JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
(a) obligations will be imposed to publish certain matters relating to its handling; (b) the requirements for requests for suspension of use will be relaxed; and (c) provision to third parties based on the opt-out scheme will be prohibited. • For businesses entrusted with data processing and similar services, the obligations concerning the appropriate handling of entrusted personal data will be reviewed. • In the event of a data breach or similar incident, where there is little risk of harm to the rights or interests of the data subject, the obligation to notify the data subject will be relaxed. Prevention of improper use and other misconduct • With respect to information that does not consti - tute personal information but enables targeted approaches to specific individuals, improper use and unlawful acquisition of such information will be prohibited. • For systems that permit provision of personal data to third parties without consent subject to certain conditions (opt-out schemes), obligations will be imposed to verify the identity of the recipient and the purpose of use. Measures to ensure the effectiveness of regulatory compliance • The requirements for issuing orders will be reviewed to enable more prompt correction of violations. In addition, recommendations or orders may be issued requiring measures necessary to protect the rights or interests of data subjects, such as notification to or public disclosure for affected individuals regarding the facts of the viola - tion. • A statutory basis will be established for requesting third parties who assist or facilitate violations to take necessary measures to cease such violations. • With respect to penalties for the unlawful provision of personal information databases, acts of provi - sion carried out for the purpose of causing harm will also be subject to punishment, and statutory penalties will be increased. In addition, penalties will be introduced for acts of unlawfully acquir - ing personal information through fraud or similar means.
• In order to effectively deter egregious violations involving the handling of large volumes of personal information driven by economic incentives, admin - istrative fines will be introduced whereby, in cases of serious violations that infringe upon the rights or interests of individuals, payment of surcharges equivalent to the economic benefits obtained through the violation may be ordered. 1.2 Rights and Obligations Handling Operator Duties The obligations of handling operators under the APPI are as follows. • They must specify and make known to data subjects the purpose of collecting their personal information (Articles 17 and 21). • When a handling operator changes the purpose of use beyond what can be reasonably recognised as having relevance to the original purpose of use, the data subjects’ consent is required (Articles 17.2 and 18.1). Exceptions to this consent requirement include instances when the use of information is required by law or is necessary to perform govern - mental duties, to protect the life, body or property of a person, or to improve public health (Article 18.3). Handling operators must not utilise personal information in a way that possibly foments or prompts unlawful or unfair acts (Article 19). • When a handling operator obtains personal information of a person directly from documents (including electronic records) provided by that person, it must explicitly inform that person of the purpose of use in advance (Article 21.2). • They must establish appropriate safeguards to protect personal data (Article 23). • They must report data breach incidents to the PPC and notify affected data subjects in cases where their rights or interests are likely to be infringed (Article 26). • They may not transfer personal data to another entity without the opt-in consent of the data sub - jects, unless they meet the requirements of any of the exceptions provided by the APPI (Article 27.1). These exceptions include instances where a transfer is required by law or is necessary to perform governmental duties to protect the life, body or property of a person or to improve public
241 CHAMBERS.COM
Powered by FlippingBook