Concerning the International Efforts

November 8, 2016
Personal Information Protection Commission

The Personal Information Protection Commission (“the Commission”) on
July 29, 2016, decided on “New Initiatives for Ensuring Smooth Cross-Border
Personal Data Flows”, in which it is stated that “The Commission will for themoment, while advocating further cooperation with foreign counterparts to boost
smooth cross-border transfer of personal information ensuring the protection
thereof, facilitate coordination directed toward setting up a bilateral meeting on aregular basis with its counterparts in the United States and the European Union(the Brexit’s effects will need to keep watching) with both of whom theCommission has held certain dialogues hitherto, with putting into perspective thepossibilities of establishing a framework to enhance reciprocal and smooth datatransfer.” Based upon this, the Commission has been engaging in dialogues with
its counterparts of the United States and the European Union.
In connection with this effort, the Commission also on October 14, 2016,
developed a Basic Policy on the Protection of Personal Information, which wasadopted by the Cabinet on October 28, 2016, stating that “The Commission will
make every effort such as participating in an international cooperative framework
and building a cooperative relation with the enforcement authorities in othercountries in order to establish and maintain an environment where smoothinternational data flows are kept while ensuring the protection of personalinformation.”
The United States
A shared recognition has been gained regarding the importance of collaboratingclosely and holding a regular meeting continuously. In addition, a consensus has
been achieved on cooperatively practicing public relations for the APEC Cross
Border Privacy Rules (CBPR) system and undertaking promotional activities toencourage the APEC member economies to participate therein together with therespective countries’ stakeholders.
 Uninterruptedly this effort will continue to be devoted to vitalize the APECCBPR system, a personal data transfer framework, and take other measureswhile keeping in mind its possible extension to a global arena.

1

The European Union
While stressing the importance to ensure the protection of personal data andsimultaneously promoting its cross-border transfer between Japan and theEuropean Union, a consensus has been achieved on continuing to hold acooperative dialogue between the two parties toward that goal.
 Uninterruptedly further discussion taking into account the following points will
be advanced while putting into perspective close coordination with a global
personal data transfer framework.
 Personal data transfer between Japan and the European Union will besustained supposing a framework to enable two-way personal data flows
on the premise of the amended Act on the Protection of Personal
Information (providing for, among others, the establishment of a Personal
Information Protection Commission as an independent organization).
 Also, for the European Union’s part, as the EU General Data Protection
Regulations (GDPR) adopted this year will be applied after May 2018,
close attention needs to be paid to movements toward its implementation.
(Annotation 1) A summary of the APEC Cross-Border Privacy Rule (CBPR)
system The APEC CBPR system is a scheme to certify a business operator’scompliance with the APEC Privacy Framework in the APEC member
economies, and an effective mechanism to judge a business operator’s levelof personal information protection by international standards.
 An APEC economy expresses its wish to participate in the system, and thoseadmitted into participation can register an Accountability Agent (AA). This AA
certifies a business operator’s compliance with the APEC Privacy Framework
based on the business operator’s application.
(Annotation 2) A summary of the EU General Data Protection Regulations (GDPR)
 The European Parliament on April 14, 2016, adopted the EU General Data
Protection Regulations (GDPR) as a unified data protection rule to be applied
within the European Union region by replacing the EU Data Protection
Directive from a scheduled implementation date of May 25, 2018.
 As the “Directive” requiring each member state’s action for its domestic
implementation has been upgraded to the “Regulations” directly applicable tothe member states, the integration of the data protection rules will be achieved
across the European Union member countries.

2