Japan's PIPA Overhaul: Key Changes to the Personal Information Protection Act

Japanese Attorney at Law - Bengoshi L.L.

• 11 min read

Japan's Act on the Protection of Personal Information (APPI or PIPA, 個人情報保護法 - kojin jōhō hogo hō) stands as the central pillar of the nation's data privacy framework. Originally enacted in 2003 and fully enforced in 2005, the APPI underwent its first significant overhaul through amendments passed in 2015, which became fully effective on May 30, 2017. This landmark reform was necessitated by a decade of rapid advancements in information and communication technologies (ICT), the globalization of data flows, and the burgeoning era of big data analytics. The amendments aimed to strike a delicate balance: bolstering the protection of personal information while simultaneously fostering an environment conducive to the responsible utilization of data for innovation and economic growth. This article provides an in-depth analysis of the key changes introduced by these amendments and their implications.

Drivers for the APPI Amendments

The decision to comprehensively revise the APPI after a decade of its enforcement stemmed from a recognition that the digital landscape had profoundly transformed. Key drivers included:

  • Technological Evolution: The widespread adoption of smartphones, the proliferation of social networking services (SNS), and the extensive use of cloud computing had led to an exponential increase in the volume and velocity of personal data being generated and circulated. This, in turn, amplified the risks of data breaches and misuse.
  • New Frontiers in Data Utilization: The emergence of big data analytics opened up unprecedented opportunities for deriving valuable insights from large datasets. However, the existing legal framework needed to be updated to provide clearer rules for how such data could be used beneficially while safeguarding individual privacy.
  • Dual Legislative Objectives: The reform efforts were guided by two primary goals: firstly, to strengthen the protection afforded to personal information in light of new technological risks and societal expectations; and secondly, to establish rules that would enable and promote the legitimate use of personal data (including appropriately processed data) to fuel new industries, create innovative services, and contribute to the overall safety and well-being of the public.

Core Revisions and Their Implications

The 2015 amendments introduced a wide array of changes, touching upon fundamental definitions, regulatory oversight, rules for data handling and utilization, and provisions for international data transfers.

A. Clarification and Expansion of "Personal Information" Definitions

One of the most fundamental aspects of the reform was the refinement and expansion of what constitutes "personal information" under the Act.

  • Redefined "Personal Information" (個人情報 - kojin jōhō): The Act (APPI Art. 2(1)) now defines personal information as information relating to a living individual that can either (a) identify a specific individual by name, date of birth, or other description contained in such information, or (b) contains a "Personal Identification Code".
  • Introduction of "Personal Identification Codes" (個人識別符号 - kojin shikibetsu fugō): This new category (APPI Art. 2(2)) was introduced to bring clarity to certain types of data that, by their nature, can identify an individual. These codes fall into two types:
    1. Codes derived from an individual's physical characteristics and converted for computer use, such as fingerprint data, palm vein patterns, voiceprint data, and DNA sequence information.
    2. Codes uniquely assigned to individuals in relation to the provision of services or goods, such as passport numbers, driver's license numbers, basic pension numbers, health insurance card numbers, and Japan's individual identification number, known as "My Number".
      The inclusion of these codes means that any data containing them is unequivocally treated as personal information, resolving previous ambiguities.
  • Establishment of "Special Care-Required Personal Information" (要配慮個人情報 - yō-hairyō kojin jōhō): Similar to the concept of "sensitive personal data" in other data protection regimes like the GDPR, this category (APPI Art. 2(3)) encompasses information that, if mishandled, could lead to unjust discrimination, prejudice, or other disadvantages. This includes information concerning an individual's race, creed, social status, medical history, criminal record, and status as a victim of a crime. The Act mandates stricter handling for such information, principally requiring explicit consent from the individual for its acquisition and, with limited exceptions, for its provision to third parties. The "opt-out" mechanism generally available for other types of personal data cannot be used for special care-required personal information.
  • Clarification of "Personal Information Database, etc." (個人情報データベース等 - kojin jōhō dētabēsu tō): This term (APPI Art. 2(4)) refers to a collective body of information including personal information that is systematically organized so that specific personal information can be easily retrieved, whether in electronic or paper format. The amendments clarified certain exclusions, such as publicly available information like telephone directories or commercially sold maps, provided they are used for their original purpose without adding other personal information that would allow for easier identification of individuals.

B. Establishment of the Personal Information Protection Commission (PPC)

A pivotal change was the establishment of the Personal Information Protection Commission (PPC - 個人情報保護委員会 - kojin jōhō hogo iinkai) as an independent data protection authority. Formally launched on January 1, 2016, the PPC evolved from the Specific Personal Information Protection Commission (which was initially created under the My Number Act).
The PPC operates under the authority of the Prime Minister but is designed to function independently. Its mandate (APPI Art. 59) is to ensure the proper handling and protection of personal information (including My Number data) while also giving due consideration to its useful and beneficial applications. This move centralized the oversight and enforcement of the APPI, which was previously dispersed among various government ministries responsible for different business sectors. This centralization is intended to promote more consistent interpretation and vigorous enforcement of the law. The PPC's powers include issuing guidance and recommendations, ordering corrective actions, conducting on-site inspections, requesting reports from businesses, and accrediting private-sector organizations to carry out personal information protection activities.

C. Facilitating Data Utilization Under Appropriate Rules

While strengthening protections, the amendments also sought to provide clearer pathways for the legitimate utilization of data, particularly in the context of big data analytics and innovation.

  • Relaxation of Restrictions on Changing the Purpose of Use (利用目的の制限の緩和 - riyō mokuteki no seigen no kanwa): Businesses are required to specify the purpose for which they collect and use personal information. The amended APPI (Art. 15(2)) eased the conditions under which this specified purpose can be changed. Previously, a change required a "considerable relevance" (相当の関連性) to the original purpose. The new standard requires only "relevance" (関連性), provided that the change remains within a scope that a data subject could reasonably anticipate, judging from an ordinary person's perspective. While this offers more flexibility, businesses are still obligated to notify the data subject of the changed purpose or make a public announcement to that effect (APPI Art. 18(3)).
  • Introduction of "Anonymously Processed Information" (匿名加工情報 - tokumei kakō jōhō): This was a significant new concept introduced by the amendments (APPI Art. 2(9)) designed to facilitate the use of big data. Anonymously processed information is created by processing personal information in such a way that the specific individual cannot be re-identified and the original personal information cannot be restored. Businesses that create or handle such information must adhere to specific processing standards and security measures stipulated by the PPC. Once information meets the criteria for anonymously processed information, it can be used for broader purposes and provided to third parties without the individual's consent, provided certain conditions are met (such as public announcement of the data items included in the anonymized dataset and notification to the recipient that the data is anonymously processed). This framework aims to unlock the value in large datasets for research, product development, and other innovations while mitigating privacy risks.

D. Ensuring Appropriate Handling and Circulation of Personal Information

The amendments introduced several measures to enhance the security and accountability surrounding the handling and transfer of personal data.

  • Stricter Rules for "Opt-Out" Third-Party Provision (オプトアウト規定の厳格化 - oputoauto kitei no genkakuka): The APPI allows businesses to provide personal data to third parties without obtaining specific consent from each individual if they meet "opt-out" conditions. These conditions include notifying the individuals (or making information readily accessible to them) about the intended third-party provision and offering them an easy way to request that their data not be shared. The 2015 amendments added a significant new requirement: businesses intending to use this opt-out mechanism must now file a notification with the PPC in advance (APPI Art. 23(2)). This measure increases transparency and allows for greater regulatory oversight of opt-out practices. It's important to note that the opt-out route cannot be used for special care-required personal information or for personal data that was itself received via an opt-out transfer.
  • Introduction of Traceability (Record-Keeping) Requirements (トレーサビリティの確保 - torēsabiriti no kakuho): To improve the accountability of data flows, particularly in third-party transfers, the amended APPI (Arts. 25 and 26) mandates that businesses create and retain records when they provide personal data to, or receive it from, a third party. These records must generally include information such as the date of the transfer, the names of the provider and recipient, and the categories of personal data transferred. This requirement is aimed at making it easier to trace the path of personal data, which can be crucial in investigating data breaches or combating the illicit trade of personal information by data brokers.
  • Creation of a Crime for Illicit Provision of Personal Information Databases (データベース提供罪の創設 - dētabēsu teikyōzai no sōsetsu): The amendments introduced a new criminal offense (APPI Art. 83) targeting the unauthorized provision or theft of a "personal information database, etc." that is handled in the course of business, where such an act is done for the purpose of securing an illicit gain for oneself or a third party. This provision directly addresses a gap in the previous legal framework, where such actions might not have been directly punishable unless they also constituted other existing crimes like theft or embezzlement. The offense carries penalties of imprisonment for up to one year or a fine of up to JPY 500,000. Importantly, this provision can apply not only to the individuals who commit the act but also to the corporation they work for, under dual liability rules (APPI Art. 87).

E. Provisions for the Globalization of Personal Information Handling

Recognizing the increasingly international nature of data flows driven by globalized economic activity and the widespread use of ICT, the amendments incorporated provisions to address cross-border data transfers and international cooperation.

  • Government's Role in International Consistency: The APPI (Art. 6) now explicitly states that the Japanese government shall take necessary measures to establish an internationally consistent system for personal information protection through cooperation with international organizations and other relevant international frameworks.
  • Restrictions on Cross-Border Transfers to Third Countries (外国にある第三者への提供の制限 - gaikoku ni aru daisansha e no teikyō no seigen): A cornerstone of the international provisions is APPI Art. 24, which generally requires a data subject's prior consent to transfer their personal data to a third party located in a foreign country. However, consent is not required if:
    1. The foreign country has been designated by the PPC as having a personal information protection system recognized as being at an equivalent level to that of Japan (an "adequacy decision").
    2. The third-party recipient in the foreign country has established a system that ensures they will continuously take measures equivalent to those required of personal information handling business operators in Japan. This can typically be achieved through contractual agreements (such as standard contractual clauses) or intra-group rules (akin to Binding Corporate Rules).
      The business operator must take necessary measures to ensure the continuous implementation of those equivalent measures by the third party and, upon request by the data subject, provide information on those measures.
  • Clarification of Extraterritorial Application (域外適用される規定の明示 - ikigai tekiyō sareru kitei no meiji): The amended APPI (Art. 75) clarifies that certain of its provisions apply to business operators located outside Japan if they handle the personal information of individuals in Japan in connection with the offering of goods or services to those individuals, or if they otherwise monitor individuals in Japan. This aligns Japan's approach more closely with international trends in asserting jurisdiction over foreign entities processing local residents' data.
  • Information Provision to Foreign Enforcement Authorities (外国執行当局への情報提供 - gaikoku shikkō tōkyoku e no jōhō teikyō): To facilitate international cooperation in enforcement, the PPC is empowered (APPI Art. 78) to provide information to foreign data protection authorities, subject to certain conditions and safeguards.
  • Expansion of Scope for Punishing Offenses Committed Abroad (国外犯処罰の範囲拡大 - kokugaihan shobatsu no han'i kakudai): Certain penal provisions of the APPI (e.g., the illicit database provision crime) have been extended to apply to offenses committed outside of Japan (APPI Art. 86).

F. Abolition of Exemption for Small-Scale Handlers

Perhaps one of the most impactful changes for many businesses was the abolition of the exemption for "small-scale handlers". Under the previous APPI, businesses that, on any day in the preceding six months, handled the personal information of 5,000 or fewer individuals were exempt from most of the Act's obligations. The 2015 amendments eliminated this exemption entirely. This decision was driven by the understanding that even improper handling of a small number of personal records can cause significant harm to individuals, and that the ease of digital data processing meant that even small entities could accumulate and process substantial amounts of personal information. Consequently, all businesses in Japan that handle personal information, regardless of their size or the volume of data they process, are now subject to the full scope of the APPI.

G. Enhancement of Data Subject Rights

The APPI has always provided individuals with certain rights concerning their "retained personal data" (保有個人データ - hoyū kojin dēta). This term refers to personal data that a business operator has the authority to disclose, correct, add to, or delete, and which is not expected to be deleted within a period of not more than one year (this period was changed from 6 months by subsequent amendments in 2020, but was 6 months at the time of the 2015 amendments). Business operators are obliged to publicly disclose certain information about their handling of retained personal data (APPI Art. 27(1)). The 2015 amendments served to clarify and, in some respects, strengthen these individual rights, making them more explicit as "requests" (請求 - seikyū) that individuals can make. These include the right to:

  • Request notification of the purpose(s) for which their retained personal data is being used (APPI Art. 27(2)).
  • Request disclosure of their retained personal data (APPI Art. 28).
  • Request correction, addition, or deletion of their retained personal data if it is inaccurate (APPI Art. 29).
  • Request cessation of use or erasure of their retained personal data, and cessation of its provision to third parties, under certain conditions, such as if the data was unlawfully acquired, is being used beyond its specified purpose, was unlawfully provided to a third party, is no longer necessary, a major data breach has occurred, or if the individual's rights or legitimate interests are likely to be harmed by its continued handling (APPI Art. 30).

Practical Implications for Businesses Operating in Japan

The 2015 amendments to the APPI have had wide-ranging practical implications for any organization that handles the personal information of individuals in Japan. Key takeaways include:

  • Comprehensive Policy Review: Businesses needed to undertake a thorough review and update of their internal data handling policies, procedures, and data inventories to align with the new definitions and requirements.
  • Consent Mechanisms: Enhanced scrutiny is required for consent mechanisms, especially for acquiring special care-required personal information and for justifying cross-border data transfers.
  • Traceability Systems: Implementation of systems and processes to create and maintain records of third-party data transfers became necessary.
  • Anonymously Processed Information: Organizations choosing to utilize the framework for anonymously processed information must develop robust processes for anonymization that meet PPC standards and for managing this distinct category of data.
  • Enhanced Security and Incident Response: A renewed focus on strengthening data security measures and ensuring that data breach incident response plans are comprehensive and effective.
  • Employee Training: Ongoing training for employees on the updated APPI requirements is crucial to ensure day-to-day compliance.
  • Universal Applicability: Businesses that were previously exempt due to their small scale now need to ensure full compliance with all aspects of the APPI.

Conclusion: Navigating Japan's Strengthened Data Privacy Regime

The 2015 amendments to Japan's Act on the Protection of Personal Information mark a significant maturation of the country's data privacy framework. They reflect a concerted effort to adapt to the realities of a data-driven global economy, aiming to enhance individual privacy protections while also providing clearer pathways for the beneficial use of data and fostering international interoperability. For businesses, both domestic and international, that handle the personal information of individuals in Japan, diligent attention to these strengthened rules is paramount. Compliance is not only a legal obligation but also a key factor in building and maintaining trust with customers, employees, and regulatory authorities like the increasingly influential Personal Information Protection Commission. As data continues to be a vital asset, navigating this evolving regime with care and foresight will be essential for sustainable success in the Japanese market.