On June 5, the law amending the Act on the Protection of Personal Information was enacted. After the Cabinet order and rules of the Personal Information Protection Commission regarding the amendments are made, the new law is expected to take effect in the first half of 2022 or last quarter of 2021, although it is not clear exactly when.
The Diet passed the bill “as is.” For an outline of the amendments, please see our article published in March. In this article, we will focus on the amendments to the current privacy policy.
Elements covered in privacy policies under the current APPI
Practically speaking, a business operator’s privacy policy must cover the following elements under the requirements of the current APPI.
Notification or publication of purposes of use of personal information
Under the APPI, a notification or publication, which may be done through a privacy policy, of the purposes of use of personal information is required if personal data is collected. Please note that in the case of a collection of personal information stated in a written document, including an electromagnetic record, directly from data subjects, showing the purposes of use explicitly to data subjects is required, and mere publication of a privacy policy will not suffice; however, an operator may explicitly show its privacy policy, which includes the purposes of use, to meet this requirement.
Elements to be made available to data subjects regarding 'retained personal data'
Under the APPI, a business operator must make the following elements regarding “retained personal data” available to data subjects, which in practice, is done through a privacy policy:
- The name of the business operator.
- The purpose for which the business operator uses personal information.
- The procedure that the data subjects should take to exercise their rights of disclosure; correction, addition or deletion; cessation of use or deletion; or cessation of provision to third parties, regarding retained personal data, including any fee to be paid.
- Those prescribed by Cabinet order as a necessary matter to ensure the proper handling of retained personal data.
The current Cabinet order prescribes contact information for complaints as noted in the last bullet point.
“Retained personal data” means personal data that a business operator has the authority to disclose; correct, add or delete; cease the use of or erase; or cease its provision to third parties. Under the current APPI, any personal data that is prearranged to be erased within six months from the acquisition is not "retained personal data" but the amendments removed the six-month qualification, thereby making any personal data "retained personal data" regardless of the data retention period.
Elements to be included in an operator’s policy under the PPC guideline
The PPC guideline states that it is important for a business operator to establish a policy as part of its security control measures and recommends the inclusion of certain elements, which the amendments did not change, such as:
- The name of the business operator.
- A statement that the business operator is complying with the APPI and any other applicable laws, regulations and guidelines.
- A statement that the business operator is taking necessary and appropriate measures for the security control of the personal data it is processing.
- Contact information for complaints and questions.
Information to be made available to data subjects in certain cases
Collection of sensitive data and provision of personal data to third parties
The current APPI generally requires the consent of data subjects for the collection of sensitive data, such as race and medical history. It also requires the consent of data subjects for the provision of personal data to third parties. In both instances, and especially when sensitive data is being collected indirectly, it is enough to refer to the sensitive data section of the privacy policy.
There are exceptions, including joint use and opt-out schemes for the provision of data to third parties. In addition, personal data can be provided to third parties without the consent of data subjects if certain information regarding joint use is notified or made easily available to data subjects or certain requirements of the opt-out scheme, including filing with the PPC and notifying or making certain information easily available to data subjects, are satisfied.
Overseas transfer of personal data
The current APPI requires the consent of data subjects for the transfer of data to third parties outside Japan unless certain exceptions are applicable. However, in seeking consent, it is enough to refer to the data transfer section of the privacy policy.
Anonymized personal information
After creating anonymized personal information and before providing anonymized personal information to third parties, certain information must be publicized, which can be done through a privacy policy. Anonymized personal information means information relating to an individual that can be produced through processing personal information such that, by taking actions prescribed in the APPI, a specific individual cannot be identified.
Additional elements to be covered in the privacy policy by the amendments
Elements to be made available to data subjects regarding 'retained personal data'
Under the amendments, business operators must publicize the following additional information regarding “retained personal data” to data subjects: the physical address of the business operator, name of the corporate representative (e.g., CEO), if the business operators are corporations, and the procedure that the data subjects should take to exercise their rights.
The amendments expand data subjects’ rights by allowing data subjects to exercise their rights when their rights and legitimate interests are likely to be infringed by the data processing of business operators. Data subjects will also be able to demand disclosure of records that data providers and data recipients must keep regarding the provision of personal data to third parties.
In addition, the current Cabinet order is expected to be amended to require the following elements to be publicized: a system for processing and safeguarding retained personal information and how retained personal data is processed.
Regarding a system for processing and safeguarding personal information, many companies already cite safeguards for personal data, but at this moment, it is not clear how much detail must be explained. Companies may need to make substantive amendments to their privacy policy if it does not explain how they process retained personal data. At this moment, it is not clear how much detail must be explained, and especially, companies may want to know how much they must explain if they are profiling data subjects. It is necessary to keep an eye on what will be stated in PPC’s guidelines.
Information to be made available to data subjects in certain cases
Pseudonymized information
The amendments introduced the concept of pseudonymized information and require the publication of its purposes of use. Pseudonymized information is information that can identify a specific individual only by collation with other information.
Provision of personal data to third parties
The amendments added certain information that must be notified or made easily available to data subjects for joint use or an opt-out scheme. They also introduced regulations for the provision of data that does not fall under the definition of personal data on the provider's side but is supposed to become personal data on the recipient's side. If the provider provides such data to third parties, it must confirm in advance that the recipient has obtained the consent of the data subjects regarding the recipient’s collection of their data as personal data. However, in seeking consent, the recipient may simply refer to the receipt of the personal data section of its privacy policy.
Data transfer to third parties outside Japan
The amendments strengthened current regulations on data transfers to third parties outside Japan. In the case of a transfer of personal data to third parties outside Japan based on data subjects’ consent, transferors must provide the data subjects with certain information to enable them to determine whether or not to provide consent. Additionally, the newly introduced regulations require the transferor to confirm that the transferee has informed the data subjects of the requirements, particularly when transferring data to third parties outside Japan.
What that certain information covers will be stipulated in the amended rules of the PPC, but the APPI amendments generally refer to information on the data protection system of the foreign country to which personal data will be transferred and the measures taken by the overseas data transferee to protect personal data, for example. However, in seeking consent, it is enough to refer to the data transfer section of the privacy policy.
Please note that the new regulations discussed in this section will only apply to overseas data transfers to be made after the effective date of the amendments.
Photo by Louie Martinez on Unsplash
