EDPS Opinion 3/2024 on the signing and conclusion on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data

10 January 2024 Opinion 3/2024

on the signing and conclusion on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 1 December 2023, the European Commission issued two proposals for a Council Decision on the signing and on the conclusion, on behalf of the European Union, of the Protocol amending the Agreement between the EU and Japan for an Economic Partnership regarding free flow of data.

On 23 January 2019, Japan was granted an adequacy finding by the Commission. Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Japan covered by the adequacy decision may take place without the need to obtain any further authorisation.

The Agreement for an Economic Partnership between the EU and Japan was signed on 17 July 2018. The objective of this Agreement is, in particular, to remove the vast majority of duties paid by EU and Japanese companies and other technical and regulatory trade barriers. On 12 July 2023, the Council authorised the Commission to negotiate the inclusion of provisions on cross-border data flows in the Agreement between the EU and Japan for an Economic Partnership.

The EDPS notes that the protocol amending the Agreement exclusively concerns cross-border data flows between the EU and Japan. Considering that Japan has already been granted an adequacy finding by the Commission, the EDPS recommends to further explain why, despite this adequacy decision, further negotiations on cross-border data flows were considered to be necessary.

The EDPS welcomes that the negotiated protocol provides that each party shall adopt or maintain a legal framework that provides for the protection of personal data related to electronic commerce.

The EDPS recalls that he supports the legal wording of the horizontal provisions for cross-border data flows and personal data protection in trade negotiations, published by the Commission in July 2018. These horizontal provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by EU law.

The EDPS notes that the amending protocol does not integrally take over the horizontal provisions. In amending the legal wording of the horizontal provisions, the EDPS considers that the protocol creates legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with EU data protection law. In particular, the EDPS is concerned that the protocol, in its current wording, could affect the EU’s personal data protection rules and the possibility for the EU to, in duly justified cases, enact measures that would require controllers or processors to store personal data in the EU/EEA.

To better reflect the legal wording of the horizontal provisions, the EDPS recommends amending the protocol in order to clarify that each party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through rules for the cross-border transfer of personal data. The EDPS also recommends clarifying that nothing in the Agreement shall affect the protection of personal data and privacy afforded by the parties’ respective safeguards.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 1 December 2023, the European Commission issued:  a proposal for a Council Decision on the signing, on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data (‘the Signing Proposal’) ; and  a proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol amending the Agreement between the European Union and Japan for an Economic Partnership regarding free flow of data (‘the Conclusion Proposal’) .

2. The objective of the Signing Proposal is to approve the signing of the protocol amending the agreement between the European Union and Japan for an Economic Partnership regarding free flow of data ('the Protocol') .

3. The objective of the Conclusion Proposal is to approve the Protocol .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 December 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the third citation of the Signing Proposal and Conclusion Proposal.

2. General remarks

5. By decision of 29 November 2012, the Council approved negotiating directives for the Commission to negotiate a free trade agreement with Japan, on the basis of which the Commission negotiated the Agreement between the European Union and Japan for an Economic Partnership, signed on 17 July 2018 (‘the Agreement’). The Agreement entered into force on 1 February 2019. The objective of the Agreement is, in particular, to remove the vast majority of duties paid by EU and Japanese companies and other technical and regulatory trade barriers.

6. Chapter 8 of the Agreement contains provisions on trade in services, investment liberalisation and electronic commerce. Article 8.81 of the Agreement, which relates to the free flow of data, provides that '[t]he Parties shall reassess within three years of the date of entry into force of this Agreement the need for inclusion of provisions on the free flow of data into this Agreement’. In its meeting of 25 March 2022, the Joint Committee established by Article 22.1 of the Agreement examined whether the economic partnership between the European Union and Japan would benefit from the inclusion of provisions on cross-border data flows in the Agreement. Building on that examination, the representatives of the European Union and Japan, at the 28th EU-Japan summit (in May 2022), committed to consider the launch of the negotiations needed for such inclusion, as underlined in the Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership (the ‘Recommendation’) .

7. The EDPS was consulted on this matter and issued on 9 August 2022 his Opinion 17/2022 on the Recommendation . On 12 July 2023, the Council authorised the Commission to negotiate the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership ('the Agreement') .

8. On 28 October 2023, the negotiations of the provisions on cross-border data flows to be included in the Agreement were concluded .

9. According to the Commission, the outcome of the negotiations confirms the EU and Japan’s continued commitment to the rules-based international trading system and joint determination to shape global data flow rules that respect shared values and respective regulatory approaches. As mentioned in the Signing Proposal, the EU and Japan agreed on rules addressing unjustified obstacles to data flows while preserving regulatory autonomy in the area of data protection and privacy .

10. The Protocol should now be signed and approved on behalf of the EU.

11. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

12. In this regard, the EDPS positively notes that Japan has already been granted an adequacy finding by the Commission on 23 January 2019 (‘the Adequacy Decision) . Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Japan covered by the Adequacy Decision may take place without the need to obtain any further authorisation .

13. In this context, the EDPS notes that the Protocol exclusively concerns cross-border data flows between the European Union and Japan. In view of the Adequacy Decision, the need for having additional rules covering cross-border data flows should be expressed in more detail so that the justification for an amendment of the Agreement is made clearer . In other words, the EDPS recommends to further explain why, despite the Adequacy Decision, further negotiations on cross-border data flows were considered to be necessary.

3. Horizontal provisions on cross-border data flows

14. On 31 January 2018, the European Commission endorsed horizontal provisions for crossborder data flows and personal data protection in trade negotiations (‘the Horizontal Provisions’), which were published in July 2018 .

15. The EDPS recalls that he supports the legal wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of fundamental rights of the EU and the EU legislation on the protection of personal data .

16. In his Opinion 17/2022, the EDPS welcomed that Recital 4 to the Recommendation confirmed that the negotiations would be opened ‘with a view to include the provisions on

data flows into the Agreement, coherent with the horizontal provisions for cross-border data flows and personal data protection in trade negotiations’ (emphasis

added) .

17. In his Opinion 3/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, the EDPS recommended that the wording agreed with the UK on data protection and privacy (which modified the Horizontal Provisions) remained an exception and would not be the basis for future trade agreements with other third countries . On this note, the EDPS recalls that the Commission has repeatedly stated that as ‘the protection of personal data is a fundamental right in the EU, it cannot be subject to negotiations in the context of EU trade agreements’. Consequently, the Horizontal Provisions should not be up for negotiation .

18. Nonetheless, the EDPS notes that the Protocol does not integrally take over the Horizontal Provisions. In amending the legal wording of the Horizontal Provisions, the EDPS considers that the Protocol creates legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with the EU data protection legal framework. The EDPS reinstates that, as a matter of principle, the wording of the Horizontal Provisions should be kept in EU trade agreements containing provisions for cross-border data flows and personal data protection. He also stresses that any different wording resulting from negotiations in a specific case should not serve as a precedent for negotiations of EU trade agreements with other third countries on matters of cross-border data flows and personal data protection.

4. Differences between the Horizontal Provisions and the Protocol

19. The EDPS regrets that the legal wording of the Horizontal provisions was modified in the Protocol. In particular, the EDPS is concerned that the Protocol, in its current wording, could - contrary to the negotiating directives contained in the Recommendation - affect the EU’s personal data protection rules and the possibility for the EU to, in duly justified cases, enact measures that would require controllers or processors to store personal data in the EU/EEA .

20. In this regard, Article 3 of the Protocol, which would replace Article 8.81 of the Agreement, states that ‘Nothing in this Article shall prevent a Party from adopting or maintaining measures on the protection of personal data and privacy, including with respect to cross-border transfers of information, provided that the law of the Party provides for instruments enabling transfers under conditions of general application for the protection of the information transferred’ (emphasis added). According to footnote 4 of the Protocol, ‘“conditions of general application” refer to conditions formulated in objective terms that apply horizontally to an unidentified number of economic operators and thus cover a range of situations and cases’. It is not clear whether all duly justified cases in which the EU would decide to require specific controllers or processors to store specific personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy would qualify as conditions of general application under the Protocol. In practice, Article 8.81(4) of the Agreement as formulated under Article 3 of the Protocol would not fully safeguard how the EU regulates the protection of personal data and privacy and would mean the Protocol regulates what a law applying to data transfers should look like in the EU.

21. Furthermore, unlike Article B(2) of the Horizontal Provisions, Article 8.81(4) of the Agreement as formulated under Article 3 of the Protocol does not state that ‘[n]othing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards’. Article B(2) of the Horizontal Provisions was meant to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the General Agreement on Trade in Services. The absence of such wording in the Protocol would apparently not prevent the EU from having to pass strict trade tests to justify its measures safeguarding the fundamental rights to privacy and personal data protection.

22. Therefore, the EDPS recommends replacing the new Article 8.81(4) of the Agreement as formulated under Article 3 of the Protocol with the wording in Article B(2) of the Horizontal Provisions, which states that “Each Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards”.

23. In any event, even if Article 8.81(4) of the Agreement as formulated under Article 3 of the Protocol is not amended as suggested, the EDPS interprets the current wording as still allowing the EU to require, in duly justified cases, specific controllers or processors to store specific personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy, as long as there is a general framework (such as Chapter V of the GDPR) enabling transfers under conditions of general application.

24. The EDPS notes that new Article 8.81(2)(f) of the Agreement as formulated under Article 3 of the Protocol would establish that a Party shall not adopt or maintain measures which prohibit or restrict the cross-border transfer of information by electronic means where this activity is for the conduct of the business of a covered person where such measures entail “requiring the approval of the Party prior to the transfer of information to the territory of the other Party”. The EDPS welcomes that footnote 1 of the Protocol clarifies that this provision would not prevent the EU from subjecting the use of a specific transfer instrument or a particular cross-border transfer of information to approval on grounds relating to the protection of personal data and privacy, in compliance with Article 8.81(4) of the Agreement under Article 3 of the Protocol. However, also for this reason, the EDPS stresses the need to alter the text of Article 8.81(4) of the Agreement as formulated under Article 3 of the Protocol, in line with the recommendation set out in paragraph 22 of this Opinion. 8

25. The EDPS welcomes that Article 8.81(3) of the Agreement as formulated under Article 3 of the Protocol would allow the EU to adopt or maintain measures that would require (inter alia) the localisation of information (including personal data) in the territory of the EU for storage or processing or require the approval of the EU prior to the transfer of information to the territory of Japan to achieve a “legitimate public policy objective ” (other than the protection of personal data and privacy), under certain conditions.

26. The EDPS regrets that, unlike Article B(1) of the Horizontal Provisions, Article 8.82(1) of the Agreement under Article 4 of the Protocol does not refer to the right to data protection as a fundamental right, but merely that “individuals have a right to the protection of their personal data and privacy as provided for by the laws and regulations of each Party and that high standards in this regard contribute to trust in the digital economy and to the development of trade.” On the other hand, he welcomes that Article 8.82(2) and (3) of the Agreement under Article 4 of the Protocol establish that “Each Party shall endeavour to adopt measures that protect individuals, without discrimination based on grounds such as nationality or residence, from personal data protection violations occurring within its jurisdiction”, and that “Each Party shall adopt or maintain a legal framework that provides for the protection of personal data related to electronic commerce.”

27. The EDPS also notes that, contrary to Article X of the Horizontal Provisions, Article 8.82 of the Agreement under Article 4 of the Protocol does not contain provisions on regulatory dialogue and cooperation on regulatory issues with regard to digital trade.

5. Conclusions

28. In light of the above, the EDPS makes the following recommendations: (1) to detail in a recital the reasons why, despite the Adequacy Decision, further negotiations on cross-border data flows are considered to be necessary. (2) to replace the new Article 8.81(4) of the Agreement as formulated under Article 3 of the Protocol with the wording in Article B(2) of the Horizontal Provisions, which states that “Each Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards”. Brussels, 10 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10