JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
It is important to note that the APPI imposes no administrative fines. Criminal sanctions may only be imposed if a handling operator: • refuses to co-operate with or makes any false report in response to an investigation by the PPC (Article 178); • provides a personal information database to unauthorised persons or misuses the database for unlawful gains (Article 180); or • violates any order given by the PPC as part of an administrative sanction (Article 181). The PPC empowers private organisations called accredited personal information protection organisa - tions ( nintei kojin jouhou hogo dantai ) to handle and promote the protection of the personal information held by handling operators. These accredited organi - sations process complaints against handling opera - tors or provide information on them to ensure the reli - ability of the businesses of those handling operators, and promote the protection of personal information. They also establish their own rules, with which their members must comply. 1.8 Enforcement Proceedings and Fines The PPC finds potential violations of the APPI through data breach reports submitted by handling operators, telephone consultations made through their business support desk, and media coverage. Please see 1.7 Regulators for details. The PPC has the power to enforce administrative sanctions, but the APPI does not provide for admin - istrative fines; please see 1.7 Regulators for details. Introduction of administrative fines is under discus - sion; please refer to 1.1 Overview of Data and Priva- cy-Related Laws for more details. The PPC provides guidance or advice and does not take further action in most cases, although it does take strong action such as issuing orders in serious cases. 1.9 Enforcement Trends In June 2024, it was discovered that insurance agents handling products from multiple non-life insurance companies had, without obtaining the consent of policyholders, provided personal data of insurance policyholders (including names, policy numbers,
premiums, and the names of the insurers with which contracts were concluded) to other non-life insurance companies. In addition, employees seconded from non-life insurance companies to insurance agents were found to have, without authorisation from the host insurance agent and without the consent of the data subjects, transmitted personal data (including names, policy numbers, premiums, insurer names and policy periods) by email or other means to their insurance companies. Following an investigation by the FSA, a business improvement order was issued on 24 March 2025. The PPC also issued administrative guidance on 30 April 2025. The authorities pointed out that the shar - ing of personal information among companies for the purpose of acquiring insurance contracts had become a common practice, and that there was a lack of organisation-wide awareness regarding the proper management of personal information. The case underscores the importance of prioritising legal com - pliance over business convenience or industry cus - toms and maintaining a strong compliance-oriented mindset throughout the organisation. Data subjects may go to court to seek compensation for damages or distress caused by breaches of data protection. There are two major types of legal causes. • First, Japanese courts recognise the right to pri - vacy, which is the right of persons not to have their private lives disclosed except for legitimate rea - sons. Breaching the right to privacy constitutes tort under Article 709 of the Civil Code. • Second, if a business promises to keep personal data confidential in an agreement (such as terms of use) but then compromises the data, the legal cause of breach of contract may also be available. 2.2 Recent Case Law In October 2017, the Supreme Court rendered a deci - sion granting a claim for damages for the infringe - ment of privacy in a case where a company providing correspondence education services for children was 2. Privacy Litigation 2.1 Privacy Litigation Overview
248 CHAMBERS.COM
Powered by FlippingBook