Web Forum on Data and Values
Deutsches Institut für Japanstudien

10.6.2021 | Dr. Axel Frhr. von dem Bussche, LL.M.
(L.S.E.)
Private and Confidential

1

Introduction
Basic concepts of the GDPR
How is the GDPR relevant for Japan?

Introduction

Data protection is …
 a new market and power factor
 a corrective to digitalisation in a modern data economy•

international industry standard•

competitve advantage

 the new nature protection

 GDPR as the new gold standard:

Private and Confidential

3

Introduction

Above all: Preservation ofcompetitiveness!!!
How can business models based on
Audits in theinternational data exchange beprivate sector
preserved?

Global data protection: Legislative
progress worldwide (CCPA in USA,
LGPD in Brazil, PDPB in India etc.)

What do the authorities
do? Fines?

Activists, warning wave,
data subjects' rights

Private and Confidential

Press? A lot of nonsense and fuss
about the GDPRCOMPANIES

Certified Public Accountants(IDW PH 9.860.0)

New secret weapon labour law
Future: "DataBreach" litigation
funding4

Introduction
Outsourcing vs. internal
implementation?
Project Manager / Project Team
Process Management (Milestones,Timeline)

Management task

Customer data protection 20%
Employee data protection 80%

GDPR implementation

GDPR in a big way:international dimension

Private and Confidential

To dos:• Processing overview as a"must have"• DPAs for everything?
• See papers

The GDPR in miniature:
www.lda.bayern.de/de/kleine-unternehmen.html

5Introduction
How is this relevant for Japan?
How is this relevant for Japan?
 Japanese companies must also comply with the requirements of the GDPR if they
offer services in the EU or monitor the behaviour of data subjects.
 The GDPR has a comprehensive catalogue of obligations, the violation of which
can lead to heavy fines.
•In the case of certain infringements, fines of up to EUR 10 million or 2% of thetotal worldwide annual turnover of the company or in other cases EUR 20
million or 4% of the total worldwide annual turnover of the company (inparticular for data transfers to a third country).

Private and Confidential

6

Introduction
How is this relevant for Japan?
Adequacy Decision – Free Flow of Data between EU and Japan?
 Commission Implementing Decision: Japan ensures “adequate level of protection”.
• Came into force on 23 January 2019
• Political context of JEFTA: free trade and free data flow.
 What does it mean?
• Transfers of personal data from the EU are not subject to additionalrequirements.
• E.g. Standard Data Protection Clauses, Binding Corporate Rules, Code ofConduct What does it not mean?
• Exemptions from GDPR: scope of applicability remains the same.
• Clear distinction between European and Japanese data protection regimes.
o processing activities may be subject to EU and Japanese law at the same timeo companies may be subject to EU and Japanese supervision at the same time
Private and Confidential

7

2Transfers of personal data to thirdcountries
Schrems II, SCC

Transfer of personal data to a third country
Schrems IIBackground Activist Maximilian Schrems called for the Irish Data Protection Commissioner toinavlidade the SCCs used by Facebook Ireland Ltd. for transfering personal data tothe US.

 European Court of Justice ruled on 16 July 2020 – (C-311/18 „Schrems II“).

 SCCs remain applicable and can be the basis for a third country transfer.

Private and Confidential

9Transfer of personal data to a third country
SCC
SCC – Key takeaways:
 4 June 2021 the European Commission issued modernised SCCs.
1. Future transactions: after grace period of 3 months following official publication (yet tocome) only new SCC shall be used.
2. Existing agreements: + within 15 months, existing SCC to be replaced with new SCC.
3. The new SCC include a lot of Schrems II obligations. However, additional safeguards
will need to be implemented.
4. Mandatory transfer impact assessment (TIA) re importer’s country laws meeting EUstandards. TIA documentation duty, authorities can request copy.
5. The new SCC follow a “modular approach”: more flexible but also more difficult to use.
6. New scenarios “Processor-to-Processor” and “Processor-to-Controller” have been
introduced.
7. The new SCC include strict hierarchy and a liability clauses; difficult for data importers
to limit their liability.
Private and Confidential

10Your Taylor Wessing TeamAxel von dem Bussche is a specialist lawyer for information technology law. He heads up the Technology, Media & Telecoms practice groupand coordinates Taylor Wessing's international US Group for Germany.
With his considerable years of experience and outstanding expertise, he routinely guides clients from the technology sector throughcomplex international transactions, contract drafting and regulatory issues. Axel is an accomplished data protection and GDPR expert. He
supports corporate groups with the transformation to digital and global business models and also conducts negotiations with the responsible
regulatory authorities.
Languages
German, English, French“Axel von dem Bussche is a data protection specialist, advising companies on complex implementation mandates. His expertise also
includes cybersecurity as well as whistle-blower protection matters.” Chambers & Partners Europe 2020

Dr. Axel Frhr. von dem Bussche, LL.M. (L.S.E.)“very experienced”, “top networked”, Competitors, JUVE 2019/2020

Partner
Hamburg

Highlighted as Best Lawyer for IT, Best Lawyers in Germany, Handelsblatt 2018-2020+49 40 36803-229
a.bussche@taylorwessing.com

Leading Individual, Legal 500 Germany 2019-2021
TOP Lawyer for Data Protection Law, WirtschaftsWoche 2019, 2020
“Axel Freiherr von dem Bussche is an ‘excellent IT lawyer’, praise peers.”, Who’s Who Legal 2020

Key areas of expertiseIT & Telecoms

Data Protection

One of the world’s leading Data Privacy and Protection and Information Technology lawyers,
Who’s Who Legal 2018 - 2020



Copyright & Media Law

Litigation & Dispute Resolution

Recommended for information technology, data protection and media“one of the best, absolute strategist” ; “absolute expert in the industry”, JUVE 2018/2019

Technology, Media & Communications

Especially highlighted for Privacy Law, Kanzleimonitor (BUJ) 2018/2019

Private and Confidential

11Europe > Middle East > Asia

taylorwessing.com© Taylor Wessing 2021
This publication is not intended to constitute legal advice. Taylor Wessing entities operate under one brand but are legally distinct, either being or affiliated to a member of Taylor Wessing Verein. Taylor Wessing Verein does not itself provide services. Further
information can be found on our regulatory page at taylorwessing.com/en/legal/regulatory-information.