JAPAN Trends and Developments Contributed by: Yuki Kuroda, Takuya Uehara and Nanoko Sasaki, Oh-Ebashi LPC & Partners
Other directions regarding relaxation of consent requirements In addition to the points mentioned above, the PPC’s Views on Institutional Issues and Policy on Institu - tional Amendments also suggest that personal data processing that clearly does not contradict the data subject’s will and therefore does not harm his/her rights and interests may be allowed without his/her consent. Such processing may include, for example, the provision of customer data from a hotel booking site to the hotel where the customer wishes to stay, or data sharing between banks for overseas remittances. Consent may also no longer be required for the pro - cessing of personal data that is necessary for the pro - tection of life, body or property, or for the improvement of public health or the promotion of the healthy devel - opment of children. Under the current APPI, such data processing is allowed without data subjects’ consent only if it is difficult to obtain such consent. The PPC is considering easing the requirement by allowing such data processing even when it is not difficult to obtain the data subject’s consent but there are reasonable grounds for not obtaining his/her consent – for exam - ple, when necessary and appropriate measures have been implemented to prevent privacy violations, such as anonymisation or concluding confidentiality agree - ments. The PPC is also considering easing consent require - ments when hospitals and other organisations provid - ing medical care acquire sensitive personal data or share personal data with third parties. Rules to Appropriately Address Risks Establishment of new regulations on processing children’s personal data The current APPI does not have any special regula - tions regarding the processing of children’s personal data that differ from those relating to adults, except that it stipulates that a legal representative, including a parent, may make a request for disclosure, etc, on a child’s behalf (Article 37). On the other hand, the PPC makes it clear that, when processing the per - sonal data of children under the age of 12, businesses should obtain the consent from the children’s legal representatives rather than from the children them - selves.
nal record (Article 20), or providing personal data to a third party (Article 27), among other activities. There have been complicated debates on how strictly these regulations should be applied in situations where training data sets containing personal data are used for AI development. This is said to have been causing confusion in practice. The PPC is of the opinion that parameters making up a learned model of AI do not constitute personal data even if the model was trained with data sets containing personal data, as long as there is no correspondence between such parameters and a specific individual. However, this does not mean that AI developers may use personal data they received from a third party, such as user companies, without limitation for AI train - ing purposes; instead, AI developers may only use such personal data without the data subjects’ consent within the scope of work outsourced by the third party. As a result, it is often discussed whether the usage of the subject training data sets falls “within the scope of work outsourced by the third party”, which is hard to determine if the AI developer intends to provide the learned model to users other than the third party that provided the data sets. There is also a debate as to whether it would be illegal for an AI developer to cre - ate training data sets containing personal data without the data subjects’ consent by collecting information that was publicly available on the internet but uninten - tionally containing sensitive personal data. Under these circumstances, the PPC’s Views on Insti - tutional Issues and Policy on Institutional Amendments demonstrate that it is considering the introduction of a system that would allow for the legitimate provision of personal data to a third party and the acquisition of publicly available sensitive personal data without the data subjects’ consent as long as it is ensured that such data would be used only for the creation of sta - tistical information, including “AI development, etc., which can be categorised as statistical creation, etc.” If such system is introduced, the practical confusion surrounding AI development would likely be settled to a certain extent.
255 CHAMBERS.COM
Powered by FlippingBook