JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
Mori Hamada & Matsumoto 16th Floor, Marunouchi Park Building 2-6-1 Marunouchi Chiyoda-ku Tokyo 100-8222 Japan
Tel: +81 3 6212 8330 Fax: +81 3 6212 8230
Email: info@morihamada.com Web: www.morihamada.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Japan’s principal data protection legislation is the Act on the Protection of Personal Information (APPI). It provides the basic principles for the government’s regulatory policies and authority, as well as the obli - gations of private business operators that handle per - sonal information (handling operators). Before April 2022, national administrative bodies were regulated by the Act on the Protection of Personal Information Held by Administrative Organs and the Act on the Protection of Personal Information Held by Independent Administrative Agencies, etc. How - ever, thereafter, the obligations prescribed in these two laws were integrated into the APPI. In addition, local government bodies are regulated under their own local regulations ( jourei ), but these vary between bodies. In April 2023, the APPI intro - duced nationwide principles for jourei and related implementation guidelines to homogenise the admin - istration of national data protection regulations. Under this set of amendments, standard rules regarding per - sonal information handled by local governments are uniformly stipulated in the APPI, while jourei can only stipulate local rules in very limited situations allowed under the law. Where a personal information handling business oper - ator located outside Japan handles personal informa - tion outside Japan relating to individuals located in
Japan in connection with the provision of goods or services to those persons, such handling is subject to the extraterritorial application of the APPI (Article 171). For example, where a personal information handling business operator located outside Japan processes personal data outside Japan relating to users located in Japan pursuant to an outsourcing arrangement with a local business operator for the development and operation of an application intended for users in Japan, such processing by the foreign operator is considered to be in connection with the provision of goods or services to persons located in Japan and therefore falls within the scope of the extraterritorial application of the APPI. In addition, as a general rule, personal information handling business operators located in Japan that provide personal data to personal information han - dling business operators located outside Japan are required to obtain the prior consent of the data sub - jects to the effect that the provision of personal data to third parties located outside Japan is permitted (Article 28.1). Handling operators not limited to critical infrastruc - ture must take necessary and appropriate action for security control over the personal data they handle, including preventing the leakage, loss or damage of or to personal data (Article 23). Another important law is the Act on the Use of Num - bers to Identify a Specific Individual in Administrative Procedures (the “My Number Act”), which stipulates
239 CHAMBERS.COM
Powered by FlippingBook