JAPAN Trends and Developments Contributed by: Yuki Kuroda, Takahiro Nakayama, Takuya Uehara and Nanoko Sasaki, Oh-Ebashi LPC & Partners
Similar to the three elements discussed above (under Consideration of elements ), the Study Group is considering imposing penalties in cas - es where there was “a severe failure to exercise reasonable care”, “individual rights and interests have been infringed or there is a concrete risk of infringement”, and the data breach affects 1,000 or more data subjects. Penalty calculation method The Study Group is considering calculating penalties by applying a specific calculation rate to the sales generated during the period of the violation through the business’s activi - ties. An example of a similar specific calculation rate being adopted is seen in the Antitrust Act, which stipulates a range of 10% to 1% of the sales generated during the period of the viola - tion through the business’s activities (Articles 7-2, 7-9, 20-2 and 20-6), and in the Act Against Unjustifiable Premiums and Misleading Repre - sentations, which sets the rate at 3% (Article 8, Para 1). Furthermore, the introduction of presumptive provisions is being considered, similar to those mentioned above. Other rules related to administrative monetary penalties Reduction for voluntary reporting To incentivise businesses to address violations immediately upon discovery, the Study Group is considering implementing reduction provisions (like a leniency system) for violators who volun - tarily report, thereby encouraging early detection of violations and the development of compliance systems. Increase for repeated violations The Study Group is considering imposing 1.5 times the standard penalty amount on entities
that have received a penalty payment order within ten years before the date of the provision of the report or on-site inspection related to the current violation. Other considerations Other matters under consideration include establishing a statute of limitations period from the cessation of the violation within which administrative authorities can take measures, and ensuring effectiveness against overseas businesses and those whose whereabouts are unknown. Injunctive Relief and Damage Recovery Systems Through Qualified Consumer Organisations Current rights protection for data subjects Currently, the APPI provides that data subjects may request the cessation of use or erasure of their personal data from businesses that have unlawfully processed such data (Article 35). In addition, data subjects may claim damages from businesses that have intentionally or negli - gently unlawfully infringed their rights related to personal data, including privacy (Article 709 of the Civil Code). Japanese courts award compensation for men - tal distress in data breach cases even without proof of financial damage. However, for less sen - sitive information such as names, addresses and email addresses, the mental distress compen - sation typically amounts to only USD10–20 per person. Consequently, many cases are aban - doned due to litigation costs exceeding potential compensation. Moreover, even if one data sub - ject pursues such claims, it cannot prevent the likelihood of similar harm occurring to numerous other data subjects in the future.
265 CHAMBERS.COM
Powered by FlippingBook