JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
ments of any of the exceptions provided by the APPI (Article 27.1). These exceptions include instances where a transfer is required by law or is necessary to perform governmen - tal duties to protect the life, body or property of a person or to improve public health, or is necessary for academic or research purposes (Article 27.1(i)–(vii)). Other major exceptions include cases of entrustment of the handling of personal data to another entity, joint use of personal data with another entity, business succession resulting from a merger or other legal reasons (Article 27.5), or the filing of a notification of opt-out consent with the PPC (Article 27.2). • They may not transfer personal data to coun - tries that do not have sufficient data protec - tion safeguards without the data subjects’ consent (Article 28). • They must keep records of the provision of personal data to third parties (Article 29). • Upon receiving personal data from other handling operators, they must confirm the providing handling operator’s compliance with applicable regulations regarding the pro - vision of personal data and keep a record of the confirmation process (Article 30). • They must handle pseudonymously and anonymously processed information in cer - tain ways (Articles 41 to 46). Entrustment Under Article 27.5(i) of the APPI, if a handling operator entrusts all or part of the handling of personal data it acquires to an individual or another entity, that individual or entity will not be considered a third party under Article 27.1. For example, if a handling operator uses third- party vendors of handling operator services and shares personal data with those vendors for them to use on the handling operator’s behalf and not for their own use, that transfer will be
deemed an “entrustment” and is not subject to data transfer restrictions. When a handling operator “entrusts” personal data, it must exercise appropriate supervision as necessary over the entrusted person to ensure security control over the entrusted personal data (Article 25). Joint Use Handling operators may share and jointly use personal data with specific individuals or enti - ties as long as the handling operator notifies the data subjects or makes the following information accessible to them (Article 27.5(iii)) before any information sharing or joint use: • the fact that personal data will be used jointly with specific individuals or entities; • the personal data to be used jointly; • who the joint users are; • the purpose of the joint use; and • the name of the individual or entity respon - sible for managing the personal data (the address of the responsible individual or entity and, if it is a corporate body, the name of its representative are also required). After this information is published or the data subjects are notified of it, the identified joint users will not be deemed third parties within the context of Article 27 and, therefore, the handling operator and the identified joint users may share and jointly use specific items of personal data as if they were a single entity. Business Succession Handling operators may transfer personal data to third parties without the opt-in consent of data subjects if the transfer accompanies a business succession caused by a merger or for other legal reason (Article 27.5 (ii)).
253 CHAMBERS.COM
Powered by FlippingBook