Act on the Protection of Personal Information (Japan)

Act on the Protection of Personal Information (Japan)
Name	Act on the Protection of Personal Information
Enacted by	National Diet
Enacted	2003
Amended	2015, 2017, 2020, 2022
Status	In force

Act on the Protection of Personal Information (Japan)

The Act on the Protection of Personal Information is Japan's principal statute regulating handling of personal data within Japan and by entities engaging with Japanese residents. The law establishes obligations for business corporations, public institutions, financial institutions, and telecommunication providers while interfacing with international frameworks such as the European Union–Japan Economic Partnership Agreement, the Asia-Pacific Economic Cooperation, and bilateral arrangements with the United States. It interacts with regulatory actors including the Personal Information Protection Commission (Japan), Ministry of Economy, Trade and Industry, Financial Services Agency (Japan), and judicial organs such as the Supreme Court of Japan.

Background and Purpose

The Act was enacted in response to technological change, high-profile incidents involving credit card fraud, data breaches, and the proliferation of internet service providers and mobile phone platforms in the late 1990s and early 2000s. It aims to protect the rights and interests of data subjects and to promote appropriate handling by controllers in sectors including banking, healthcare, insurance, retail, and advertising. The Act complements international instruments like the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and dialogues with regulators such as the European Data Protection Board and the Office of the Privacy Commissioner of Canada.

Scope and Definitions

The Act defines "personal information" as data related to a living individual that can identify the person, and distinguishes "personal data", "sensitive personal information", and "anonymously processed information". Definitions reference actors such as "personal information handling business operators" which include Sony, Toyota, Rakuten, and SoftBank when they process consumer records. Exemptions and special regimes cover entities under laws like the Act on Access to Information Held by Administrative Organs and sectors regulated by the Act on the Protection of Personal Information Held by Administrative Organs and the Medical Care Act.

Key Provisions and Principles

Core provisions require lawful and fair acquisition, use-limitation, purpose specification, accuracy, and security management measures. Controllers must implement safeguards akin to those promoted by ISO/IEC 27001 and report breaches to the Personal Information Protection Commission (Japan). The Act sets rules for outsourcing to processors such as Accenture, NEC Corporation, and Fujitsu, and prescribes consent requirements influenced by jurisprudence from the Tokyo District Court and opinions from the Japan Federation of Bar Associations. It also addresses profiling, direct marketing by entities like LINE Corporation and Yahoo! Japan, and the handling of identifiers such as national identifiers from the My Number system.

Data Subject Rights and Obligations

Data subjects have rights including access, correction, suspension of use, and deletion against controllers like MUFG Bank, Mitsubishi UFJ Financial Group, and Japan Post. The Act provides mechanisms for complaints to the Personal Information Protection Commission (Japan) and administrative remedies that can involve review by the Intellectual Property High Court or litigation before district courts. Obligations for businesses include notification, disclosure of purpose, and respect for third-party rights as reflected in decisions involving Google Japan, Facebook, and Amazon Japan.

Enforcement, Supervision, and Penalties

The Personal Information Protection Commission serves as the primary supervisory authority, empowered to issue guidance, orders to improve, and public announcements concerning entities like LINE Corporation and Canon. Administrative fines, injunctions, and public naming are enforcement tools; criminal penalties apply in serious cases involving falsification or unauthorized disclosure, enforceable via prosecutors from the Public Prosecutors Office (Japan)]. Coordination occurs with sectoral regulators including the Ministry of Health, Labour and Welfare, Ministry of Internal Affairs and Communications, and the Bank of Japan for financial stability and consumer protection.

Amendments and Recent Reforms

Major amendments in 2015, 2017, 2020, and 2022 responded to developments such as cross-border data flows, cloud services from Amazon Web Services, Microsoft Azure, and Google Cloud Platform, and privacy concerns raised by platforms like TikTok and Twitter. Reforms introduced stricter rules for anonymization, data portability reminiscent of the General Data Protection Regulation, and enhanced breach notification obligations after incidents involving JTB Corporation and Line Pay. Legislative debates involved members from political parties including the Liberal Democratic Party (Japan), Constitutional Democratic Party of Japan, and Komeito.

International Transfers and Cross-border Data Issues

The Act regulates transfers to foreign recipients and incorporates safeguards similar to adequacy mechanisms in European Union law and binding corporate rules used by multinationals like Sony Group Corporation and Toyota Motor Corporation. Cross-border cooperation occurs with counterparts such as the European Commission, the United States Department of Commerce, and the Australian Information Commissioner to resolve transnational disputes and data localization questions raised by cloud providers and multinational banks. The law balances international trade commitments under the World Trade Organization and regional agreements including the Comprehensive and Progressive Agreement for Trans-Pacific Partnership.

Category:Japanese law