JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
Privacy Rules (CBPR) as a recognised international framework for the handling of personal information. Please also refer to 5.5 Recent Developments for additional obligations effective since April 2022. 5.2 Government Notifications and Approvals Overseas data transfer restrictions do not require gov - ernment notification or approval. 5.3 Data Localisation Requirements There are no data localisation requirements under the APPI. 5.4 Blocking Statutes There are no blocking statutes under Japanese law. 5.5 Recent Developments Effective since April 2022, international data transfers are permitted only when additional requirements are met. First, when handling operators transfer personal data to foreign countries based on the aforementioned consent mechanism, they will be required to provide data subjects with certain information, as specified by the amended ordinance issued by the PPC (the “Amended PPC Ordinance”) (Article 28.2). According to the PPC Ordinance, the foreign country’s name, information about its personal information protection system and the measures to be taken by the recipient party to protect personal information are required to be provided to the data subjects. Second, when handling operators transfer personal data relying on the recipient’s equivalent system of data protection, they will be required to take the necessary steps to ensure that the overseas recipient continu - ously takes equivalent measures and to provide data subjects with certain information about the measures to be taken upon request under the Amended PPC
Ordinance (Article 28.3). In this regard, according to the PPC Ordinance, one of two assurance measures is to periodically confirm the implementation status of the equivalent measures taken by the recipient and the presence or absence of systems in the foreign country that might affect the implementation of the equivalent measures. The other measure is to take necessary and appropriate measures if the recipient party’s implemen - tation of the equivalent measures is interfered with in some way, and to suspend the provision of personal data if it becomes difficult to ensure the continuous implementation of the equivalent measures. The PPC Ordinance also states that the following information must be provided to data subjects upon request: • the recipient party’s equivalent system of data protection; • an outline of the equivalent measures taken by the recipient; • the frequency and method of confirmation of the status of the equivalent measures and of the system in the foreign country that might affect the • the presence or absence of systems in that foreign country that might affect the implementation of the equivalent measures; • the presence or absence of any impediments to the implementation of the equivalent measures; and • an outline of the measures to be taken in response to such impediments. As a result, data transfers to countries where proper government access is not implemented can be dif - ficult. An example of this difficulty is the international data transfer regulations under the GDPR raised by the Schrems II case. implementation of the measures; • the name of the foreign country;
252 CHAMBERS.COM
Powered by FlippingBook