During its plenary session on Wednesday, 19 July, the European Data Protection Board (EDPB) welcomed the adoption of the adequacy decision establishing a new framework for transferring personal data between the EU and the United States (see EUROPE 13219/11) as well as the review of the adequacy decision between the EU and Japan (see EUROPE 13156/16).
The United States
Accordingly, while welcoming the new framework authorising the transfer of personal data between the European Economic Area and the United States, EDPB Chair Anu Talus stressed that citizens must be “aware of their rights” and organisations, “their obligations”.
As a result, the board published an information note aiming to provide objective information on the impact of the adequacy decision on transfers to the United States as well as the redress mechanisms available, including the new redress mechanism in the area of national security.
While its first review will take place next year, the “EDPB will continue to pay special attention to the correct implementation of this new instrument”, added the chair.
See the information note: https://aeur.eu/f/87s
Japan
The EDPB also adopted a statement on the first review of the adequacy decision for Japan. Overall, it agrees with the European Commission’s review and welcomes its proposal to move to a four-year review cycle.
The board was notably pleased with the developments in Japan’s legal framework, which have led to “further convergence” with the General Data Protection Regulation (GDPR)—particularly with regard to the right to object to one’s data being processed, the right to be notified about data leaks, and the expansion of which personal data are protected.
Nevertheless, the EDPB recommended that the European Commission carefully monitor the introduction of the new category of “pseudonymised” personal information as well as questions surrounding consent in situations where there is an imbalance of power.
The statement: https://aeur.eu/f/87r (Original version in French by Hélène Seynaeve)