JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
health or is necessary for academic or research purposes (Article 27.1 (i)–(vii)). Other major excep - tions include cases of entrustment of the handling of personal data to another entity, joint use of personal data with another entity, business succes - sion resulting from a merger or other legal reasons (Article 27.5), or the filing of a notification of opt-out consent with the PPC (Article 27.2). • They may not transfer personal data to countries that do not have sufficient data protection safe - guards without the data subjects’ consent (Article 28). • They must keep records of the provision of per - sonal data to third parties (Article 29). • Upon receiving personal data from other handling operators, they must confirm the providing han - dling operator’s compliance with applicable regula - tions regarding the provision of personal data and keep a record of the confirmation process (Article 30). • They must handle pseudonymously and anony - mously processed information in certain ways (Articles 41 to 46). Entrustment Under Article 27.5 (i) of the APPI, if a handling operator entrusts all or part of the handling of personal data it acquires to an individual or another entity, that individ - ual or entity will not be considered a third party under Article 27.1. For example, if a handling operator uses third-party vendors of handling operator services and shares personal data with those vendors for them to use on the handling operator’s behalf and not for their own use, that transfer will be deemed an “entrust - ment” and is not subject to data transfer restrictions. When a handling operator “entrusts” personal data, it must exercise appropriate supervision as necessary over the entrusted person to ensure security control over the entrusted personal data (Article 25). Joint Use Handling operators may share and jointly use personal data with specific individuals or entities as long as the handling operator notifies the data subjects or makes the following information accessible to them (Article 27.5 (iii)) before any information sharing or joint use:
• the fact that personal data will be used jointly with specific individuals or entities; • the personal data to be used jointly; • who the joint users are; • the purpose of the joint use; and • the name of the individual or entity responsible for managing the personal data (the address of the responsible individual or entity and, if it is a corpo - rate body, the name of its representative are also required). After this information is published or the data subjects are notified of the same, the identified joint users will not be deemed third parties within the context of Arti - cle 27 and, therefore, the handling operator and the identified joint users may share and jointly use specific items of personal data as if they were a single entity. Business Succession Handling operators may transfer personal data to third parties without the opt-in consent of data subjects if the transfer accompanies a business succession caused by a merger or for other legal reason (Article 27.5 (ii)). Filing of Notification of Opt-Out Consent Under Article 27.2 of the APPI, handling operators may provide personal data (excluding special-care- required personal information and personal data acquired by improper means or provided by another handling operator pursuant to the opt-out mechanism) to third parties without the opt-in consent of data sub - jects if the following conditions are met: • they agree to stop providing personal data to the third party upon the data subjects’ demand; • they notify the data subjects in advance of cer - tain events outlined in Article 27.2 or make such notification of events readily accessible to the data subjects; and • they submit a notification of certain matters to the PPC. Please note that, in practice, the PPC does not readily accept the foregoing opt-out notification unless it is not practical to seek the data subjects’ consent and it is difficult to use the other exceptions.
242 CHAMBERS.COM
Powered by FlippingBook