JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
According to a supplementary provision of the APPI, a review of whether to amend the law is conducted every three years. Based on this pro - vision, on 27 June 2024 the PPC published an “Interim Summary”, outlining its current thinking based on discussions and examinations to date. On 4 September 2024, the commission then published the results of a public consultation, • specifying and categorising the regulations on improper use and unauthorised acquisition; • aggravating obligations on the opt-out scheme for the provision of personal data to third parties; • regulations regarding children’s personal information; • strengthening APPI enforcement (including implementation of an administrative fine sys - tem and establishing a new system of injunc - tive relief and restoration of damages); covering the following main topics: • new regulations on biometric data; • streamlining the scope and details of data breach reports and data subject notifications; • exempting certain data processing from data subject consent that is currently required by law; and • privacy impact assessments (PIAs) and those in charge of handling personal data. However, it remains unclear whether legislation based on the Interim Summary will be submitted to the next regular Diet session (January–June 2025). If the amended law is enacted, its imple - mentation is expected to begin in either 2026 or 2027. On 31 July 2024, an expert panel was estab - lished to discuss issues regarding strengthen - ing APPI enforcement, with the report being published on 25 December 2024. In addition, on 21 October 2024, the PPC published its “Per -
spectives for Enhancing the Triennial Review of the Personal Information Protection Act”. These perspectives could possibly be interpreted as suggesting a shift towards GDPR-style legisla - tion to some extent, but such fundamental insti - tutional changes may not be realistic in the short term, particularly as passage at the next regular Diet session would face significant hurdles. The PPC has conducted hearings with various stake - holders regarding these perspectives, with the results being published on 17 December 2024. 1.2 Regulators The PPC is tasked with enforcing and imple - menting the APPI, and has the following powers: • to require handling operators to report or submit materials regarding their handling of personal information, and to enter handling operators’ offices or other locations to inves - tigate, make enquiries and check records or other documents (Article 146); • to provide guidance or advice to handling operators (Article 147); • to recommend that handling operators cease any violations of the APPI and take other necessary measures to correct the violations (Article 148.1); • to order handling operators to take necessary measures to implement the PPC’s recom - mendations mentioned above and rectify certain violations of the APPI (Articles 148.2 and 148.3); and • to publicly announce any handling operators’ violations of orders issued by the PPC pursu - ant to Articles 148.2 and 148.3 (Article 148.4). For some sectors, other government authorities also enforce the APPI – for example, the FSA is the relevant authority for banks, whereas MIC is the appropriate authority for TSPs. There are no regulators specifically overseeing AI data.
249 CHAMBERS.COM
Powered by FlippingBook