JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
Data Protection Officers The APPI has no provision mandating the appoint - ment of privacy or data protection officers; however, handling operators must take necessary and proper measures to prevent the leakage, loss or damage of or to personal data and to implement other security controls. Under the PPC Guidelines, those measures should include the following: • organisational security measures, such as estab - lishing rules for handling personal data and clarify - ing who is responsible for supervising such han - dling; • HR security measures, including educating/training employees; • physical security measures, including controlling the areas where personal data is handled, such as servers and offices; • technical security measures, including controlling access to personal data; and • understanding of the external environment – this security measure, introduced in the amendments to the guidelines, requires handling operators that process personal data in foreign countries to understand the foreign country’s legal system for personal information protection and, taking that legal system into consideration, to take necessary and appropriate measures to ensure the security of personal data. Effective since April 2024, the PPC Guidelines also require handling operators to take security control over personal information that is collected and expected to be treated as personal data to prevent cyber-attackers from intercepting it on the operators’ behalf. The PPC Guidelines indicate the appointment of a person to be in charge of the handling of personal data as an example of a proper and necessary measure. However, although handling operators are expected to adopt the measures described in the PPC Guidelines, any failure to adopt such measures is not a direct breach of the APPI. Under the TBA, large TSPs are required to appoint a chief manager responsible for handling user informa - tion.
Privacy By Design/Default and Privacy Impact Analyses (PIAs) The APPI does not mandate obligations regarding PIAs. However, the PPC has issued a report titled “Promoting the implementation of PIAs – Significance of PIAs and points to keep in mind in the implementa - tion process”, which business operators are encour - aged to follow voluntarily. The APPI does not refer to the concepts of privacy by design or default, but PPC guidelines on accredited personal information protec - tion organisations recommend that these organisa - tions promote privacy by design. Internal or External Privacy Policy The PPC Guidelines recommend releasing a privacy policy or statement. Article 32.1 of the APPI requires handling operators to make the following information regarding retained personal data available to data subjects: • the name of the handling operator, an address for the individual or entity responsible and, if it is a corporate body, the name of its representative; • the purposes of use of retained personal data; • the procedures for responding to requests from data subjects to disclose, correct, suspend the use of or erase retained personal data; • contact information for accepting complaints regarding the processing of retained personal data; and • security measures being implemented by the han - dling operator. Most handling operators typically comply by using internal and external privacy policies. The PPC Guidelines also recommend stating the fol - lowing in a handling operator’s basic policies as part of the implementation of security control measures regarding personal data: • the name of the handling operator; • compliance with relevant laws, regulations and guidelines; • an explanation of security control measures regard - ing personal data; and • contact details for complaints and questions.
243 CHAMBERS.COM
Powered by FlippingBook