Joint Use, Special Care Data, and a Lost USB in Tokyo
Sakura Mobility K.K. is the Tokyo subsidiary of a German mobility group and employs 800 people in Japan. The group wants all HR records - contracts, payroll, absence data, and annual health-check results for 300 employees - loaded into a platform hosted in Frankfurt and administered by the German parent. Sakura plans to treat the arrangement as joint use with the parent rather than a third-party transfer, and to skip individual consents because 'Germany is an adequate country'. A separate US vendor will run engagement surveys using pseudonymous IDs that the parent can re-link to individuals. In April an employee, Ms Ito, requested disclosure of her performance evaluation and the scoring criteria, and correction of two narrative comments she says are wrong; HR replied that the file would be sent within two months and that the criteria are confidential. On 3 May a manager lost an unencrypted USB stick holding 1,200 employees' records, including the 300 health-check results; it was recovered from a car park two days later and may have been read.
1. Is the German arrangement properly characterised as joint use, and what does that mean for consent and cross-border transfer?
Read the worked answer
The label does not decide it. Joint use applies where the parent and Sakura jointly determine the purpose and effectively use the data as a single entity's data. If the parent uses the data for its own group purposes beyond the notified scope, it becomes a third-party transfer and the joint-use structure collapses.
Conditions for joint use. Sakura must notify individuals, or place the information in an easily accessible state, of the fact of joint use, the items of data, the scope of joint users, the purpose of use, and the name of the party responsible for managing the data; individuals must be able to make requests to that party. HR should also check that the purpose of use has been properly notified to employees.
Special care-required data. Health-check results are special care-required personal information. Acquiring them requires prior consent, and they can never be routed to a third party through the opt-out route.
Cross-border. Germany sits within the EU/EEA, which the PPC designates as having adequate protection, so the prior-consent requirement for an overseas third-party transfer is not engaged by the transfer itself. That is not a blanket exemption: consent is still needed for acquiring and using the health data, and the US survey vendor is a third party in a non-designated country requiring consent or an APPI-equivalent framework. Safest structure: specific consent for the health data, joint-use notices for the rest, and Article 28(2) reference information for the US vendor.
2. How should Sakura handle Ms Ito's disclosure and correction request, and is 'confidential criteria' a valid refusal ground?
Read the worked answer
Disclosure. Under the APPI, Sakura must disclose retained personal data to the individual without delay and in writing. Two months is not defensible on these facts. The evaluation scores and narrative comments about Ms Ito are her personal data, and she is entitled to be told the purpose of use if that was not already notified.
Refusal grounds are narrow. The permitted grounds include a risk of harm to the life, body, property or other rights of the individual or a third party, and a risk of significant interference with the proper execution of the business, together with a small number of other prescribed cases. 'The criteria are confidential' is not itself a ground. The company would have to show that disclosure of the criteria would seriously undermine the evaluation process or harm others, and even then it must give reasons in writing. A refusal without reasons is exactly what generates a PPC inquiry.
Correction. Where the data is factually incorrect, correction must be made to the extent necessary; if the company declines, it must explain why. Opinion-based assessment is not 'incorrect' merely because the employee disagrees - but a factual error in a narrative comment is correctable.
Records. Keep a record of the request, the decision, the reasoning and the date, which is also the evidence a regulator asks for.
3. What are Sakura's breach notification obligations after the USB loss, and to whom?
Read the worked answer
Report to the PPC. The 2022 amendments introduced mandatory two-stage reporting. A preliminary report must be made promptly and within 3 days of becoming aware - here by 6 May - and a final report within 30 days, extended to 60 days where improper use is involved. The trigger is not confirmation that data was read: the loss of a device holding special care-required data is itself a reportable event.
Notify individuals. Notification to affected individuals is required where the breach involves special care-required personal information, where there is a risk of property damage, or where the data was used for an improper purpose. The 300 health-check results fall squarely within the first limb, so those employees must be told even though the stick was recovered, because unauthorised access cannot be excluded.
Content and evidence. Describe what happened, the data items, the likely cause, the contact point and mitigation, and note that the device was unencrypted - that is itself a security-safeguards finding that will shape the PPC's remedial guidance. Identify why the data was on removable media at all.
Internal. Tell the German parent under group policy, but the APPI filing duty belongs to Sakura as the Japanese business operator handling the information. Record the decision-making timeline for both reports.