JAPAN Trends and Developments Contributed by: Yuki Kuroda, Takahiro Nakayama, Takuya Uehara and Nanoko Sasaki, Oh-Ebashi LPC & Partners
Data Protection and Privacy in Japan: an Introduction The Act on the Protection of Personal Informa - tion (APPI) serves as Japan’s fundamental and comprehensive data protection legislation. When the APPI underwent significant amend - ments in 2020, it was stipulated that its provi - sions should be reviewed approximately every three years following the implementation of the amended law. Therefore, the Personal Informa - tion Protection Commission (PPC), established as the data protection authority under the APPI, initiated its review in November 2023 and pub - lished an Interim Report in June 2024. Subse - quently, the PPC established a Study Group, comprising experts in data protection, to dis - cuss matters that the Interim Report identified as requiring further consideration. Specifically, the Study Group discussed the potential intro - duction of an administrative monetary penalty system, and the potential introduction of injunc - tive relief and damage recovery systems through qualified consumer organisations. The Study Group published a report summarising its dis - cussions in December 2024. Meanwhile, the PPC conducted hearings with experts and other stakeholders to examine specific institutional designs and priorities for issues identified in the Interim Report but not discussed by the Study Group, and to prepare for medium-term comprehensive reform of the system. Based on these hearing results, the PPC published the “Next Steps” in January 2025, outlining the issues requiring short-term consideration. The Interim Report, the Study Group’s report and the Next Steps are crucial documents for antici - pating future APPI amendments. This chapter
provides an overview of the prospective APPI amendments as gleaned from these documents. As discussed below, these three documents primarily address the administrative monetary penalty system, and injunctive relief and dam - age recovery systems through qualified con - sumer organisations, and other pertinent issues. However, the implementation requirements for these items vary: some clearly necessitate APPI amendments, while others could be achieved through modifications to enforcement regula - tions or guidelines alone. Furthermore, no clear timeline has been established for implementing these various issues. Consequently, while specific proposed amend - ments to the APPI may be published as early as this spring, it remains uncertain whether all issues discussed in this chapter will be incor - porated. Nevertheless, the introduction of the administrative monetary penalty system and the injunctive relief and damage recovery sys - tems through qualified consumer organisations would undoubtedly represent the most signifi - cant enforcement-related amendment since the APPI’s implementation in 2005. Note that one unique aspect of the APPI com - pared to other countries’ data protection regula - tions is that it defines concepts such as “Person - al Information”, “Personal Data” and “Personal Data the Business Holds”. Since most of the data processed by businesses falls under “Per - sonal Data”, this chapter will use the term “Per - sonal Data” without making strict distinctions between these terms. Administrative Monetary Penalty System Sanctions under the current system The current APPI provides the following primary sanctions for APPI violations.
262 CHAMBERS.COM
Powered by FlippingBook