or national security purposes. The Commission may also present such draft measures if the lack of cooperation of the Japanese government prevents the Commission from determining whether the finding in Article 1(1) of this Decision is affected.

This Decision is addressed to the Member States.