Japan: Act on the Protection of Personal Information
The APPI (2003, with major 2017 and 2022 amendments) is enforced by the Personal Information Protection Commission (PPC).
Key concepts
Personal information versus personal data (held in a database) versus retained personal data. Specially care-required personal information includes race, creed, social status, medical history, and criminal record. The 2022 amendments added pseudonymized and anonymized information categories and mandatory breach reporting.
Obligations
Specify and publicize the purpose; limit purpose; secure data; supervise employees and contractors; respond to disclosure, correction, and cessation requests for retained personal data; and obtain consent for third-party provision, except an opt-out filed with the PPC for non-sensitive data. Cross-border: consent unless the PPC designates the destination as adequate (the EU/EEA and the UK) or the recipient maintains appropriate measures; since 2022, consent must include information about the destination's legal system.
Breach notification
Notify the PPC and affected individuals for leaks of specially care-required data, leaks affecting 1,000 or more individuals, or risk of harm.
Worked example
A Japanese firm transfers HR data to its US parent. The US is not PPC-designated, so consent is needed with destination information, or a contract with appropriate measures plus information to data subjects. The opt-out cannot be used for specially care-required data.
Traps
- Treating an EU adequacy decision as a global passport.
- Using the opt-out for sensitive data.
- Confusing access rights, which attach to retained personal data only.