Summary of the Opinion of the European Data Protection Supervisor on the Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership

(2022/C 426/08)

(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)

On 12 July 2022, the Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership (1).

The Agreement between the European Union and Japan for an Economic Partnership (2) was signed on 17 July 2018. The objective of this Agreement is, in particular, to remove the vast majority of duties paid by EU and Japanese companies and other technical and regulatory trade barriers.

On 23 January 2019, Japan was granted an adequacy finding by the Commission. Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Japan covered by the adequacy decision may take place without the need to obtain any further authorisation.

The EDPS takes note that the negotiations would exclusively concern cross-border data flows. Having regard to the fact that Japan has already been granted an adequacy finding by the Commission in 2019, the EDPS recommends detailing the reasons why, despite this adequacy decision, further negotiations on cross-border data flows are considered necessary.

The EPDS welcomes the specification that the provisions on cross-border data flows should be coherent with the horizontal provisions for cross-border data flows and personal data protection in trade negotiations. The horizontal provisions, published by the Commission in July 2018, represent a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of fundamental rights of the EU and the EU legislation on the protection of personal data.

The EDPS understands the negotiating directives and the horizontal provisions as allowing, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA. The EDPS recalls that, together with the EDPB, he recently recommended that controllers and processors, established in the EU/EEA and processing personal electronic health data within the scope of the Commission’s proposal for a Regulation on the European Health Data Space, should be required to store this data in the EU/EEA, without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V GDPR (3). For the avoidance of doubt, the EDPS recommends to expressly clarify in the negotiating directives that the negotiated rules should not prevent the EU or the Member States from adopting, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA.

1. INTRODUCTION

1. On 12 July 2022, the European Commission (‘the Commission’) issued a Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership (‘the Recommendation’).

2. By decision of 29 November 2012, the Council approved negotiating directives for the Commission to negotiate a free trade agreement with Japan, on the basis of which the Commission negotiated the Agreement between the European Union and Japan for an Economic Partnership, signed on 17 July 2018 (‘the Agreement’). The Agreement entered into force on 1 February 2019. The objective of the Agreement is, in particular, to remove the vast majority of duties paid by EU and Japanese companies and other technical and regulatory trade barriers.

3. Chapter 8 of the Agreement contains provisions on trade in services, investment liberalisation and electronic commerce. Article 8.81 of the Agreement, which relates to the free flow of data, provides that ’[t]he Parties shall reassess within three years of the date of entry into force of this Agreement the need for inclusion of provisions on the free flow of data into this Agreement’. In its meeting of 25 March 2022, the Joint Committee established by Article 22.1 of the Agreement examined whether the economic partnership between the European Union and Japan would benefit from the inclusion of provisions on cross-border data flows in the Agreement. Building on that examination, the representatives of the European Union and Japan, at the 28th EU-Japan summit (in May 2022), committed to consider the launch of the negotiations needed for such inclusion ( 4 )

4. As made clear by its title, the objective of the Recommendation is to authorise the Commission to open negotiations with Japan with the view to include provisions on data flows into the Agreement.

5. The present Opinion of the EDPS is issued in response to a consultation by the Commission of 22 July 2022, pursuant to Article 42(1) of EUDPR ( 5 )

5. CONCLUSIONS

17. In light of the above, the EDPS makes the following recommendations: (1) to detail in a recital the reasons why, despite the Adequacy Decision, further negotiations on cross-border data flows are considered to be necessary; (2) to clarify, in the negotiating directives included in the annex to the Recommendation, that the negotiated rules should not prevent the EU or the Member States from imposing on controllers and processors, in duly justified cases, to store personal data in the EU/EEA; and (3) to refer to the EDPS consultation in a recital.

Brussels, 9 August 2022. p.o. Leonardo CERVERA NAVAS Wojciech Rafał WIEWIÓROWSKI

(1) COM(2022) 336 final, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022PC0336&from=FR

(2) OJ L 330, 27.12.2018, p. 3.

(3) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

(4) Recital 2 to the Recommendation.

(5) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).