The EU and Japan today announced a new trade deal which has triggered plenty of commentary about cars and cows (the EU apparently exports a lot of dairy products to Japan). Less air time has been devoted to the parallel announcement by the EU of an intention for mutual "data adequacy" between Japan and the EU.
Once ratified, this adequacy decision will enable organisations in the EU to pass personal data to recipients in Japan, without having to worry about the restrictions in the General Data Protection Regulation (GDPR) on transferring personal data outside the EEA.
Japan will be the largest economy to date to receive an adequacy decision from the EU. The other countries which currently benefit from adequacy decisions are fairly small in comparison.
Granted, there are partial adequacy decisions in place in respect of US organisations who have signed up for the EU-US Privacy Shield scheme, though the European Parliament recently launched an attack on Privacy Shield (see: https://www.theregister.co.uk/2018/07/05/privacy_shield_under_pressure_meps_vote/, and in relation to Canadian companies falling under the scope of the Canadian Personal Information Protection and Electronic Documents Act.
However, right now the only jurisdictions which benefit from whole-country adequacy decisions are: Andorra, Argentina, Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay. It seems they will soon be joined by Japan.
The question then, is whether the EU will also see fit to grant an adequacy decision to the UK once the UK leaves the European Union.
If the UK also leaves the EEA when it exits the EU, then technically it will be a third country, meaning companies in the EU will need to put special safeguards in place in order to send personal data to the UK. That would seriously impede the UK's ability to trade effectively in the EU and so the need for an adequacy decision is one of the key drivers of the new UK Data Protection Act 2018, which demonstrates that the UK will continue to abide by GDPR standards even after Brexit.
Who knows, as with Japan today, perhaps next year an adequacy decision about the UK could also go under-reported amidst the excitement of a free trade deal with the EU.
Want to hear more from us? 
