JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
The employer has the right to monitor workplace communications in relation to work and to use cybersecurity tools, insider threat detection and prevention programmes, and digital loss preven - tion technologies, but privacy issues may arise regarding private communications and other pri - vacy matters at the workplace. Thus, employ - ers are recommended to establish internal rules prohibiting the use of company PCs and email addresses for private use, and to disclose the possibility of monitoring those devices and data, including emails. In principle, there is no special role for labour organisations or works councils regarding employment-related data privacy, but there is a general requirement for employers to obtain the opinion of the employee representative in estab - lishing work rules. 4.4 Transfer of Personal Data in Asset Deals See 3.1 Objectives and Scope of Data Regula- tion for the regulations on transferring personal data to other entities. 5. International Considerations 5.1 Restrictions on International Data Transfers Basic Regulation There are special restrictions on the transfer of personal data to foreign countries. In princi - ple, the APPI requires the transferor to obtain the prior consent of individuals whose personal data will be transferred to third parties located in foreign countries (Article 28). Thus, overseas transfer restrictions will apply if a foreign compa - ny transfers user data to another company out - side Japan. However, if it does so to a company in Japan, overseas transfer restrictions will not
apply. These restrictions apply even in cases of entrustment and joint use, which are exceptions to local third-party data transfer restrictions. Data subjects’ consent to overseas data trans - fers is not necessary only if either of the follow - ing applies: • the PPC designates the foreign country as a country with a data protection regime with a level of protection equivalent to that of Japan (only member countries of the EEA and the UK have been designated to date); or • the third-party recipient has an equivalent system of data protection that meets the standards prescribed by the PPC Ordinance – ie, either of the following: (a) there is assurance, by appropriate and reasonable methodologies, that the recipient will treat the disclosed personal data in accordance with the spirit of the requirements for handling personal data under the APPI; or (b) the recipient has been certified under an international arrangement recognised by the PPC regarding its system of handling personal data. Implementation of the PPC Ordinance is provid - ed for in the PPC Guidelines, under which the “appropriate and reasonable methodologies” referred to above include agreements between the data importer and exporter, or intergroup pri - vacy rules, which ensure that the data importer will treat the disclosed personal data in accord - ance with the spirit of the APPI. With respect to recognised international arrangements, the PPC Guidelines have identified the APEC Cross Border Privacy Rules (CBPR) as a recognised international framework for the handling of per - sonal information.
258 CHAMBERS.COM
Powered by FlippingBook