JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
1.5 Processing of Personal Data in the Context of Artificial Intelligence Legal problems concerning AI have been the subject of intense discussion of late, including matters such as liability for the actions of AI and ownership of rights regarding AI-created content. On 1 September 2025, the AI Act took effect, which addresses risks associated with AI while promoting innovation. It provides for the establishment of an AI Strategy Headquarters, headed by the Prime Minis - ter and composed of other ministers, and sets forth the basic policies for measures to be implemented by the government to promote research, development and utilisation of AI. The law also defines fundamen - tal measures relating to AI. The AI Act expresses the government’s overall stance on AI-related matters and does not contain specific compliance obligations, requirements or penalty provisions. The PPC published an announcement in June 2023 stating its interpretation of the APPI in the context of generative AI and requesting generative AI service providers and users to comply with the law. MIC and the Ministry of Economy, Trade and Industry (METI) published their AI Business Guidelines for AI develop - ers, service providers and users in April 2024. These guidelines include cautions and points to note regard - ing privacy and data protection. The Institute for Information and Communications Pol - icy (IICP) and MIC have jointly published the Draft AI R&D Guidelines for International Discussions, which explain the R&D and nine other principles for research into and development of AI. These are tentative guide - lines for further international discussion. MIC also published the Guidelines for AI Utilisation in August 2019, which summarise the issues that users (includ - ing service providers) are expected to pay attention to in their utilisation phase of AI in the form of “princi - ples” and provide explanations based on the principle of a human-centred AI society. Some other AI-related associations have also published similar principles or guidelines for research into and development of arti - ficial intelligence. There are no regulations specific to AI data, but please note that general regulations are applicable.
For example, if AI data includes personal information, the APPI applies to the processing of that data. 1.6 Data Breach Requirement According to the guidelines issued by the PPC, where a business operator handling personal informa - tion becomes aware of an actual or suspected data breach, it is required to take necessary measures with respect to the following matters, depending on the nature and circumstances of the incident. • Internal reporting and prevention of further damage – The business operator must promptly report the incident to a person in a position of responsibility within the organisation and take necessary meas - ures to prevent the damage caused by the leakage from spreading beyond what existed when the incident was discovered. • Investigation of the facts and identification of the cause – The business operator must take neces - sary measures to investigate the facts surrounding the leakage and to identify its cause. • Identification of the scope of impact – The business operator must take necessary measures to identify the scope of impact of the leakage. • Consideration and implementation of measures to prevent recurrence – The business operator must take necessary measures to consider and imple - ment measures to prevent recurrence of the leak - age. Further, business operators handling personal infor - mation must report to the PPC when they become aware of a data breach in any of the following circum - stances (Article 26.1): • where actual or suspected leakage involves per - sonal data containing sensitive personal informa - tion (see 1.3 Special Categories of Personal Data ); • where actual or suspected leakage involves per - sonal data that is likely to result in financial harm if improperly used; • where actual or suspected leakage results from an act directed at the business operator that is suspected to have been carried out for an unlawful purpose; or
246 CHAMBERS.COM
Powered by FlippingBook