On January 23, 2019, the European Union (EU) issued an adequacy decision regarding free flow of sensitive data with Japan. This is the first adequacy agreement since the General Data Protection Regulation (GDPR) went into effect last May. With countries around the world examining and strengthening their data protection laws, this agreement could be the first of many.
Under the GDPR, the EU can assess other countries’ data security initiatives and, if sufficient, issue an adequacy decision that allows uninhibited data transfer between the EU and the other country. This is no small task, as the European Commission has to research the other country’s data security measures and submit a proposal, receive input from the European Data Protection Board, gain approval from all EU countries, and ultimately adopt the parameters of the agreement. The other country also has to agree that the EU’s system is adequate.
