JAPAN Trends and Developments Contributed by: Yuki Kuroda, Takuya Uehara and Nanoko Sasaki, Oh-Ebashi LPC & Partners
breach in cases where there is little risk to individual rights and interests, including where only information such as the management ID, which has no meaning by itself for those who acquire it, has been breached. This is considered an issue that would have no small impact on practice. Prevention of Improper Use The current APPI only prohibits the inappropriate use or improper acquisition of personal data – ie, infor - mation that can identify a specific individual, either by itself or with other information that can easily be collated with it (Articles 19–20). In other words, the APPI does not currently regulate the inappropriate use or improper acquisition of information with which no specific individual can be identified. However, the inappropriate use or improper acquisi - tion of such information may also infringe individual rights and interests if the party using or acquiring it can contact the data subjects through such informa - tion. For example, a malicious party can send phishing emails to email addresses even if such email address - es do not constitute personal data – ie, no specific individual can be identified with the email addresses themselves or with other information that can easily be collated with them. In addition, anonymous health information that is not considered personal data can be used for advertising purposes beyond the purpos - es known to the data subjects. Under these circumstances, the PPC is considering broadening the coverage of the prohibitions men - tioned above by prohibiting the inappropriate use or improper acquisition of information with which no specific individual can be identified but through which the party using or acquiring it can contact the data subjects. Rules to Ensure Effective Compliance Introduction of an administrative monetary penalty system If businesses processing personal data violate the current APPI, they may be subject to sanctions issued by the PPC, such as administrative guidance, advice, recommendations or other orders, publication of their non-compliance (Articles 147–148) or criminal penal -
ties, including fines of up to JPY100 million (Articles 178–179 and 182–185). Based on the data published by the PPC, while sev - eral hundreds of notices of administrative guidance, advice and recommendations have been issued annu - ally, including against major corporations, no orders have been issued to businesses engaged in normal business activities, and no criminal penalties have ever been imposed on companies. These facts have cast doubt on the deterrent effect of the current APPI and, given the fact that many other countries have already introduced financial penalty systems, discus - sions over the potential introduction of an adminis - trative monetary penalty system in Japan have been increasing in recent years. On the occasion of the current triennial review pro - cess, the PPC seems to be seriously considering the introduction of an administrative monetary penalty system for the APPI. However, it has been proposed that the scope of corporate acts that would be sub - ject to monetary penalties should be limited to some extent, to avoid excessive regulation that might dis - courage lawful acts. The proposal includes the introduction of a penalty that would be imposed on a business only when: • it has derived financial benefits by violating any of the specific provisions of the APPI, including Articles 19 (prohibition of inappropriate use), 20 (proper acquisition) and 27 (restrictions on provi - sion of personal data to third parties); • it fails to exercise reasonable care to prevent such violation; • individual rights and interests have been or are likely to be infringed by such violation; and • the number of data subjects involved is not less than 1,000. Ensuring the effectiveness of recommendations, orders, etc In addition to the potential introduction of an admin - istrative monetary penalty system, the PPC is con - sidering the introduction of measures to ensure the effectiveness of existing penalties, such as recom -
257 CHAMBERS.COM
Powered by FlippingBook