16 Amendments of Romeo FRANZ related to 2018/2904(RSP)
Amendment 3 #
Recital J
J. whereas the Commission reports that with a view to facilitating international data transfers, the Cabinet of Japan adopted a Cabinet Decision on 12 June 2018 that delegates to the Personal Information Protection Commission (PPC), as the authority competent for administering and implementing the APPI, ‘the power to take the necessary action to bridge differences of the systems and operations between Japan and the concerned foreign country based on Article 6 of the Act in view of ensuring appropriate handling of personal information received from such country’; whereas this decision stipulates that this includes the power to establish enhanced protections through the adoption by the PPC of stricter rules supplementing and going beyond those laid down in the APPI and the Cabinet Order; whereas pursuant to this decision, these stricter rules would be binding and enforceable on Japanese business operators; whereas the Commission has not provided the text of this decision as part of the elements on which it has based its evaluation;
Amendment 7 #
Recital K
K. whereas the draft Commission implementing decision on the adequate protection of personal data by Japan is accompanied by, as Annex I thereto, the Supplementary Rules adopted by the PPC on 15 June 2018, which are based on Article 6 of the APPI, which explicitly allows the PPC to adopt stricter rules, including for the purpose of facilitating international data transfers; whereas the version of the Supplementary Rules provided by the Commission does not bear any official signature of the PPC; whereas the Supplementary Rules are not available on the official PPC websitare not yet publicly available;
Amendment 9 #
Recital M
M. whereas the Commission states that the Supplementary Rules would be legally binding on any personal information-handling business operator which receives personal data transferred from the EU on the basis of an adequacy decision and is therefore required to comply with those rules and any related rights and obligations, and that they would be enforceable by both the PPC and the Japanese courts; whereas some Japanese experts question whether the Supplementary Rules are binding;
Amendment 18 #
Recital S
S. whereas the Japanese data protection law which is the object of the draft implementing decision excludes from its scope several sectors when they process personal data for specific purposes, as well as personal data that are not part of an electronic filing system (i.e. manual filing systems); whereas the draft implementing decision would not apply to the transfer of personal data from the EU to a recipient falling within any of the above-mentioned exceptions provided for by Japanese data protection law;
Amendment 20 #
Recital V
Amendment 24 #
Paragraph 4
4. Points out that, in this regard, the European Court of Justice ruled in the Schrems case that ‘even though the means to which that third country has recourse, in this connection, for the purpose of ensuring such a level of protection may differ from those employed within the European Union in order to ensure that the requirements stemming from Directive 95/46 [(now replaced by the GDPR]) read in the light of the Charter are complied with, those means must nevertheless prove, in practice, effective in order to ensure protection essentially equivalent to that guaranteed within the European Union’;
Amendment 27 #
Paragraph 7
7. Notes that the material scope of the adequacy finding is not sufficiently defined in Article 1 of the draft implementing decision excludes several sectors, owing to the fact that the APPI excludes from its material scope several categories of business and processing activities; calls on the Commission to provide further and detailed clarifications on the impact of such exclusions on EU personal data transferred to Japan, and to clearly specify in Article 1 of the draft implementing decision which transfers of EU personal data are covered by the adequacy decision, indicating that for transfers of personal data by manual processing, the processing operations concerned would have to be covered where they are subject to further electronic processing in Japan;
Amendment 28 #
Paragraph 10
Amendment 33 #
Paragraph 11
Amendment 37 #
Paragraph 13
13. Considers that as the additional protections of the Supplementary Rules cover only transfers under adequacy decisions, personal data excluded from the scope of the draft implementing decision and transferred from the EU pursuant to any other GDPR basis (i.e. Articles 46 to 49) would not benefit from those protections; believesregrets that this would create a different level of protection for EU citizens, thus undermining th where otheir mechanisms that can be used to transfer personal data; recalls that in view of the scope of the adequacy decision, some data transfers will be conducted under these other available mechanismpersonal data is transferred to data controllers outside the scope of the APPI and the draft implementing decision; calls on the European Data Protection Board to closely monitor the situation with regard to such transfers;
Amendment 39 #
Paragraph 14
14. Acknowledges that the additional protections stipulated in the Supplementary Rules are limited to personal data transferred from Europe and therefore do not seem applicableautomatically apply to Japanese personal data or to personal data transferred from other third countries, hence possibly creating practical problems for business operators who have to simultaneously process Japanese and European personal data, forcing them to create dual databases and procedures; invites the Commission to assess whether this dual degree of protection for Japanese and third-country data subjects is in line with the GDPR requirements and the ‘essential equivalence’ standard set by the Court of Justice and to assess if this situation might lead to a loophole whereby operators circumvent the obligations laid down in the Supplementary Rules by transferring data via third countries; calls on the Commission, therefore, to address these issues as soon as possible; welcomes however, that large Japanese business operators have started applying the GDPR in all their operations and for all personal data, including outside of Japan or the European Union; highlights that this illustrates the global effect of the GDPR on the processing of personal data;
Amendment 51 #
Paragraph 18
18. Calls on the Commission to requirprovide further clarifications, includingand if necessary to request further binding supplementary rules, from the Japanese authorities, in order to ensure that all personal data in the meaning of the GDPR are protected when transferred to Japan;
Amendment 57 #
Paragraph 22
Amendment 61 #
Paragraph 23
23. Regrets that, as regards effective enforcement of the APPI, the level of possible fines that would be imposed by the penal authorities is insufficient to ensure effective compliance with the Act, as it does not seem to be proportionate, effective or dissuasive in relation to the gravity of the infringement; calls on the Commission to ensure that the level of fines should be aligned withnotes, however, that the APPI also provides for criminal sanctions including imprisonment; calls on the Commission to provide information on the actual use of administrative fines and criminal sanctions in the GDPRpast;
Amendment 65 #
Paragraph 24
24. Regrets that there is no independent authority overseeing the data processing activities of the law enforcement sector; points out that the PPC has no competence over this; notes that the Information Disclosure and Personal Information Protection Review Board has some competences in this field, including reviewing access requests and publishing opinions, but points out that these powers are not legally binding; notes that the Prefectural Public Safety Commission also exercises oversight, but points out that this Commission is not an independent data protection authority; notes the redress structure administered by the PPC as described in Annex II of the draft implementing decision; questions the legally binding quality of the redress structure, as it is based on Article 80 of the APPI which merely requires Japanese authorities to cooperate with the PPC;
Amendment 75 #
Paragraph 31
31. Instruct its President to forward this resolution to the Council, the Commission, the governments and parliaments of the Member States, the European Data Protection Board, the European Data Protection Supervisor, the Committee established pursuant to Article 93(1) of the GDPR and, the Council of Europe, and the government of Japan.