JAPAN Trends and Developments Contributed by: Satoshi Ogawa, Yuto Noro, Hitoshi Fujimaki and Yuka Hirata, TMI Associates
Regarding the APPI, the 2015 Amendment intro- duced the information category of “anonymous- ly processed information”, making it easier to provide anonymised data externally. The 2020 Amendment also added “pseudonymously pro- cessed information” to the APPI and encour- aged the utilisation of pseudonymised data internally. Moreover, the 2021 Amendment to the APPI ensures that the same rules apply to public authorities and private companies in the medical and academic sectors, thereby promoting joint public–private partnerships. For example, Japanese healthcare service pro- viders provide healthcare data as anonymously processed information to pharmaceutical com- panies and research institutions. These provid- ers include JMDC Inc., Medical Data Vision Co., Ltd., IQVIA Solutions Japan G.K. and Real World Data Co., Ltd. The Next Generation Medical Infrastructure Act introduced an accreditation system for medical data providers, allowing accredited providers to receive medical information from medical institu- tions on an opt-out basis. Initially, such accred- ited providers could only create “anonymously processed medical information”, but the 2023 Amendment allowed them to produce “pseu- donymously processed medical information”. This has broadened the use of medical informa- tion under the Next Generation Medical Infra- structure Act. Currently, only a limited number of healthcare data providers have received accreditation. The major accredited providers are Life Data Initiative (LDI), Japan Medical Association, Medical Infor- mation Management Organization (J-MIMO) and Fair and Safe Use of Anonymised Standardised Health Data of Japan (FAST-HDJ). As of the end of February 2025, the number of data provision
cases under the Next Generation Medical Infra- structure Act is 45 for LDI, 14 for J-MIMO, and 4 for FAST-HDJ. A total of 153 medical institutions are co-operating by sharing medical information with these accredited providers. Increased complexity of data protection regulations The regulation of healthcare data has become increasingly complex due to the frequent amend- ments to the APPI. The APPI has been signifi- cantly amended in 2015, 2020 and 2021, since it was first legislated in 2003. These amendments have increased the burden of legal compliance in handling healthcare data. In 2015, the APPI established new regulations by creating “special care-required personal information”. This information includes medi- cal history, physical/mental disabilities, medical test results, and medical treatment/dispens- ing. Under the amended APPI, collecting spe- cial care-required personal information requires consent from the data subject and it can no longer be provided to third parties in an opt-out manner. The 2015 Amendment to the APPI also introduced a requirement for international trans- fer and obliged businesses to obtain the data subject’s consent to such transfer. In 2020, the APPI expanded the rights “to cease use” and “to erase” so that the data subject can broadly exercise these rights if there is a risk of harm to their rights or interests. The 2020 Amendment to the APPI also introduced a new reporting obligation for data breach incidents. If such incident exceeds certain thresholds, the business must report to the regulator and the data subjects. Moreover, the 2020 Amend- ment strengthened the data transfer require- ment. Businesses must now provide the name of the foreign country in question, information on
71
CHAMBERS.COM
Powered by FlippingBook