4. Focused Research (3)IIJ’s Road to BCR Approval—Complying with EU GDPR and Beyond
In August 2021, we received notice of the long-awaited

With the rise of major platform operators, exemplified byapproval for IIJ’s BCRs (Binding Corporate Rules) from LDI-GAFA, that use personal data to the hilt and Snowden’s

NRW, the supervisory authority in North Rhine-Westphalia

exposure of the US government’s excessive surveillance(NRW), Germany. Since the EU’s GDPR (General Data

practices, there was strong distrust within Europe about

Protection Regulation) came into force, 18 companies world-the US’s use of personal data, and I think this is the real

wide have received BCR approval (as of August 2021), IIJ

backdrop for what prompted the creation of the GDPR.

being one of them. The five years since we started looking

I think, at its heart, this traces back to a marked difference

at BCRs as a means for complying with the GDPR have beenin cultural values about personal data. This is something

eventful, and with the approval, we can now proudly say

I will discuss later.

that our efforts so far have finally been recognized.
It became evident that the EU was pretty serious, but
Here, I discuss why we chose the IIJ BCR approval route,

IIJ doesn’t provide personal services on a global basis,

what the road to acquiring that approval was like, and where

and there was talk about the Japanese government’s

we are headed from here.

Personal Information Protection Commission working
toward some sort of national certification from the EU

4.1 Decision to Seek BCR Approval

anyway, so truth be told, we hadn’t intended to actively

The EU drafted the GDPR for the purpose of protecting

pursue GDPR compliance. But as we worked through all

personal data within the EEA (European Economic Area) in

the factors to consider, and with a proposal from Shinpei

2016, and it came into effect in 2018. The GDPR was the

Ogawa, a director of IIJ Europe at the time, we came to

subject of a lot of speculation back when it was announced,

the conclusion that seeking IIJ’s own BCR approval would

and I remember some extreme arguments saying, for example.

be advantageous.

that it would harm the free distribution of information on
We had four main reasons for embarking on our journey for

the Internet.

IIJ’s BCR approval.
The EU’s objective was of course not to restrict the dis-38

tribution of personal data on the Internet. Rather, it was■ We saw the need for global security governancecalling for the appropriate use of data on people in the EU

IIJ has been deploying group companies all over the world

at a time when such information was already being used infor some time, and doing business naturally requires us tocountries everywhere. Where practices had been vague, theaddress personal data protection and other factors in each

EU wanted to lay out clearer protections on personal data

country. In the past, however, we did not fully comprehend

that had real effect. It was a truly advanced initiative tothe situation in every country, so it was left up to each group

institutionalize such protections. I think that, even now, thecompany to mount its own response, and to be honest, we

policies and practices for personal data protection laid out in

weren’t able to address the issue of control on a group level.

the GDPR have a lot to say about personal data protection

Creating IIJ’s BCRs to comply with the GDPR and puttingin the information age.

this into effect at group companies was crucial in enabling© Internet Initiative Japan Inc.

Feb.2022

Vol.

53

4. Focused Research (3)us to implement control at a time when the situation around

implementing responses to a range of issues that potentiallypersonal data was becoming more and more nuanced.

lay down the track. We were honestly surprised at how far
they were taking it. Japan was also naturally making an■ Alternatives to BCR were too complicatedeffort in that regard, and the EU did adopt an adequacy

An alternative to obtaining BCR approval as a means

decision on Japan, but it is telling that supplementary rulesof meeting the GDPR requirements is to enter into SCC

were applied to transfers of personal data from within the(Standard Contractual Clauses), a form of template contract,

EEA to Japan. This leads into the discussion that follows,

as necessary and perform data transfers on that basis.

but the approach of giving careful thought not just to the

These contracts, however, must be meshed in the sense

controller but also to the processors, and developing athat there needs to be contracts between the controller

framework with respect to the processors, is a fairly ad-(the party responsible for holding the personal data) andvanced one. The EU obviously implemented this because it

the processors (the parties who receive the personal data

felt it was necessary to protect personal data, but I think it

for processing), as well as between processors themselves.

also shows that they were somewhat prescient about how

And if changes are made to how the data are processed,

personal data would be handled in the Internet’s cloud era.

the contracts must be entered into again, so managing thecontracts is cumbersome. It was easy to see that we would
end up with quite a lot of contracts just with IIJ’s own group■ It would enable protection of personal data on cloudservices in addition to personal data held by IIJ

companies, and given the nature of our business, in many

The EU’s motivation for creating the GDPR was clearly tocases information from our customers is deployed across eachregulate the handling of personal data on the Internet byof our group companies’ platforms. For these reasons, we

platform operators and the like within the EEA, to whichwere concerned about this approach eventually collapsing.

end it sought to impose rules on business operators andIIJ’s own BCR approval was really the only way to solve thethe like that handle personal data so as to ensure that they

problem.

do so properly in accord with EU standards. As such, theGDPR naturally applies not only to controllers responsible■ GDPR represented a more advanced approach thanfor managing personal data but also to processors who

Japan’s own personal information protection practices

receive such data from controllers. I think the EU made such

IIJ naturally implements internal controls for the protection

provisions explicit because it was seeking to confront whatof personal information and has acquired Japan’s P Markit saw as a less than appropriate state of affairs particularly(Privacy Mark). Yet something that became eminently

with respect to the platform operators who process personal

apparent as we started to understand more about the GDPR

data. This potentially opened the way for outsourcing, suchis that the EU’s commitment is on another level. Japan’s

as cloud services, to comply with the GDPR by meeting

personal information protections certainly do comprise

the BCR conditions under the processor category. That is,a range of carefully thought out measures, but the EU’s

it provided a way for controllers, the customers of suchapproach was to tackle these difficult problems throughservices, to prove that they use processors who have imple-

sound reasoning and ideas, and to look ahead and startmented proper protections.

© Internet Initiative Japan Inc.

39

IIJ Europe began looking seriously at GDPR compliance inakin to the efforts developed in Japan over the past many

January 2016, and IIJ’s board of directors officially gave

years around internal control for information security andapproval to start working toward BCR approval in May

personal information protection. That said, the EU’s GDPR

2016. The approval was actually received on August 5,

is the most stringent personal information protection regulation

2021, partly because of how long the review takes, but

anywhere in the world, so obtaining BCR approval is byalso due to the impact of Brexit and other subsequentno means easy.

events. While not all that many people were involved
over that period, a number of internal units, led by the

At the IIJ Group level, the IIJ Binding Corporate Rules

Risk Management Office, had a role to play, including

appear at the very bottom of the privacy policy on IIJ

the Business Risk Consulting Headquarters, the Global

Europe’s website, and IIJ Group companies also link to this.

Business Division, and the Compliance Department, andwe actually used a law firm when negotiating with theOnce a corporate group’s BCRs have been approved by theEU’s supervisory bodies as well. Our efforts did finallycompetent data protection authority in the EU, this certifies

pay off in the form of BCR approval. IIJ is the first global

that, in terms of personal data protection under EU law,cloud vendor, not just in Japan but worldwide, to receive

the group has appropriate safeguards in place, and underapproval since the GDPR took effect.

GDPR Article 46, Item 2(b), this allows it to legally transfer
personal data fro within the EEA to locations outside of

But as with other aspects of data governance, obtaining

the EU.

approval is not the goal. Instead, it provides an opportunity
to embark on new efforts to establish internal control forTransfers of personal data from within the EEA to theglobal data governance.

outside of the EEA are in principle prohibited. There are
a number of recognized ways of making it possible to do

4.2 What are BCRs?

this, though. Among them, BCRs represent the strictest

Below is a brief explanation of BCRs.

standards at the corporate level. As long as they comply
with the BCRs, transfers of personal data outside the region

BCRs are data protection policies that are adhered to by an

to corporate groups that have BCR approval, or between

entire corporate group (these policies are also made known

companies within a group that has received approval, areto the subjects of personal data and are thus widely dis-

recognized as being subject to the appropriate safeguards

closed) and embody rules that are binding on the grouprequired by the GDPR.

companies and their employees. The objective is data

40

protection, but this is not so much about implementing

Approval is obtained by submitting BCRs as stipulated intechnical security measures as it is about sharing information

GDPR Article 47 to the competent data protection authority

and educating employees on the basic principles and rules

for approval. A rigorous review process that goes beyond

around the handling of personal data, creating an operating

the competent authority ensues. First, the competentenvironment that allows employees to raise queries orauthority reviews the BCRs with the assistance of super-complaints, and so forth. In that sense, the approach isvisory authorities, and corrections are repeatedly made© Internet Initiative Japan Inc.

Feb.2022

Vol.

53

4. Focused Research (3)in conjunction with the company under review. Once it

a federation, all 16 of its states have their own personalis satisfied, the competent authority communicates withdata protection supervisory authority.

the EDPB (European Data Protection Board), part of theEuropean Commission, the EU’s executive branch, andThe EU adopted an adequacy decision on Japan on January

submits a pre-review request to the ITES (International23, 2019. The decision means the EU recognizes that Japan

Transfer Expert Subgroup) meeting. ITES is made up ofhas personal information protection guarantees that areexperts from the supervisory authorities of all EU member

in line with those that apply in the EEA. This recognition

states. They may think that something should be done

from the European Commission was the result of work bydifferently or that a particular rule is a little loose, and theyJapan’s Personal Information Protection Commission alongaccordingly send revision requests to the competentwith other stakeholders and no doubt came as a boon forauthority, based on which the corporate group revises

many Japanese companies.

the BCR draft. This process is repeated until it is apparent
there are no further opinions on the pre-review, at which

It does not mean, however, that all Japanese companies arepoint the competent authority asks for an Opinion from a

now GDPR compliant.

plenary meeting of the EDPB, the highest decision-making
authority in this case, composed of representatives of allFirst of all, the GDPR does not in principle allow the

EU national data protection authorities. The Opinion is antransfer of personal data out of the EEA, so the cross-borderofficial document of the EDPB, in accord with which thetransfer rules must be observed when transferring data.

competent authority provides instructions to the corporate

The cross-border transfer rules, per GDPR Articles 45 andgroup to finalize the BCRs, and then grants final approval.

46, allow such transfers under conditions including theThis rigorous process means that obtaining BCR approvalfollowing.

from your competent data protection authority in the EU
takes quite a lot of effort and time.

• The European Commission has adopted an adequacy
decision on the country

In the IIJ Group’s case, we submitted our BCRs to the UK’s

• BCR approval has been acquired

ICO (Information Commissioner’s Office), our competent• SCCs have been entered into

authority at the time, in October 2016. The impact of Brexit,• In compliance with a (an industry) code of conduct

however, means that the competent authority for us is now

approved by the EDPB

the supervisory authority in North Rhine-Westphalia (NRW),
Germany. IIJ Europe (based in London) had been the IIJ

Put differently, only transfers of personal data out of theGroup’s headquarters in the EU, but the UK’s withdrawal

EEA pursuant to the GDPR are exempted. In addition, thefrom the EU meant that this role passed to IIJ Deutschland

Personal Information Protection Commission has published(based in Dusseldorf), and thus the supervisory authority

official notice that supplementary rules will apply toin NRW, in which Dusseldorf is located, became the IIJ

personal data transferred from within the EEA wherever theGroup’s competent authority. The norm in other countries islocal rules are deemed inadequate. The EU’s adequacy

to have a single national authority, but with Germany being

decision means that transfers of personal data from the EU© Internet Initiative Japan Inc.

41

to Japan are permitted, but such data may not be further

I will now briefly explain the background to the creation oftransferred from Japan to a third country. So the adequacy

the GDPR. An essential element is that the EU authorities

decision does not fully cover cases in which, for instance,

are in opposition to the US in terms of privacy protection.

an employee register is shared globally.
■ Historical background
Japan’s pursuit of an adequacy decision was the rightThe 9/11 terrorist attacks in the US were more than enoughapproach for the nation to take, and an understandable

to shake the world’s collective consciousness. After 9/11,

one, in view of the circumstances of many Japanese

the US embarked on a secret mass surveillance program andcompanies’ businesses, but it is unfortunate that it led to

implemented mechanisms for installing backdoors in social

a sense that companies now no longer need to take any

media and other services in order to expose terrorists. These

particular steps of their own with respect to the GDPR.

operations should only have been carried out under a court

Personal data protection is an extremely important issueorder, but in reality, as exposed by Edward Snowden in Junefor the Internet and other types of new information2013, the US had made it possible for intelligence personnel

infrastructure, and we should not forget that the situation

to freely snoop into people’s privacy in the course of their

these days is such that even companies that do businessintelligence activities. I think it was difficult for the American

mainly within Japan cannot ignore its impact.

people to oppose this because the atmosphere was suchthat they felt compelled to allow the government to do what

4.3 Personal Data Protection Initiatives Around
the World

it needed to do for national security. I think Americans have

As my mind became increasingly wound up in the various

the sense that they see the government as the people’s

personal data protection initiatives out there, I was maderepresentative and spokesperson, an attitude that dates

acutely aware of differences in perspectives on personal

back to the nation’s founding. But then Snowden revealed

data and astonished by just how different the culturalthat the US had been eavesdropping indiscriminately on

backgrounds can be. Norms around personal data in Japanembassies of the country’s allies including Germany andmerely represented Japan’s own local perspective. My

France. This enraged the EU’s member states and hadrealization that there are rights and responsibilities withmajor ramifications, the German government’s axing of its

respect to personal data in other parts of the world that

Verizon contract, for instance.

a very strong sense of ownership about their country in

differ completely from those found in Japan was a very

42

important insight that I gained from IIJ’s BCR approval

The idea that the government is absolutely right does

process. To be honest, I realized that IIJ’s mindset as a

not exist in the EU. For more than a millennium, thetraditional Japanese company simply would not cut it on

European continent was again and again the scene of

the world stage. There exist multiple ideas about what iswars and conflicts that ultimately failed to settle nationalright and just when it comes to personal data around theborders or territory. The rise of tyrants repeatedly led toworld, and they will all no doubt have a major influence on

tragic events—people oppressing those from different

the information society we live in going forward.

denominations within their own religion, for example, or© Internet Initiative Japan Inc.

Feb.2022

Vol.

53

4. Focused Research (3)massacring other ethnic groups. The European Coal and

Ireland. The details are complex, but roughly speaking, under

Steel Community was created with the aim of establishing

Facebook’s Safe Harbor agreement, Facebook users’ per-final national boundaries and securing a lasting peace after

sonal data was, for example, being transferred from Ireland

World War II. Gradually building its cooperation with the(location of Facebook’s EU headquarters) to the US. But as

European Atomic Energy Community and the European

the Snowden expose revealed, the US government was able

Commission, it eventually grew to become the EU we know

to freely view that data. This means, said the complaint,

today. The EU operates on the premise that governmentsthat Facebook is breaking the Safe Harbor agreement, and if

can also overstep and run wild, so when EU laws are

the US government can legally spy on the services of private

passed, it is stipulated that independent, third-party

companies under US law, then the Safe Harbor agreement

supervisory authorities that have the power to enforce theitself is pretty much meaningless in the first place. The Irish

law with respect to governments also be established. So

High Court, unable to make a decision, referred the matterthe EU’s privacy protection supervisory authorities strictly

to the Court of Justice of the EU (CJEU). In a shocking

enforce the law with respect to privacy breaches not only

ruling, in October 2015 the CJEU declared the Safe Harborover private-sector companies but also over governments

Agreement invalid. This is known as the Schrems I decision.

and public agencies.

The inability to transfer personal data from the EU to the
US represented an extreme impediment to trade, however,This difference in thinking means the US and the EU areso economic proponents within the European Commission

basically incompatible in the world of privacy. But because

and the US Department of Commerce adopted a new spe-

they are each other’s largest trading partner, people in thecial framework called Privacy Shield in August 2016. The

EU involved in the business of trade desire a good relation-

Patriot Act, created after the 2001 terrorist attacks, expired

ship with the US. Personal data is generally distributed

in 2015, but the mechanisms for exposing terrorists arguably

as part of commercial activities and is thus inseparably

remained intact, albeit with increased transparency, underlinked with trade negotiations. In 2000, therefore, theits successor, the Freedom Act. Privacy protection advocates

EU created a framework called the EU-US Safe Harborwithin the European Commission claimed, therefore, that

Principles, under which private-sector organizations werenothing had really changed, and debate about the validity

permitted to freely transfer personal data from the EU toof Privacy Shield thus continued to smolder on during andthe US provided they submitted a notification to the US

after 2017. Once the GDPR came into effect on May 25,

Department of Commerce attesting that they had adequate

2018, Schrems immediately filed another suit claiming that

security measures in place and will not pass personal data

it was illegal for US companies to transfer EU personal datafrom the EU to third parties.

to the US based on Privacy Shield. The case was settled
in July 2020 with the ruling that Privacy Shield was alsoThis collapsed in the wake of the Snowden expose.

illegal. This is the Schrems II decision. Following Schrems

Snowden’s revelations prompted doubt about the effective-

II, the SCCs were also reviewed, and modernized SCCs

ness of the Safe Harbor agreements in the mind of Austrian

were issued in June 2021.

lawyer Max Schrems, who then filed a legal complaint in© Internet Initiative Japan Inc.

43

The new SCCs provide extra protections that require

Although the process is gradual, the revised Personal

companies and other bodies that transfer data to disclose

Information Protection Act, which was passed in June 2020

information about access by public authorities in theand will come into effect from April 1, 2022, also looks

destination country (whether the country has laws that

set to tighten Japan’s protections and bring them closer inallow the government requisition data and whether theyline with the GDPR. For instance, penalties will be raised

are actually enforced).

from 300,000 yen and 500,000 yen to 100 million yen.
Stronger information disclosure requirements will apply whenOnce personal data is transferred from one country to

personal data is provided to a third party in a foreign country

another, it is no longer protected by the origin country’s(from the EU’s perspective, this means when personal data

laws, so various restrictions are thus imposed. Meanwhile,is transferred out of its domain). Cookies will be subject

the EU does recognize a number of countries as offering

to restrictions, although not quite to the extent as in theadequately secure personal data protections. It refers to

EU. And it will be mandatory to report personal data leaks

these as “adequate” countries (recognized by adequacythat match certain patterns to the Personal Information

decisions), and they include Switzerland, New Zealand,Protection Commission and other bodies (preliminary reportand Argentina. Personal data can be transferred from thewithin 3–5 days and a final report within 30 or 60 days;

EU to these countries. Japan joined these ranks in January

incidentally, the GDPR mandates reporting within 72 hours).

2019. Japan’s Personal Information Protection Act is notquite up to the GDPR standards, however, so personal data

■ Cultural backgroundmay only be transferred if certain supplementary rules are

In light of the above historical background, I see three major

applied.

trends in personal data protection across the globe today.

The Personal Information Protection Act is to be reviewed

One is a sort of public welfare idea that the sharing of big

every three years to bring it up to speed with technological

data will benefit people all over the world, which seems todevelopments and other countries’ laws and regulations,be the mainstream view in the US. Another is the humanand thus it may approach parity with the GDPR going forward.

rights assertion that says that the ability to manage yourOn the other hand, Japanese personal data can also be

own personal data is a basic human right, which is the main-transferred to the EU. As announced in January 2019,

stream view in Europe. And then there is the security-oriented

Japan and the EU reached a mutual agreement on the flow

idea that the management of data within a country’s ownof personal data between each other’s domains, and thisdomain is its own national security issue, which is probably

means that Japan also recognizes the EU as having

exemplified by China.

adequate protections. The only other place Japan recognizes

44

in this manner is the UK. Given these developments, it

In the US, personal data is seen not only as holding

does seem like the Japanese government’s approach whenconvenience for the user but also as conveying benefits toit comes to protecting privacy is to strengthen individuals’

a wide swath of other users, as exemplified by the rise ofrights and interests using the EU’s GDPR as a reference.

GAFA. This is evident from Google’s mission, for instance,© Internet Initiative Japan Inc.

Feb.2022

Vol.

53

4. Focused Research (3)which reads: “Our mission is to organise the world’s infor-

than emphasizing any single factor alone. But I think it’smation and make it universally accessible and useful.” The

important to note that, broadly speaking, there are threehistory of American society is one of pioneering on the

major perspectives around personal data, each emerging

frontier, and this is possibly what embedded the idea of

from its own historical and cultural backdrop, and there

information sharing, including for the purposes of protecting

is no unified mindset on personal data that applies acrossnational security, as an important part of its culture. In

the entire world.

terms of its development strategy too, this seems to have
led to a set of values that embrace the idea of de facto

Closer to home in Japan (and while certainly not thestandards, the idea that prevalence itself is what makes amainstream world view), there is a culture of regarding

standard, something that has been a prominent factor in

information as being equivalent to value itself, a view that

the Internet as well.

comes from the Japanese concept of kotodama, the belief
that mystical powers dwell in words. So when it comes

In Europe, on the other hand, personal data was at times

to personal data, people may feel that if someone knows

something that could affect whether a person lived or died,

information about you, they actually know you in someso the ability of the subject of personal data to know andtrue sense. In older times, there was a cultural practicemanage that data is seen as a right. Further, the developmentof hiding one’s true name out of the belief that knowing

strategy is one of clarifying processes thought to have been

someone’s name would confer dominion over them. Theredeveloped as part of colonial policies, with standardizationis also a long-held idea that you should not utter unlucky

being pivotal to the global development of data protections.

thoughts (put misfortunes into words) because expressing
information can somehow lead to the events it describes

In China, which exerts a significant influence on the

coming to pass (this is a deep rabbit hole to go down, so

world in recent times, the desire to maintain the nation

I will cut the discussion short here).

is a crucial factor, and so naturally the thinking is thatjudgements about all sorts of information, including per-In any case, when it comes to personal data protection, thissonal data, should be based on national security. Hence,

Japanese style of thinking, at least, is unlikely to pass muster

China recommends its own country’s services over thoseelsewhere in terms of the mindset and meaning it implies andcreated in the US, and it imposes heavy restrictions on

the weight of the belief. Of course, there is clearly no globally

information flows between countries. And of course, theunified view, and this holds for the US mindset, the European

strategy is a nationalistic one: information flows involving

mindset, and the Chinese mindset alike. In our information

China will take place under China’s restrictions.

society, information is not just a set of symbols. There are
historical and cultural backgrounds, and therefore each culture

Of course, these are somewhat stereotypical character-has its own principles, its own ideas about the right way to

izations. I think countries’ information control strategies

handle information, so when it comes to flows of information

are carried out with an eye on any number of elements

across national borders, there is a desire to ensure that theto do with the public interest, rights, and security, rather

principles of each country or region involved are respected.

© Internet Initiative Japan Inc.

45

4.4 IIJ’s Road to BCR Approval

4.5 Looking Ahead

IIJ was an early mover on BCR approval, but the process

As discussed earlier, as the Internet spreads further, initiatives

was full of twists and turns. The impact of Brexit in particularin personal data protection will no doubt continue to affectwas significant, and the IIJ Group, which had aimed toInternet-related companies and other companies in various

obtain approval from the UKs ICO, did have to make a major

ways. This process is a necessary part of the way society

strategic change along the way.

is adapting to facets of the information age, most notably
the Internet, and even in Japan where attitudes can be

Table 1 provides a brief overview.

indifferent, these changes are something that, sooner orlater, we will be unable to ignore. Of course, even frommy own experience, I cannot declare that every company
should obtain BCR approval, but objectively speaking, there
are many companies in Japan that do need it, and they will
eventually be forced to take action of some sort.

Date

Organization

ActionJan 2016

IIJ Europe

IIJ-EU receives CEO ￼approval to start working toward GDPR compliance. Work begins in earnest.

Mar 2016

GDPR Office

Office set up by the Risk Management Office, Compliance Department, Global Business Division, and IIJ Europe.

Jun 2016

UK

Brexit prevails.

Jul 2016

GDPR Office

Decides on law firm.

Aug–Oct 2016

Risk Management Office

Creates BCR document.

Aug 2016

IIJ Europe

Starts GDPR compliance support consulting.

Oct 2016

GDPR OfficeSubmits BCRs to the Information Commissioner's Office (ICO), the UK’s personal data protection authority.

Mar 2017

UK

Prime Minister signs a letter triggering Brexit.

Aug 2017

ICO

First communication that IIJ’s BCRs are now under review. An ongoing process of revisions follows.

May 25, 2018

EU

GDPR comes into effect.

Jan 10, 2019

ICO

UK ICO’s review is completed and submitted to the co-reviewers (Germany, Netherlands).

Feb 12, 2019

EDPB

Information on competent supervisory authorities post-Brexit is published. Appears we will not make it in time for Brexit.

Mar 1, 2019

LDI-NRW

Co-reviewer comments on IIJ’s BCRs from the authority in NRW, Germany.

Mar 21, 2019

Dutch authority

Co-reviewer comments on IIJ’s BCRs from the Dutch authority.

Mar 28, 2019

GDPR Office

Presents response to comments to ICO. Brexit deadline extended to Oct 31.

May 16, 2019

ICO

Co-reviewer provides notice that the review is complete. Pre-review by the EDPB ITES (International Transfers Experts Subgroup) meeting requested.

Jun 2019

UK

Prime Minister Theresa May resigns.

Jul 2019

UK

Boris Johnson becomes Prime Minister.

Jan 31, 2020

EU/UK

Britain withdraws from the EU. The transition period runs until end-2020.

Apr 2020

EDPB

Pre-review conducted by the EDPB ITES meeting under the ICO’s guidance. Several rounds of revisions ensue.

Jun 2020

EDPB

Provides notice that ICO approvals made during the Brexit transition period are invalid.

Jul–Sep 2020

GDPR Office

The supervisory authority in NRW, Germany, where IIJ Deutschland is located, is appointed as the competent authority.

Sep 2020

GDPR OfficeFormally requests the NRW authority to act as the competent authority.

Sep–Nov 2020

ICO/LDI-NRWLDI-NRW takes over from ICO on IIJ’s BCRs.

Dec 2, 2020

LDI-NRW

LDI-NRW officially becomes IIJ’s competent authority.

Dec 31, 2020

UK

Completely withdraws from the EU.

Apr 2021

EDPB

Review at ITES meeting (review had progressed under ICO, so passage is smooth).

May 2021

GDPR Office

Creates a German-language version of the BCR document.

Jun 28, 2021

LDI-NRW

Submits BCR-C and BCR-P to the EDPB.

Jul 28, 2021

EDPB

Deliberates at a plenary meeting. All clear given.

Aug 2, 2021

EDPB

Discloses a positive official opinion on IIJ BCR-C/P.

Aug 5, 2021

LDI-NRWIIJ BCR-C/P approved.

Table 1: IIJ’s BCR Approval Process

46© Internet Initiative Japan Inc.

Feb.2022

Vol.

53

4. Focused Research (3)The IIJ Group is also aware that it cannot rest on its laurels

work practices. At the risk of being repetitive, obtaining BCR

just because it has obtained BCR approval under the EU

approval for IIJ was never our end goal. Our bigger objective

GDPR. We realize that, at the very least, we will also need

was to use it as an opportunity to further bolster our internal

to comply with the UK’s requirements now that it is out ofcontrols around information security and privacy protection.

the EU, and that we will need to adhere with other personal

We are proud to have taken a major, if not definitive, step

data protection initiatives, including those in the US. The

toward that goal.

situation now is such that we could never keep up with allof the initiatives out there, but broad frameworks such as

I think the IIJ Group’s corporate mission can be described

APEC CBPR, at least, are something we believe we should

as the single-minded pursuit of business with the Internet

also look at complying with.

at its core. Companies that specialize exclusively in global
Internet infrastructure seem to have become rare these

IIJ is also not immune to personal information breaches anddays. So, as a company that has helped drive the spreadother incidents, so I think we could be exposed to criticism

of the Internet, I think we have a responsibility to holdalong the lines of “look who’s talking.” But given the crucial

on to our Internet-centric perspective and continue making

role of personal information protection and other aspects ofcontributions as an infrastructure company for the information

information security in our modern information society, I

society age.

think there is a clear duty to address the issues in front of
us. Organizations need to respond to the personal data

To be honest, IIJ BCR was a slog, and I honestly wouldn’t

protection and other practices found in different cultures while

recommend it to anyone. But I can say emphatically that

also enhancing their own information security capabilities.

I’m glad we did it because I believe it will be one key pillar
supporting the type of Internet we envision.

Personal information protections and other information
security measures are not something that can be thrown

Looking ahead, we will continue to strive for a safe andtogether overnight. They become meaningful only once they

secure Internet.

are established as part of organizational culture and everyday

Takamichi Miyoshi
Senior Fellow, DPO (Data Protection Officer), IIJ. Mr. Miyoshi joined Internet Initiative Planning Inc. (now Internet Initiative Japan Inc.)in April 1993. He worked on launching Internet services and the operation of service equipment/facilities. He later served in services
development and strategic planning, going on to participate in numerous study groups set up by the Ministry of Internal Affairs andCommunications and other agencies as Managing Director of IIJ. He has been in his current position since June 2015.

© Internet Initiative Japan Inc.

47