JAPAN Trends and Developments Contributed by: Yuki Kuroda, Takahiro Nakayama, Takuya Uehara and Nanoko Sasaki, Oh-Ebashi LPC & Partners
Violations likely to lead to serious infringement of rights and interests Specific examples
more data subjects (ie, limitation based on the scale of the violation). These proposals have raised concerns such as that “the requirements for reasonable care and concrete risk are unclear” and that “serious harm could occur even in cases involving fewer than 1,000 individuals”, warranting further detailed consideration. Penalty calculation method The Study Group is considering setting the pen - alty amount to be equal to the full amount of the financial benefits gained from the violation, or, even further, setting the surcharge amount in excess of this sum, with an emphasis on the importance of the deterrent effect of such pen - alty. Here, “financial benefit” refers to the “sales” received as a result of the violation, not “profit”. On this point, referring to the Certified Public Accountants Act, where a fine of 1.5 times the audit fee is imposed in cases of intentional false certification, an opinion has been raised sug - gesting that a fine exceeding the actual mon - etary gain by a certain extent should also be considered. The Study Group is also considering introducing presumptive provisions for cases where accu - rate calculation of such “financial benefit” proves difficult. Such presumptive provisions are said to be effective with respect to businesses that fail to accurately report their sales. Violations of security management measures Specific examples and element considerations Data breaches resulting from insufficient secu - rity management measures occur frequently in Japan, and the Study Group considers it appro - priate to subject certain of such data breaches to penalties.
The Study Group identified acts that generate benefits or compensation through violations of the following provisions as specific examples of acts likely to lead to serious infringement of rights and interests: • Article 18 – businesses shall not process personal data beyond the scope necessary to achieve the purpose of use specified in advance; • Article 19 – businesses shall not use personal data in a manner that may encourage or induce illegal or improper conduct; • Article 20 – businesses shall not collect per - sonal data through deception or other wrong - ful means; and • Article 27 – businesses shall not provide per - sonal data to third parties without obtaining prior consent from the data subject. Consideration of elements The Study Group is considering striking a bal - ance by taking the following three points into account: • the current policy is to adopt a negligence- based, rather than results-based, approach for imposing penalties, specifically targeting cases where “reasonable care to prevent violations was not exercised” (ie, limitation based on the violator’s subjective actions); • the policy is to limit penalties to cases where “individual rights and interests have been infringed or there is a concrete risk of infringe - ment”, rather than the mere occurrence of such violations (ie, limitation based on the degree of rights infringement); and • to exclude small-scale cases, penalties would only apply when violations affect 1,000 or
264 CHAMBERS.COM
Powered by FlippingBook