JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
• where actual or suspected leakage involves per - sonal data relating to more than 1,000 data sub - jects. The matters that must be reported to the PPC are as follows: (i) overview of the incident, including the date of occurrence, date of discovery, description of the incident, person who discovered it, the applica - ble reporting category, the existence of an out - sourcing relationship (including the identity of the principal and contractor, if any), and the course of events; (ii) items, media and types of personal data involved in the actual or suspected leakage; (iii) number of data subjects whose personal data was involved; (iv) cause of the leakage and the responsible party; (v) existence and details of secondary damage, or the risk thereof; (vi) status of responses to the data subjects; (vii) status of public disclosure of the fact of the leakage; (viii) measures taken to prevent recurrence; and (ix) any other relevant information. Business operators handling personal information are required to submit a preliminary report within three to five days after becoming aware of the above mat - ters, and to file a final report within 30 days. However, in cases where actual or suspected leakage results from an act directed at the business operator that is suspected to have been carried out for an unlawful purpose, the final report must be submitted within 60 days. If it is difficult for the business operator to report all of the required items in the final report, it is allowed to report only identified items at that point and to sup - plement the remaining items as they are identified. Business operators handling personal information must notify the data subjects of data breaches upon becoming aware of them with respect to items (i), (ii), (iv), (v) and (ix) above (Article 26.2 of the APPI). According to the guidelines issued by the PPC, where a data breach has occurred, it is desirable to promptly
disclose information concerning the facts of the inci - dent and the measures taken to prevent recurrence. 1.7 Regulators The PPC is tasked with enforcing and implementing the APPI, and has the following powers: • to require handling operators to report or submit materials regarding their handling of personal infor - mation; and to enter handling operators’ offices or other locations to investigate, make enquiries and view records or other documents (Article 146); • to provide guidance or advice to handling opera - tors (Article 147); • to recommend that handling operators cease any violations of the APPI and take other necessary measures to correct the violations (Article 148.1); • to order handling operators to take necessary measures to implement the PPC’s recommenda - tions mentioned above and rectify certain violations of the APPI (Articles 148.2 and 148.3); and • to publicly announce any handling operators’ violations of orders issued by the PPC pursuant to Articles 148.2 and 148.3 (Article 148.4). The PPC initiates investigations based on informa - tion obtained not only from reports submitted by busi - ness operators but also through requests for reports and on-site inspections. The PPC makes available on its website detailed guidelines concerning the APPI, which are commonly relied upon in interpreting the law, including the obligations imposed on business operators. For some sectors, other government authorities also enforce the APPI – for example, the FSA is the relevant authority for banks, whereas MIC is the appropriate authority for TSPs. There are no regulators specifically overseeing AI data. The PPC does not have the authority to conduct criminal investigations, and the APPI explicitly stipu - lates that the commission’s power to conduct on-site inspections does not include criminal investigations (Article 146.3).
247 CHAMBERS.COM
Powered by FlippingBook