JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
sued for damages in tort. The case arose from a per - sonal data breach caused by a former employee of a subcontractor responsible for the development and operation of the company’s systems, who unlawfully removed a large volume of personal information relat - ing to the company’s customers from its database. The Court held that even if there had been no alle - gation or proof that the plaintiffs had been harmed beyond mere discomfort or anxiety – such as being subjected to nuisance conduct or financial loss – as a result of the data breach, it was nevertheless neces - sary, in so far as the leakage resulted in an infringe - ment of privacy, to examine whether the plaintiffs had suffered mental distress from the invasion of privacy itself, as well as the existence and extent of such dis - tress. 2.3 Collective Redress Mechanisms The Act on Special Measures Concerning Civil Court Proceedings for the Collective Redress for Property Damage Incurred by Consumers allows for class actions to be filed by consumers. Please note that claims allowed under the law are limited to property damage and emotional distress within the scope of the class action itself if the distress is caused along with property damage or by intentional conduct. As a practical matter, multiple data subjects may select the same lawyer to represent them, and that lawyer can file a single lawsuit on their behalf, which is similar to a class action. There is no difference in the standards for court acceptance or the duration of proceedings compared with ordinary cases of a similar scale. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Internet of Things (IoT) Services Legal problems regarding the IoT and ubiquitous sen - sors have been the subject of intense discussion of late, but no specific laws or regulations are currently targeting either issue. However, MIC has published guidelines regarding comprehensive measures for IoT security (July 2016).
The Information-technology Promotion Agency intro - duced a security requirement compliance evaluation and labelling system for security features of IoT prod - ucts (JC-STAR) in March 2025. Big Data As for big data analytics, data sharing will typically happen between companies subject to contracts between those companies. METI has published guidelines on contracts regarding sharing (big) data between companies. Big data may contain special care-required personal information, such as medi - cal histories. Regarding regulation of special care- required personal information, see 1.3 Special Cat- egories of Personal Data . Personal data that has been processed so as to ren - der specific individuals unidentifiable does not con - stitute personal information under the APPI and may therefore be provided to third parties subject to certain conditions without consent. 3.2 Interaction of Data Regulation and Data Protection See 3.1 Objectives and Scope of Data Regulation . 3.3 Rights and Obligations Under Applicable Data Regulation See 3.1 Objectives and Scope of Data Regulation . 3.4 Regulators and Enforcement See 1.7 Regulators and 1.9 Enforcement Trends .
4. Sectoral Topics 4.1 Use of Cookies
The use of cookies, web beacons and other tracking technology is not directly regulated under the APPI. Information collected by cookies or web beacons is not automatically deemed to be personal information, but it will be if the handling operator can easily col - late information collected by cookies or web beacons with the names of individuals (for example, when an internet-based company can identify the cookie IDs of customers when logged in to its website).
249 CHAMBERS.COM
Powered by FlippingBook