Commission Decision of 29 March 2011 pursuant to Regulation (EC) No 45/2001 of the European Parliament and of the Council on the adequate level of protection provided by Japan for personal data transferred from the European Union in the specific cases of transfer by the European Commission to Japanese customs authorities under Decision No 1/2010 of the Joint Customs Cooperation Committee pursuant to Article 21 of the Agreement between the European Community and the Government of Japan on cooperation and mutual administrative assistance in customs matters regarding mutual recognition of authorised economic operator programmes in the European Union and in Japan and for the exclusive and specific purposes of Decision No 1/2010 of the Joint Customs Cooperation Committee (2011/197/EU)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data⁽¹⁾, and in particular Article 9(1) and (2) thereof,

After consulting the European Data Protection Supervisor,

Whereas:

1. On 24 June 2010 the Joint Customs Cooperation Committee, set up pursuant to Article 21 of the Agreement between the European Community and the Government of Japan on cooperation and mutual administrative assistance in customs matters⁽²⁾ adopted Decision No 1/2010 regarding mutual recognition of authorised economic operators programmes in the European Union and in Japan⁽³⁾, (hereafter, ‘JCCC Decision No 1/2010’).

2. JCCC Decision No 1/2010 provides in Section IV for an exchange of information between customs authorities as defined in Article 1(c) of the Agreement between the European Community and the Government of Japan on cooperation and mutual administrative assistance in customs matters. According to that definition, the Japanese Ministry of Finance and the competent services of the Commission are deemed to be a customs authority.

3. The information to be exchanged between the Japanese Ministry of Finance and the competent services of the Commission comprises of details on economic operators, which may also contain personal data. The transfer of data of economic operators falls within the tasks of the Commission to be carried out under JCCC Decision No 1/2010.

4. Personal data to be exchanged are listed in Section IV(4)(a) to (f) of JCCC Decision No 1/2010. The duration of the transfers is for the whole period of time for which the Japanese Ministry of Finance uses the information in order to grant to European economic operators benefits under the terms of JCCC Decision No 1/2010. The Commission will regularly transfer updated and modified data of European economic operators to the Japanese Ministry of Finance. With regard to the exchange of information, Section IV(6) of JCCC Decision No 1/2010 restricts the use of any such data to the purposes of implementing the mutual recognition of authorised economic operator programmes between the European Union and Japan as established by that decision. The Agreement between the European Community and the Government of Japan on cooperation and mutual administrative assistance in customs matters also ensures that any such information, including personal data, is used by the Japanese Ministry of Finance solely for the purposes of their recognition as authorised economic operators in Japan. Authorised economic operator (AEO) data may not be transferred onward by the recipient authority to other authorities or services in or outside Japan because this would amount to a change of purpose not covered by JCCC Decision No 1/2010.

5. Processing of personal data by Japanese public authorities, such as the Japanese Ministry of Finance, is governed by the Japanese Act on the Protection of Personal Information Held by Administrative Organs. The right of access to and procedures for consulting ‘Administrative Documents’ is laid down by the Japanese Act on Access to Information Held by Administrative Organs. Provisions on confidentiality of data handled by Japanese public authorities and data transfers between the Minister of Finance and foreign customs authorities respectively are included in the National Public Service Law and the Customs Law.

6. Japanese data protection legislation requires Japanese public authorities, amongst which the Japanese Ministry of Finance, to provide data subjects with fair disclosure of information. Data subjects have a right to access, to initiate rectification and deletion of data relating to them.

7. Japanese legislation ensures that organisational security measures, appropriate to the risks presented by data processing, are taken by the Japanese Ministry of Finance.

8. Japanese legislation provides for an investigative mechanism in the form of a Review Board, which undertakes administrative appeals and investigation. This may be regarded as sufficient for the specific data transfer provided for by JCCC Decision No 1/2010 given the limited and non-sensitive nature of the data and the purposes of the data processing.

9. The above provisions ensure that appropriate enforcement mechanisms are in place in Japan in order to guarantee the protection of the personal data which maybe transferred by the Commission for the purpose of identifying European economic operators with regard to their recognition as authorised economic operators in Japan.

10. In the light of all the circumstances surrounding the set of the specific data transfer operations to be performed by the Commission in implementing JCCC Decision No 1/2010, the nature of the data, the purpose and duration of the proposed processing operation or operations, the rules of law, both general and sectoral, in force in Japan and the professional rules and security measures which are complied with in Japan, the level of protection provided in Japan for the transfer of personal data from the competent services of the Commission to the Japanese Ministry of Finance in implementing JCCC Decision No 1/2010 is considered to be of an adequate level.

11. This Decision should be limited to the specific situation referred to in JCCC Decision No 1/2010 as the assessment of Japanese data protection legal framework was based on the limited categories of data to be transferred, on the limited purpose for processing and on the limited duration of use of such data. Therefore this Decision is limited to the protection afforded to personal data transferred from the EU to Japan by the European Commission under the abovementioned JCCC Decision in view of the specific purpose and circumstances of their processing in Japan.

12. This Decision is without prejudice to findings of the Commission in application of Article 25(4) and (6) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data⁽⁴⁾,

HAS ADOPTED THIS DECISION: