JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
• the retention of retained personal data has become unnecessary; • a data breach has occurred regarding the retained personal data; or • there is a possibility that the handling of the retained personal data would harm the rights or legitimate interests of the data subjects. However, this obligation will not apply if it will be too costly or difficult to discontinue the use of or erase the retained personal data and the handling operator takes necessary alternative measures to protect the rights and interests of the data subjects (Article 35). 3.2 Interaction of Data Regulation and Data Protection See 3.1 Objectives and Scope of Data Regula- tion . 3.3 Rights and Obligations Under Applicable Data Regulation See 3.1 Objectives and Scope of Data Regula- tion . 3.4 Regulators and Enforcement See 1.2 Regulators . The use of cookies, web beacons and other tracking technology is not directly regulated under the APPI. Information collected by cook - ies or web beacons is not automatically deemed to be personal information, but it will be if the handling operator can easily collate information collected by cookies or web beacons with the name of the individual (for example, when an internet-based company can identify the cookie IDs of customers when logged in to its website). 4. Sectoral Issues 4.1 Use of Cookies
In this regard, the transfer of personal data to third parties – whether the data is personal data or not – is determined based on the cir - cumstances surrounding the transferor, not the transferee. In brief, if the data is not personal data in the hands of the transferor, regulations regarding the transfer of personal data to third parties are not applicable. In the past, some schemes emerged whereby data management platforms provided non-per - sonal information such as user data collected by cookies (eg, user browsing histories, interests, preferences) to third parties, with the knowledge that the data will be personal data in the hands of the recipient. The PPC was concerned by the expansion of this kind of data sharing without the involvement of (or control by) the data sub - jects. As a result, the concept of personally ref - erable information was introduced in April 2022, defined as a collective set of information com - prising information relating to living individuals that does not fall under personal information or pseudonymously or anonymously processed information but that has been systematically organised to be searchable using a computer for specific personally referable information or similar information prescribed by Cabinet Order. The APPI regulates the provision of personally referable information if the provider assumes that a recipient will acquire a database of the provided personally referable information as per - sonal data. In such cases, the transferor must confirm that the transferee has obtained the data subjects’ consent to transfer their data as per - sonal data. 4.2 Personalised Advertising and Other Online Marketing Practices Behavioural advertising is not directly regulated under the APPI, but any personal information
256 CHAMBERS.COM
Powered by FlippingBook