JAPAN Trends and Developments Contributed by: Yuki Kuroda, Takuya Uehara and Nanoko Sasaki, Oh-Ebashi LPC & Partners
Under these circumstances, the PPC is considering taking further steps to establish new regulations on the processing of children’s personal data, including: • a regulation that would obligate businesses to obtain the consent of, or notify, the legal repre - sentatives of the data subjects with respect to the processing of personal data of children under the age of 16 that requires businesses to obtain the consent of, or notify, the data subjects; and • a regulation that would allow children under the age of 16 or their legal representatives to, without cause, request businesses to cease to use, delete or cease to provide a third party with their personal data. Establishment of new regulations on the processing of biological data The current APPI does not have any special regula - tions regarding the processing of biological data that differ from those applicable to other personal data, unless it involves sensitive personal data. However, biological data that can be easily obtained without the data subjects’ knowledge and that can be used to track their behaviour over time due to its uniqueness and immutability, such as facial feature data, is prone to invade the privacy of data subjects, even if it is not sensitive personal data. The PPC is therefore considering establishing new regulations on the processing of such biological data, including: • a regulation that would obligate businesses that are processing such biological data to disclose certain items regarding the processing; and • a regulation that would allow data subjects to request businesses to, without cause, cease to use, delete or cease to provide a third party with such biological data.
exceptions. Specifically, data subjects’ consent is not required when personal data is provided to a third party for the purpose of entrusting personal data processing (Article 27, Paragraph 5, Item 1). Instead, businesses must exercise necessary and appropriate supervision over such third-party processors (Article 25). For instance, cloud service usage may be categorised as entrusted personal data processing. In such cases, cloud service users must supervise service provid - ers, such as through requiring periodic reports on the status of personal data processing. However, such supervision may be impractical when small-scale businesses use large-scale cloud services. Therefore, the PPC is now considering reviewing regulations for entities entrusted with personal data processing based on practical realities. For example, such entities may no longer be required to implement security measures for the entrusted personal data by themselves as long as they conclude agreements with the entrusting party regarding all aspects of the means of the processing and measures necessary for the entrusting party to monitor the status of the processing. Adjustment of data breach notification requirements The current APPI requires businesses that have experienced a specific type of personal data breach to report it to the PPC and notify the data subjects involved of such breach (Article 26). “Personal data” in this context includes information such as a management ID assigned solely for internal system database integration, which by itself cannot identify a specific individual but can be easily collated with other information, such as the name and con - tact information of an individual, to thereby identify a specific individual. Businesses would therefore be required to comply with the reporting and notification obligations even if only such information had been breached, which as a result imposes an excessive burden on businesses. Under these circumstances, the PPC is considering relaxing the obligation to notify data subjects of a data
Adjustment of regulatory framework for businesses entrusted with personal data processing
The APPI currently requires businesses to obtain data subjects’ consent when providing personal data to third parties, as discussed above, but there are some
256 CHAMBERS.COM
Powered by FlippingBook