JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
The PPC does not have the authority to conduct criminal investigations, and the APPI explicitly stipulates that the commission’s power to con - duct on-site inspections does not include crimi - nal investigations (Article 146.3). It is important to note that the APPI imposes no administrative fines. Criminal sanctions may only be imposed if a handling operator: • refuses to co-operate with or makes any false report in response to an investigation by the PPC (Article 178); • provides a personal information database to unauthorised persons or misuses the data - base for unlawful gains (Article 180); or • violates any order given by the PPC as part of an administrative sanction (Article 181). The PPC empowers private organisations called accredited personal information protection organisations ( nintei kojin jouhou hogo dantai ) to handle and promote the protection of the per - sonal information held by handling operators. These accredited organisations process com - plaints against handling operators or provide information on them to ensure the reliability of the businesses of those handling operators, and promote the protection of personal information. They also establish their own rules, with which their members must comply. 1.3 Enforcement Proceedings and Fines The PPC finds potential violations of the APPI through: • data breach reports submitted by handling operators; • telephone consultations made through their business support desk; and • media coverage.
It has the power to enforce administrative sanc - tions, but the APPI does not provide for admin - istrative fines; please see 1.2 Regulators for details. The introduction of administrative fines is under discussion. The PPC provides guidance or advice, and does not take further action in most cases, although the commission takes strong action such as issuing orders in serious cases. Please see 1.4 Data Protection Fines in Prac- tice for recent statistics about administrative sanctions enforced by the PPC. 1.4 Data Protection Fines in Practice The APPI does not provide for administrative fines, but enforcement statistics are as follows. • Between 1 October 2023 and 31 March 2024, no administrative orders were issued, three administrative recommendations were made, 168 issuances of administrative guidance or advice were made, no on-site inspec - tions were conducted, and 13 administrative requests for reports and materials were made against handling operators under the APPI. • Between 1 April 2023 and 30 September 2024, no administrative orders were issued, no administrative recommendations were made, 1,203 issuances of administrative guidance or advice were made, three on-site inspections were conducted, and 61 adminis - trative requests for reports and materials were made against handling operators under the APPI. No administrative orders have been issued because ordinary companies have been in com - pliance with the PPC’s administrative guidance and advice. Moreover, companies are typically
250 CHAMBERS.COM
Powered by FlippingBook