JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
5. International Considerations 5.1 Restrictions on International Data Transfers
programmes, and digital loss prevention technologies, but privacy issues may arise regarding private com - munications and other privacy matters at the work - place. Thus, employers are recommended to estab - lish internal rules prohibiting the use of company PCs and email addresses for private use, and to disclose the possibility of monitoring those devices and data, including emails. In principle, there is no special role for labour organi - sations or works councils regarding employment- related data privacy, but there is a general requirement for employers to obtain the opinion of the employee representative in establishing work rules. 4.4 Data Protection in M&A The APPI has some special rules for data process - ing in relation to M&A. Where personal information is provided in connection with a business succession, it is not necessary to obtain the data subject’s con - sent. See”Business Succession”under 1.2 Rights and Obligations . Handling operators are required to specify the pur - pose of use when acquiring personal information (Arti - cle 27 (a)) and to notify the data subject of or publicly announce such purpose (Article 27 (5)(ii)). The opera - tor may use personal information only to the extent necessary to achieve the specified purpose of use. Where the target company and the buyer are integrat - ed through a business succession, the personal infor - mation acquired prior to the integration is considered to have been obtained for different purposes based on the respective pre-integration privacy policies or simi - lar documents of the target company and the buyer. Accordingly, such personal information may not be used, after the integration, for purposes that were not originally contemplated. Nor is it permissible to use personal information previously held for services newly created as a result of the business integration. In such cases, the personal information handling busi - ness operator must either obtain the data subject’s consent to change the purpose of use, or clearly clas - sify and manage personal information by distinguish - ing between information acquired prior to and after the integration.
There are special restrictions on the transfer of per - sonal data to foreign countries. In principle, the APPI requires the transferor to obtain the prior consent of individuals whose personal data will be transferred to third parties located in foreign countries (Article 28). Thus, overseas transfer restrictions will apply if a for - eign company transfers user data to another company outside Japan. However, if it does so to a company in Japan, overseas transfer restrictions will not apply. These restrictions apply even in cases of entrustment and joint use, which are exceptions to local third-party data transfer restrictions. Data subjects’ consent to overseas data transfers is not necessary only if either of the following applies: • the PPC designates the foreign country as a coun - try with a data protection regime with a level of protection equivalent to that of Japan (only mem - ber countries of the EEA and the UK have been designated to date); or • the third-party recipient has an equivalent sys - tem of data protection that meets the standards prescribed by the PPC Ordinance – ie, either of the following: (a) there is assurance, by appropriate and reason - able methodologies, that the recipient will treat the disclosed personal data in accordance with the spirit of the requirements for handling personal data under the APPI; or (b) the recipient has been certified under an inter - national arrangement recognised by the PPC regarding its system of handling personal data. Implementation of the PPC Ordinance is provided for in the PPC Guidelines, under which the “appropriate and reasonable methodologies” referred to above include agreements between the data importer and exporter, or intergroup privacy rules, which ensure that the data importer will treat the disclosed personal data in accordance with the spirit of the APPI. With respect to recognised international arrangements, the PPC Guidelines have identified the APEC Cross-Border
251 CHAMBERS.COM
Powered by FlippingBook