JAPAN Trends and Developments Contributed by: Yuki Kuroda, Takahiro Nakayama, Takuya Uehara and Nanoko Sasaki, Oh-Ebashi LPC & Partners
ness constitute a violation of these provisions and what circumstances constitute negligence in data breach cases. Other Discussion Points Short-term consideration issues Beyond administrative monetary penalties and systems for injunctive relief and damage recov - ery through qualified consumer organisations, the PPC is discussing amendments based on past APPI violation cases and international per - sonal data protection law trends. Discussion points were initially presented in the Interim Report and subsequently prioritised in the Next Steps. The following issues are identified for consideration in the short term. Framework for data subject involvement in personal data processing: consent requirements Currently, the APPI requires businesses to obtain the consent of a data subject when collecting sensitive personal data such as race, medical history or criminal record or when providing per - sonal data to third parties (Article 20, Para 2 and Article 27, Para 1). However, there are concerns that it might be excessive to require consent even in cases where there is no direct impact on data subjects’ rights and interests. For example, AI-trained models may be devel - oped using training datasets containing personal data. Trained models typically do not contain information linked to specific individuals, so their development itself might not directly impact data subjects’ rights and interests. However, there are concerns that requiring data subject consent whenever using data available online including sensitive personal data for AI development, or when using personal data received from third parties, could hinder innovation.
Therefore, the Next Steps propose clarifying exemptions from data subject consent require - ments for personal data processing in the fol - lowing cases: • processing conducted solely for obtaining and using general-purpose analytical results that do not contain information linked to spe - cific individuals, such as statistical compila - tions; • processing conducted in a manner that is not contrary to data subjects’ intentions based on the circumstances of acquisition; and • processing personal data to protect life or improve public health where reasonable grounds exist for not obtaining data subject consent. Data breach notification requirements Currently, the APPI requires businesses to report to the PPC and notify data subjects of certain types of data breaches (Article 26). When sen - sitive personal data such as race, medical his - tory or criminal record is involved, or when data breaches occur due to unauthorised third-party access, businesses must report to the PPC and notify data subjects even if only one data subject is affected. However, there are concerns that it might be excessive to require reports and notifications in all such cases. Therefore, the Interim Report and Next Steps propose reasonably limiting the scope and con - tent of reporting and notification based on the degree of risk to data subjects’ rights and inter - ests. Proposals include: • partially exempting businesses with appropri - ate systems and procedures for handling data breaches from the PPC reporting obligations;
267 CHAMBERS.COM
Powered by FlippingBook