JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy- Related Laws Japan’s principal data protection legislation is the Act on the Protection of Personal Informa - tion (APPI). It provides the basic principles for the government’s regulatory policies and author - ity, as well as the obligations of private business operators that handle personal information (han - dling operators). Before April 2022, national administrative bod - ies were regulated by the Act on the Protection of Personal Information Held by Administrative Organs and the Act on the Protection of Person - al Information Held by Independent Administra - tive Agencies, etc. However, after April 2022, the obligations prescribed in these two laws were integrated into the APPI. Local government bodies are regulated under their own local regulations ( jourei ), but these vary between bodies. In April 2023, the APPI intro - duced nationwide principles for jourei and relat- ed implementing guidelines to homogenise the administration of national data protection regula - tions. Under this set of amendments, standard rules regarding personal information handled by local governments are uniformly stipulated in the APPI, while jourei can only stipulate local rules in very limited situations allowed under the law. Another important law is the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (My Number Act), which stipulates special rules for what is known in Japan as the Number to Identify a Specific Individual in Administrative Procedures (My Number), a 12-digit individual number assigned to each resident of Japan.
In June 2023, the Telecommunications Business Act (TBA) introduced a regulation about sending cookies to external parties. It also imposed new obligations regarding user information on large telecommunications service providers (TSPs) that have either 5 million paid users or 10 mil - lion free users. There are no laws or regulations that target arti - ficial intelligence (AI) at this time. Furthermore, the Personal Information Protec - tion Commission (PPC – the regulator primar - ily responsible for the APPI and the My Num - ber Act) has published guidelines for handling personal information (PPC Guidelines). The ministries with jurisdiction over some industrial sectors have published data protection guide - lines for those sectors. For example, the Finan - cial Services Agency (FSA) and the PPC have jointly published data protection guidelines for the financial sector, and the Ministry of Internal Affairs and Communications (MIC) has issued data protection guidelines for telecommunica - tions business operators. The APPI follows the Organisation for Economic Co-operation and Development’s eight Privacy Principles. Japan has reached an agreement with both the EU and the UK to certify each oth - er’s country or territory as an “adequate” country for Japan’s and the EU/UK’s data protection pur - poses; this decision was renewed in March and April 2023. However, this does not mean that the APPI is identical to Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR). Japanese data protection law is, nonetheless, closer to the EU omnibus model than the US sectoral/subnational approach in the sense that Japan has a comprehensive data protection law: the APPI.
248 CHAMBERS.COM
Powered by FlippingBook