The Amendment of the Act on the Protection of Personal Information (the "Personal Information Protection Act", and, the "Amendment") was enacted on September 3, 2015. The core part of the Amendment will come into force as of the day specified by an applicable Cabinet Order, which in no case shall exceed two years from the date of promulgation, September 9, 2015.
The Amendment includes: (i) clarification on the definition of "Personal Information" and provisions regarding information that requires special consideration (the "sensitive information"); (ii) provisions regarding the processing methods or treatment of anonymized information and the filing and publication of a personal information protection policy; (iii) the tightening of the requirements for the transfer of personal information without the consent of the person concerned (an "opt-out") including the requirements for the filing and publication of an opt-out policy; (iv) provisions on ensuring traceability, (v) the establishment of the Personal Information Protection Committee and the centralization of authority; and (vi) cross-border application of the Personal Information Protection Act and provisions regarding the transfer of personal information outside Japan. Among them, (ii) and (vi) are particularly important.
As big data businesses utilizing personal data have grown and developed, the use of anonymized personal data has increased. However, there has been at least one instance where a company discontinued using anonymized data in response to the concerns of consumers that the information of individual users might be identified within the data. In light of such concerns, the Amendment defines such information as "Anonymously Processed Information" and seeks to allow the utilization of such information while simultaneously protecting consumers by, for instance, prohibiting the comparison of the Anonymously Processed Information with other information to identify individuals (as per (ii) above).
In addition, taking into consideration the increased number of instances where foreign entities provide people in Japan with products or services via the internet, the Amendment has given the Personal Information Protection Act extraterritorial application. Excluding transfers to a third party who is in a country certified by the Personal Information Protection Committee or has taken protection measures that meet the standards established by the Committee, the requirements for the transfer of personal information to a third party outside Japan, including transfers made to entrust the data to another party and transfers made in connection with business succession, have been made stricter by requiring consent from the individual the personal information concerns (as per (vi) above).
The provisions of the Amendment may require private companies to change their personal information handling practices. Once the fine details of the Amendment have been determined through the establishment of the Rules of the Personal Information Protection Committee and the relevant guidelines, each company will need to review its internal rules on handling personal information.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.