Amendments to the Act on the Protection of Personal Information

With the rapid advance of digitalization, companies are now processing personal information outside of Japan. However, many users are not aware that their personal information collected in connection with these services is processed outside of Japan. There are also cases where companies providing such services are not apprised in relation to processing of data under foreign data processing systems or through other foreign companies.

To protect the rights and interests of individuals, the Act on the Protection of Personal Information of Japan (“APPI”), as well as privacy laws in other countries, such as the GDPR in the EU, are becoming stricter. Under these stricter privacy laws, mere explanations by companies about how they handle data, alone, are now considered insufficient, and by extension, services provided by such companies could be considered unacceptable from a data protection perspective.

In Japan, companies are now required to give more in-depth explanations as to how they gather and process personal data, as well as the protection measures and systems in place. In order to properly explain how personal information is transferred and handled outside of Japan, it is necessary for such companies to have an understanding of the data protection and privacy laws of other countries (e.g., the GDPR), and to be apprised of the data handling status of foreign companies.

To meet this new challenge, it is important to understand the guidelines of the Personal Information Protection Commission (“PPC”), and in order to communicate effectively with overseas companies, it is necessary to be aware of the differences between the provisions of the GDPR and APPI. However, it is not possible to address this issue by simply providing an overview of the APPI. Therefore, in this newsletter series, we will present the views of former PPC member, Haruhi Kumazawa, as well analysis from our Frankfurt Office.