1st International Data Governance Review Meeting

In order to support the implementation of the Institutional Arrangement for Partnership (IAP) launched under the OECD and other initiatives and proposals by the Government of Japan to realize DFFT in Institutional Arrangement for Partnership (IAP), while reflecting information and requests from stakeholders such as Japan and companies related to the cross-border transfer of data, we will hold a review meeting with the aim of conducting discussions, examinations, and recommendations by experts.

Overview

Date and time: Tuesday, January 30, 2024, from 10:00 to 13:00
Location: Digital Agency Government Office and Online Conference (Teams)
Agenda:
1. Opening
  1. Digital Agency Greetings
  2. Greetings from the Chairman
  3. Greetings from Members
  4. Proceedings of the Review Board (Secretariat)
2. Proceedings
  1. Efforts to Date regarding DFFT and the Purpose of the Review Board (Secretariat)
  2. Free discussion
    - Issue to be Addressed in Light of International Trends
    - Domestic Mechanisms Required for Issue Resolution
3. Communication, etc.
4. Free discussion [Optional participation]
5. Digital Agency Greetings
6. Adjournment

Materials

Related Information

Data Free Flow with Trust (DFFT)

Minutes

Date

Tuesday, January 30, 2023, from 10:00 a.m. to 1:00 p.m.

Location

Digital Agency Executive Office and Teams

Attendees

Members (Chairman and below, in alphabetical order)

Chairman Yamamoto, Member Atsumi, Member Namagai, Member Inadani, Member Kawamura, Member Kitamura, Member Kito, Member Kurosaki, Member Sato, Member Sawada, Member Suzuki, Member Fujii, Member Masushima, Member Miyamoto, Member Wakameda

Secretariat

For the public Group, Digital Agency
Ministry of Economy, Trade and Industry, International Affairs Office
Mizuho Research & Technologies Co., Ltd.

Discussion Summary

[Issue 1] Issue to be addressed by Japan in the international community

Issue that Japan should address

Since ensuring the transparency of regulation regarding data cross-border was mentioned as a point to be addressed by the Institutional Arrangement for Partnership (IAP), which was launched as an international mechanism to realize Data Free Flow with Trust (DFFT), even in the Study Group until last fiscal year, it is better to advance efforts without waiting for hearings, etc. with companies. private sector companies have commented that regulation overseas is difficult to understand, and it is important to encourage companies to understand the purpose of law, which is rapidly changing, and to operate while observing it.
- Regarding specific efforts, we would like to focus on the international arena based on discussions at this Study Group. In addition to close cooperation between government agencies, we believe it is necessary to further deepen cooperation with private sector companies and academics in the future to realize the needs of companies. We would like to ask for your cooperation. (Secretariat)
In order to ensure Trust in DFFT, it is important to explore ways to ensure interoperability while taking into account differences in the perception of risks in each country. For this reason, it is an urgent Issue to sort out the relationship between the legal regulation of each country and to realize international harmonization.
For example, in order to put the automated driving system into practical use, it is necessary to quickly collect information on accidents overseas and improve the system. In automated driving, in particular, it is assumed that the systems of private sector and public organizations will work together, so a framework for cross-border cooperation between the public and private sectors will be important.
In order to obtain specific information on the operation of systems in overseas countries' regulation, etc., it is effective not only to read the text of laws and regulations but also to borrow the power of local embassies and local subsidiaries such as international companies. Shouldn't we reconsider how to cost such intelligence?

Issues to be discussed and sorted out

In order to ensure that the free cross-border distribution of data does not affect national security, it is necessary to clarify the data to be protected and the data to be distributed. To this end, it is important to clarify the purpose of data distribution and what you want to realize, and to advance discussions based on this. In addition, it is necessary to respond to concerns about government access, etc. at the destination where the data is distributed.
- Regarding specific discussions such as the distinction between data to be shared and data to be localized, we would like to proceed based on the opinions of domestic and foreign players by effectively using various strategic methods such as international law and bilateral consultations under a certain concept of data governance. (Secretariat)
There should be risks that are commonly assumed as the premise of the data-distribution regulation of overseas countries. By clarifying such risks and confirming how they are reflected in the regulation of each country, data-sharing risks can be comprehensively understood, and it will be easier for domestic companies to understand them.
It is important to consider what value will be created across borders, and it may be easier to discuss by using a use cases that shows this. Since it is difficult to develop overall rules from the beginning, it is considered that discussions can be effectively advanced by discussing small parts of each use cases step by step.
Since the applicable law and assumed risks differ depending on the nature of the information and the industry, it may be easier for companies to understand if discussions are advanced for each specific use cases and topic.
In the course of international standardization, a Issue that is considered to be a common use cases for each country has been collected, so isn't it an idea to use such a use cases as a subject to examine the themes to be dealt with in the IAP?
Even in data legislation such as the EU General Data Protection Regulation (GDPR), data transfer is allowed for the public interest. In this trend, it is necessary to pay attention so that domestic companies are not forced to provide information, which is a source of competitiveness, for the public interest. It is necessary to sort out the concept of the balance of data sharing and compensation based on international trends.

A point to be considered in a discussion

In data distribution, the development of hardware is also essential, and physical aspects such as data centers and communication infrastructure must be taken into account.
It is also important to deepen understanding of technological solutions such as privacy-enhancing technologies (PETs) and utilize them in discussions.
- The IAP emphasizes technological solutions. Technology alone will not solve Issue, but it is important to effectively use technology to lower the cost of protecting regulation. However, in order to utilize technology in various countries, it is necessary to ensure transparency by having regulation authorities of each country participate and share what each technology can do. (Secretariat)

How to proceed with discussions in the IAP

In other countries, restrictions on cross-border distribution are being considered in fields other than personal data. Since there are concerns about the impact on Japanese companies, discussion at the IAP is important in order to prevent fragmentation of rule setting and to achieve international harmonization.
Since the role of the IAP is considered to overlap with the functions of existing international organizations such as the WTO, it is necessary to discuss whether the proliferation of multiple systems is desirable to achieve the purpose.
- Currently, there is no forum dedicated to data governance, and discussions are held in various forums in a fragmented manner. Therefore, there is a lack of opportunities to engage in cross-cutting discussions on data governance. The IAP is a forum to engage in cross-cutting discussions and promote policy coordination on data governance. (Secretariat)
Please tell us the progress of international organizations and efforts that are expected to be coordinated at this point.
- It is assumed that the project will be promoted without bringing the discussion to a stalemate by selectively cooperating with a area and an organization that have the awareness that a common framework of rules on data distribution is necessary for each topic. In addition, we are currently considering a specific area and organization to cooperate, so we would like to report on them in the future. (Secretariat)
If major foreign organizations do not participate, there is a possibility that discussions in the IAP will not be active. It is necessary to pay close attention to the perceptions of other governments and their attitudes toward participation in the IAP.

[Issue 2] Issue that Japan should address domestically

Issue relating to domestic enterprises

It is welcome that a multi-stakeholder forum to discuss the issue of cross-border transfer of data is being formed under the IAP framework. On the other hand, it is expected that various parties will raise their voices through such a framework in the future. It is important for domestic companies to have a sense of crisis that their influence will decline unless they raise their voices loudly, and to raise their voices firmly.
It is difficult to fully understand the problem awareness of a company only by asking the company about the Issue in front of them. It is important to listen to the DFFT after asking the company to fully imagine both the positive aspects such as a new business model made possible by the realization of the DFFT and the negative aspects such as business hurdles and compliance costs in the case that the regulation is not realized and the Issue is fragmented, and to communicate it in international forums such as the IAP forum.
In Japan, while many companies seek information, many companies are not active enough to discuss it at the hearing. Therefore, it is considered effective to provide information through study meetings.
Compared to major foreign companies, which are actively involved in rule-making such as cloud standard formulation under a big strategy, domestic companies tend to be reluctant to be involved in rule-making. This may be partly due to the fact that management has not drawn up a big strategy. In order to encourage Japanese companies to actively participate in rule-making, it is also important to promote the formulation of visions and strategies by companies.
- Compared with the stance of foreign companies, which are willing to approach international conferences and international negotiations such as the G7, Japanese companies are somewhat passive. On the other hand, the government believes that part of the reason is that Japan's digital policy has not shown a clear direction or overall picture. Therefore, we would like to see Digital Agency promote a comprehensive data policy at home and abroad, and create a system in which the government and private sector work together to address data governance issues. (Secretariat)
In order to obtain the cooperation of companies, it is important to present specific incentives for companies. To this end, it is important to establish a route to collect and communicate the opinions of Japanese companies on rulemaking in Europe and other countries.
Since needs and problems differ greatly depending on the type of organization and field, it may be difficult to understand the overall picture even if we conduct interviews with companies. First, we will create a use cases, clarify the benefits brought about by cross-border distribution of data through typical cases, and explore solutions by focusing on the problems of systems in each country. Then, we will be able to clarify the direction of discussion.
In order for the industry to enjoy the benefits of the unification of the global data distribution regulation, it is important to have an entity that takes leadership in data distribution. In particular, in the data field, since the entry of new players due to the transformation of the industrial structure is considered in addition to the existing players, it is expected that an entity with leadership from a wide range of perspectives, including the possibility of government leadership, will appear.

Engaging Civil Society

When there are few opinions from civil society, a mechanism to elicit opinions is necessary. To be specific, it may be necessary to consider a survey method and question items to observe civil society's views on DFFT at a fixed point.
In order to encourage the involvement of civil society, it is necessary to have discussions based on a specific Issue or use cases, not an abstract discussion. Since the Issue differs depending on the type of data and the use case, it is considered that clarifying them will make it easier to have discussions. For example, it may be easier for citizens and consumers to understand by analyzing specific cases, such as whether the distribution of data necessary for improving automobile safety is hindered by a legal regulation or a technical problem.
Since the term "DFFT" is not yet common, it may be necessary to promote understanding by organizing the concept and related terms.
"DFFT" is not a term that refers to a specific mechanism or technology. It is a term that aims to create a common awareness among countries about the significance of realizing cross-border data transfer and discussing a specific Trust mechanism to overcome differences in privacy, security, and so on. To this end, it is important to first identify bottlenecks that hinder data flow and to proceed with the examination of specific solutions while incorporating opinions from private sector, academia, and civil society.

How to proceed with future discussions

It may be necessary to clarify the results of the discussions at the DFFT Study Group and the parts that have not yet been discussed. In particular, it is recognized that there is a lack of discussion on non-personal data.
Although hearings and use cases collection have been conducted, there may be business types and industries for which information has not yet been collected. Therefore, it is necessary to consider the granularity and strategies of segmentation.
It is necessary to think about both the discussion on how to overcome Issue and the specific methodology for discussing it. As a methodology, it is necessary to consider the strategy of hearings, how to create incentives to involve companies, and how to incorporate the voices of citizens.

End