JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
special rules for what is known in Japan as the Num - ber to Identify a Specific Individual in Administrative Procedures (“My Number”), a 12-digit individual num - ber assigned to each resident of Japan. In June 2023, the Telecommunications Business Act (TBA) introduced a regulation about sending cookies to external parties. It also imposed new obligations regarding user information on large telecommunica - tions service providers (TSPs) that have either 5 million paid users or 10 million free users. Furthermore, the Personal Information Protection Commission (PPC – the regulator primarily respon - sible for the APPI and the My Number Act) has pub - lished guidelines for handling personal information (the “PPC Guidelines”). For some industrial sectors, the ministries with jurisdiction over them have pub - lished data protection guidelines for those sectors. For example, the Financial Services Agency (FSA) and the PPC have jointly published data protection guidelines for the financial sector, and the Ministry of Internal Affairs and Communications (MIC) has issued data protection guidelines for telecommunications business operators. The APPI follows the Organisation for Economic Co- operation and Development’s eight Privacy Principles. Japan has reached an agreement with both the EU and the UK to certify each other’s country or territory as an “adequate” country for Japan’s and the EU/UK’s data protection purposes; this decision was renewed in March and April 2023. However, this does not mean that the APPI is identical to Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR). Japanese data protection law is, nonetheless, closer to the EU omnibus model than the US sectoral/sub - national approach in the sense that Japan has a com - prehensive data protection law: the APPI. Draft Policy Outlining Reforms On 9 January 2026, a draft policy outlining institutional reforms was released. The draft identifies four over - arching themes:
• prevention of improper use and other misconduct; and • measures to ensure the effectiveness of regulatory compliance. The specific policy proposals under each theme are as follows. Promotion of appropriate data utilisation • With respect to the provision of personal data to third parties and the acquisition of publicly avail - able sensitive personal information, consent of the data subject will not be required where such data is used solely for the creation of statistical informa - tion or similar purposes. • Regarding regulations on use beyond the specified purpose, acquisition of sensitive personal informa - tion, and provision to third parties: (a) consent of the data subject will not be required where, in light of the circumstances of acquisi - tion, it is clear that the handling does not run counter to the data subject’s intent and does not harm the rights or interests of the data subject; (b) the requirement that obtaining consent be dif - ficult will be relaxed for cases where personal data is handled for the protection of life, body or property, or for the improvement of public health; and (c) it will be expressly clarified that institutions or organisations whose purpose is the provision of medical care are included within the scope of “academic research institutions” eligible for the academic research exception. Regulation appropriately tailored to risk • Where the data subject is under 16 years of age, it will be explicitly stipulated that consent acquisi - tion, notifications and similar procedures shall be directed to the legal guardian of the data sub - ject. In addition, the requirements for requests to suspend the use of retained personal data relating to such minors will be relaxed, and a duty provi - sion will be introduced requiring that the handling of minors’ personal information give priority to the best interests of the minor. • With respect to facial feature data and similar infor - mation:
• promotion of appropriate data utilisation; • regulation appropriately tailored to risk;
240 CHAMBERS.COM
Powered by FlippingBook