JAPAN Law and Practice Contributed by: Junichi Ueda, Etsuko Hara, Nobuto Shirane, Takahiro Hayase, Yutaka Shimoo and Miki Goto, Anderson Mori & Tomotsune
Limitation on Transfer of Personal Data to Third Parties In principle, an information handler must not transfer personal data to third parties, including its affiliated companies, without the prior consent of the data sub - ject (Article 27 of the APPI). An information handler must also obtain the prior consent of the relevant data subject before providing their personal data to a third party in a foreign country and provide certain informa - tion to the relevant data subjects when obtaining their consent (Article 28 of the APPI). An information handler must keep records regarding the transfer and receipt of personal data (Articles 29 An information handler must take reasonable steps to keep personal data as accurate and up to date as is necessary to achieve the purposes of use and must endeavour to delete the personal data without delay when it becomes unnecessary to use the data (Article 22 of the APPI). An information handler must also take all necessary and proper measures to ensure that personal data is kept secure from loss and from unauthorised access, use and disclosure (Article 23 of the APPI). In addition, an information handler must exercise nec - essary and appropriate supervision of its employees who handle personal data and of its data manage - ment outsourcing entities to ensure they implement and comply with security measures (Articles 24 and 25 of the APPI). and 30 of the APPI). Security Measures Data incidents, such as leakages of, loss of or damage to personal data, must be reported to the Personal Infor - mation Protection Commission (PPC) and the relevant data subject must be notified thereof when the incident reaches a certain threshold (Article 26 of the APPI). Data Subject’s Right Upon the request of a data subject, an information handler must inform them about the purposes their personal data was used for, grant access to it, cor - rect or delete it, or take other appropriate measures (Articles 32 to 39 of the APPI).
lawsuit, a confidentiality protective order or a suspen - sion of disclosure (including omitting an examination of the parties) may be issued. A trade secret infringe - ment with a high degree of illegality is also subject to criminal penalties. New plant varieties are protected by the Plant Variety Protection and Seed Act. The circuit layout of semiconductor integrated circuits is protected by the Act on the Circuit Layout of Semi - conductor Integrated Circuits. The Act on the Protection of Personal Information (APPI) is the main piece of legislation governing the handling of personal information by business opera - tors (information handlers) in Japan. Examples of APPI regulations with which information handlers are required to comply are as follows. Purposes of Use An information handler must specify the purposes for which it will process personal information and must not process personal information beyond the scope of the specified purpose without first obtaining the consent of the relevant data subject (Articles 17 and 18 of the APPI). An information handler must not process personal information in manners that could facilitate or lead to illegal or improper activities (Article 19 of the APPI). Collection of Personal Information An information handler must not collect personal infor - mation using fraudulent or other unjust means. In prin - ciple, an information handler must not acquire certain sensitive personal information without obtaining the data subject’s prior consent (Article 20 of the APPI). If personal information is collected, an information handler must promptly notify the relevant data subject of or announce the relevant purposes of use (Article 21 of the APPI). 8. Data Protection 8.1 Applicable Regulations
526 CHAMBERS.COM
Powered by FlippingBook