Source: EURLEX
Language: en
Format: md

**Council of the**
**European Union**

**Interinstitutional File:**

**2023/0451(NLE)**

**PROPOSAL**

**Brussels, 1 December 2023**
**(OR. en)**

**16001/23**
**ADD 1**

**POLCOM 285**
**SERVICES 53**
**COASI 211**

From: Secretary-General of the European Commission, signed by Ms Martine
DEPREZ, Director

date of receipt: 1 December 2023

To: Ms Thérèse BLANCHET, Secretary-General of the Council of the
European Union

No. Cion doc.: COM(2023) 773 final - ANNEX

Subject: ANNEX to the Proposal for a Council Decision on the signing, on behalf
of the European Union, of the Protocol amending the Agreement
between the European Union and Japan for an Economic Partnership
regarding free flow of data

Delegations will find attached document COM(2023) 773 final - ANNEX.

Encl.: COM(2023) 773 final - ANNEX

16001/23 ADD 1 AG/hp
## COMPET.3 EN

EUROPEAN

COMMISSION

**ANNEX**

_**to the**_

Brussels, 1.12.2023
COM(2023) 773 final

ANNEX

**Proposal for a Council Decision**

**on the signing, on behalf of the European Union, of the Protocol amending the**
**Agreement between the European Union and Japan for an Economic Partnership**

**regarding free flow of data**

# **EN EN**

**ANNEX**

PROTOCOL

AMENDING THE AGREEMENT

BETWEEN THE EUROPEAN UNION

AND JAPAN

FOR AN ECONOMIC PARTNERSHIP

& /en 1

THE EUROPEAN UNION and JAPAN (hereinafter referred to as "the Parties"),

HAVING reassessed the need for inclusion of provisions on the free flow of data into the

Agreement between the European Union and Japan for an Economic Partnership, signed at Tokyo

on 17 July 2018 (hereinafter referred to as "the Agreement"), in accordance with Article 8.81 of the

Agreement,

HAVE AGREED AS FOLLOWS:

ARTICLE 1

The table of contents of the Agreement shall be amended by deleting the words "Articles 8.70 to

8.81" and replacing them with the words "Articles 8.70 to 8.72".

ARTICLE 2

Article 8.71 of the Agreement shall be amended by deleting the word "and" of subparagraph (a), by

deleting the period of subparagraph (b)(ii) and replacing it with a semicolon, and by inserting the

following subparagraphs immediately after subparagraph (b)(ii):

"(c) "covered person" means:

(i) a covered enterprise;

(ii) an entrepreneur of a Party; and

(iii) a service supplier of a Party; and

(d) "personal data" means any information, relating to an identified or identifiable natural

person."

& /en 2

ARTICLE 3

Article 8.81 of the Agreement shall be replaced by the following:

"ARTICLE 8.81

Cross-border transfer of information by electronic means

1. The Parties are committed to ensuring the cross-border transfer of information by electronic

means where this activity is for the conduct of the business of a covered person.

2. To that end, a Party shall not adopt or maintain measures which prohibit or restrict the cross

border transfer of information set out in paragraph 1 by:

(a) requiring the use of computing facilities or network elements in the territory of the Party for

information processing, including by requiring the use of computing facilities or network

elements that are certified or approved in the territory of the Party;

(b) requiring the localisation of information in the territory of the Party for storage or processing;

(c) prohibiting storage or processing of information in the territory of the other Party;

(d) making the cross-border transfer of information contingent upon use of computing facilities or

network elements in the territory of the Party or upon localisation requirements in the territory

of the Party;

(e) prohibiting the transfer of information into the territory of the Party; or

& /en 3

(f) requiring the approval of the Party prior to the transfer of information to the territory of the

other Party. **[1]**

3. Nothing in this Article shall prevent a Party from adopting or maintaining measures

inconsistent with paragraphs 1 and 2 to achieve a legitimate public policy objective **[2]**, provided that

the measure:

(a) is not applied in a manner which would constitute a means of arbitrary or unjustifiable

discrimination between countries where like conditions prevail, or a disguised restriction on

trade; and

(b) does not impose restrictions on transfers of information that are greater than necessary to

achieve the objective. **[3]**

4. Nothing in this Article shall prevent a Party from adopting or maintaining measures on the

protection of personal data and privacy, including with respect to cross-border transfers of

information, provided that the law of the Party provides for instruments enabling transfers under

conditions of general application **[4]** for the protection of the information transferred.

5. This Article does not apply to cross-border transfer of information held or processed by or on

behalf of a Party.

& /en 4

6. A Party may at any time propose to the other Party to review the measures listed in

paragraph 2.

_________________

**1** For greater certainty, subparagraph 2(f) does not prevent a Party from:
(a) subjecting the use of a specific transfer instrument or a particular cross-border transfer
of information to approval on grounds relating to the protection of personal data and
privacy, in compliance with paragraph 4;
(b) requiring the certification or conformity assessment of ICT products, services and
processes, including Artificial Intelligence, before their commercialisation or use in its
territory, to ensure compliance with laws and regulations consistent with this Agreement
or for cybersecurity purposes, in compliance with paragraphs 3 and 4, and
Articles 1.5, 8.3 and 8.65; or
(c) requiring that re-users of information protected by intellectual property rights or
confidentiality obligations resulting from domestic laws and regulations consistent with
this Agreement, respect such rights or obligations when transferring the information
across borders, including with regard to access requests by courts and authorities of
third countries, in compliance with Article 8.3.
**2** For the purpose of this Article, "legitimate public policy objective" shall be interpreted in an
objective manner and shall enable the pursuit of objectives such as the protection of public
security, public morals, or human, animal or plant life or health, or the maintenance of public
order or other similar objectives of public interest, taking into account the evolving nature of
digital technologies.
**3** For greater certainty, this provision does not affect the interpretation of other exceptions in
this Agreement and their application to this Article and the right of a Party to invoke any of
them.
**4** For greater certainty, in line with the horizontal nature of the protection of personal data and
privacy, "conditions of general application" refer to conditions formulated in objective terms
that apply horizontally to an unidentified number of economic operators and thus cover a
range of situations and cases."

& /en 5

ARTICLE 4

The following Article shall be inserted after Article 8.81 of the Agreement:

"ARTICLE 8.82

Protection of Personal Data

1. The Parties recognise that individuals have a right to the protection of their personal data and

privacy as provided for by the laws and regulations of each Party and that high standards in this

regard contribute to trust in the digital economy and to the development of trade. Each Party

recognises the right of the other Party to determine the appropriate level of the protection of

personal data and privacy, to be provided for by their respective measures.

2. Each Party shall endeavour to adopt measures that protect individuals, without discrimination

based on grounds such as nationality or residence, from personal data protection violations

occurring within its jurisdiction.

3. Each Party shall adopt or maintain a legal framework that provides for the protection of

personal data related to electronic commerce. In the development of its legal framework for the

protection of personal data and privacy, each Party should take into account the principles and

guidelines of relevant international bodies. The Parties also recognise that high standards of privacy

and data protection as regards government access to privately held data, such as those outlined in

the OECD Principles for Government Access to Personal Data held by Private Sector Entities,

contribute to trust in the digital economy.

& /en 6

4. Each Party shall publish information on the protection of personal data and privacy it provides

to users of electronic commerce, including:

(a) how individuals can pursue remedies for a breach of the protection of personal data or privacy

arising from digital trade; and

(b) guidance and other information regarding compliance of businesses with applicable legal

requirements for the protection of personal data and privacy."

ARTICLE 5

Article 8.63 of the Agreement shall be deleted.

ARTICLE 6

This Protocol shall enter into force in accordance with paragraphs 1 and 2 of Article 23.2 of the

Agreement.

& /en 7

ARTICLE 7

1. This Protocol, in conformity with Article 23.8 of the Agreement, is drawn up in duplicate in

the Bulgarian, Croatian, Czech, Danish, Dutch, English, Estonian, Finnish, French, German, Greek,

Hungarian, Italian, Latvian, Lithuanian, Maltese, Polish, Portuguese, Romanian, Slovak, Slovenian,

Spanish, Swedish and Japanese languages, all of these texts being equally authentic.

2. In case of any divergence of interpretation, the text of the language in which this Protocol was

negotiated shall prevail.

IN WITNESS WHEREOF, the undersigned, duly authorised to this effect, have signed this

Protocol.

DONE at XXX, on the XX day of [MONTH], in the year XXXX.

For the European Union

For Japan

& /en 8