Data Protection and Privacy 2025

JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto

collected to provide such advertising is subject to the law. For example, the APPI has regula - tions for certain cookies, web beacons and other tracking technology underlying behav - ioural or targeted advertising (please see 4.1 Use of Cookies ). It is good practice to have a cookie policy and to offer an opt-out from using cookies (especially for behavioural advertising). The Japan Interactive Advertising Association’s guidelines are useful for gaining an understand - ing of good practices in Japan. Effective since June 2023, the TBA imposed new obligations on TSPs, which have a non-trivial impact on users’ interests. More specifically, a TSP is an entity that provides: • any services of intermediating telecommuni - cation of others, such as email or direct mes - saging services; • social media services, bulletin board systems, movie sharing services, online shopping malls, live streaming services, online games, • various information, such as news, weather, movies and maps, to unspecified people. When a TSP makes users send their informa - tion (typically including cookies) to an external party, the TSP is required to make a notification or public announcement, obtain opt-in consent or provide an opt-out mechanism with respect to certain information, including the content of the information, the name of the recipient party and the recipient’s purpose of use of the information. Unsolicited marketing by email is regulated prin - cipally by the Act on the Regulation of Trans - mission of Specified Electronic Mail (Anti-Spam Act), under which marketing emails can only be sent to recipients who: online education or the like; • online search engines; or

• have given prior consent to receive them; • have provided the sender with their email addresses in writing (for instance, by provid - ing a business card); • have a business relationship with the sender; or • make their email addresses available on the internet for business purposes. The Anti-Spam Act also requires the sender to allow the recipients to opt out. Furthermore, the Act on Specified Commercial Transactions restricts marketing regarding mail order businesses, including online shopping, but does not provide exceptions similar to the last three items above. There are special restrictions on telecommuni - cations business operators regarding location information under MIC’s guidelines on personal information for telecommunications businesses. Under these guidelines, telecommunications business operators can obtain or transfer loca - tion information from mobile devices only with the data subjects’ prior consent or if there is a justifiable cause. 4.3 Employment Privacy Law The Ministry of Health, Labour and Welfare has issued a notice regarding the handling of health information of employees by employers, includ - ing a condition that the employer shall not han - dle such information beyond the scope neces - sary to secure their employees’ health. Furthermore, to prevent discrimination, the Employment Security Act has special restric - tions on obtaining information on job applicants during their recruitment.

257 CHAMBERS.COM

Powered by