JAPAN Law and Practice Contributed by: Yoshifumi Onodera, Hiroyuki Tanaka, Naoto Shimamura and Rio Ichii, Mori Hamada & Matsumoto
Please also refer to 5.5 Recent Developments for additional obligations effective since April 2022. 5.2 Government Notifications and Approvals Overseas data transfer restrictions do not require government notification or approval. 5.3 Data Localisation Requirements There are no data localisation requirements under the APPI. 5.4 Blocking Statutes There are no blocking statutes under Japanese law. 5.5 Recent Developments Additional Obligations Since April 2022 Effective since April 2022, international data transfers are permitted only when additional requirements are met. First, when handling oper - ators transfer personal data to foreign countries based on the consent mechanism, they will be required to provide data subjects with certain information, as specified by the amended Ordi - nance issued by the PPC (Article 28.2). Accord - ing to the PPC Ordinance, the foreign country’s name, information about its personal informa - tion protection system and the measures to be taken by the recipient party to protect personal information are required to be provided to the data subjects. Second, when handling operators transfer per - sonal data relying on the recipient’s equivalent system of data protection, they will be required to take the necessary steps to ensure that the overseas recipient continuously takes equivalent measures and to provide data subjects with cer - tain information about the measures to be taken upon request under the amended PPC Ordi -
nance (Article 28.3). In this regard, according to the PPC Ordinance, one of two assurance meas - ures is to periodically confirm the implementa - tion status of the equivalent measures taken by the recipient and the presence or absence of systems in the foreign country that might affect the implementation of the equivalent measures. The other measure is to take necessary and appropriate measures if the recipient party’s implementation of the equivalent measures is interfered with in some way, and to suspend the provision of personal data if it becomes difficult to ensure the continuous implementation of the equivalent measures. The PPC Ordinance also states that the follow - ing information must be provided to data sub - jects upon request: • the recipient party’s equivalent system of data protection; • an outline of the equivalent measures taken by the recipient; • the frequency and method of confirmation of the status of the equivalent measures and of the system in the foreign country that might affect the implementation of the measures; • the name of the foreign country; • the presence or absence of systems in that foreign country that might affect the imple - mentation of the equivalent measures; • the presence or absence of any impediments to the implementation of the equivalent meas - ures; and • an outline of the measures to be taken in response to such impediments. As a result, data transfers to countries where proper government access is not implemented can be difficult. An example of this difficulty is the international data transfer regulations under the GDPR raised by the Schrems II case.
259 CHAMBERS.COM
Powered by FlippingBook