JAPAN Trends and Developments Contributed by: Norihiro Sekiguchi, Daisuke Mure, Yuki Kuroda and Ryosuke Sogo, Oh-Ebashi LPC & Partners
Violation of these conditions may lead to administra - tive monetary penalties (see Section 4). Other relaxations of consent requirements Processing that clearly does not conflict with a data subject’s wishes will be permitted without consent – for example, sharing a customer’s booking data with the hotel at which the customer has reserved a room, or sharing remitter data between banks to process an overseas transfer. Rules to appropriately address risks The following rules apply. • Children ’ s data – Consent requests and notices must be directed to the legal representatives of children under 16. Such children (or their repre - sentatives) will have a right to request cessation of use or deletion without having to demonstrate a legal violation, and businesses must prioritise minors’ best interests when handling their personal data. • Biometric data – Biometric data can be collected without individuals’ knowledge and used to track behaviour indefinitely, so specific obligations apply. Businesses must publicly disclose key processing details (business name, purpose and opt-out pro - cedures), individuals will have an enhanced right to request cessation of processing, and it will be prohibited to transfer biometric data to third parties under the opt-out regime. • Outsourced processing – Processors will be explic - itly prohibited from using entrusted data beyond the scope of the delegated work. Where a proces - sor acts solely on the controller’s instructions and appropriate monitoring agreements are in place, it may be exempted from most obligations under Chapter 4 of the APPI. • Breach notification – Individual notification fol - lowing a breach may be replaced by alternative measures where there is little risk to data subjects’ rights and interests (for example, where only inter - nal system identifiers that are meaningless to third
nonetheless enables contact with a specific individual – such as email addresses, telephone numbers and Cookie IDs. Even where no specific individual can be identified from such information alone, its misuse can facilitate phishing attacks, investment fraud and other serious harms. Improper use and unlawful acquisi - tion of such information will be prohibited in the same
manner as for personal information. Rules to ensure effective compliance The following rules apply.
• Enhanced orders – Emergency orders may now be issued where harm is imminent, without waiting until harm has occurred or first issuing a recom - mendation. Orders may also require businesses to notify or publicly disclose to affected individuals the existence of a violation. • Administrative monetary penalty ( surcharge / kachoukin ) – A surcharge equal to financial gains from the violation will apply where: specific provi - sions are violated with insufficient preventative care; individual rights are infringed or at imminent risk; and at least 1,000 data subjects are affected. This is designed to remove the economic incentive for large-scale violations that existing tools have not fully deterred. • Criminal penalties – Maximum imprisonment for unlawful database provision will increase from two to three years; other data offences from one to two years, with corresponding fine increases. A new offence will cover obtaining personal data through fraud, unauthorised access or other conduct undermining the data controller’s management. Takeaway The bill balances relaxing consent requirements to facilitate AI and data-driven business with signifi - cantly stronger enforcement tools. Subject to Diet deliberations, it is expected to come into force within two years of promulgation. Businesses processing personal data in Japan should assess the impact on their AI/data analytics operations, handling of chil - dren’s data, processing of biometric data, and vendor management arrangements.
parties have been leaked). Prevention of improper use
The bill extends certain APPI protections to informa - tion that does not qualify as “personal information” but
534 CHAMBERS.COM
Powered by FlippingBook