JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
in the implementation process”, which business operators are encouraged to follow voluntarily. The APPI does not refer to the concepts of pri - vacy by design or by default, but PPC guidelines on accredited personal information protection organisations recommend that these organisa - tions promote privacy by design. Internal or External Privacy Policy The PPC Guidelines recommend releasing a pri - vacy policy or statement. Article 32.1 of the APPI requires handling opera - tors to make the following information regarding retained personal data available to data subjects: • the name of the handling operator, an address for the individual or entity responsible and, if it is a corporate body, the name of its repre - sentative; • the purposes of use of retained personal data; • the procedures for responding to requests from data subjects to disclose, correct, sus - pend the use of or erase retained personal data; • contact information for accepting complaints regarding the processing of retained personal data; and • security measures being implemented by the handling operator. Most handling operators typically comply by using internal and external privacy policies. The PPC Guidelines also recommend stating the following in a handling operator’s basic policies as part of the implementation of security control
• compliance with relevant laws, regulations and guidelines; • an explanation of security control measures regarding personal data; and • contact details for complaints and questions. Most handling operators typically comply by using internal and external privacy policies. The PPC Guidelines also recommend being transparent in disclosing the entrustment of work involving personal data (eg, disclosing whether entrustment has been made and what kind of work has been entrusted). Data Subjects’ Rights Data subjects may request handling operators to disclose their retained personal data and the record of its provision to third parties. Handling operators must comply with these requests unless there is a possibility that the disclosure could harm the data subject’s or a third party’s life, body, property or other rights or interests, or that it could seriously interfere with the handling operator’s business (Article 33). Data subjects may also request handling opera - tors to correct, add or delete retained personal data. The handling operator must investigate without delay and, based on the results of the investigation, comply with these requests to the extent necessary to achieve the purposes of use of the retained personal data (Article 34). Furthermore, data subjects may request that handling operators discontinue the use of or erase retained personal data and stop providing retained personal data to third parties if: • the data was or is being acquired, processed or provided to a third party in violation of the APPI;
measures regarding personal data: • the name of the handling operator;
255 CHAMBERS.COM
Powered by FlippingBook