Japan's APPI amendment bill would open narrow lane for some AI uses, tighten rules elsewhere

Japan's Personal Information Protection Commission announced 7 April that the Cabinet of Japan approved a bill to amend the Act on the Protection of Personal Information. The PPC frames the package as accomplishing two things at once: facilitating data use, including artificial intelligence-related data use, while strengthening protection and enforcement where data handling creates greater risks for individuals. 

The bill, which does move in both directions simultaneously, is not a wholesale rewrite of Japan's privacy law, enacted in 2003. It is a targeted reform package, and a meaningful one.

Unlike the EU General Data Protection Regulation, which generally begins by asking what legal ground supports data processing, Japan's amendment bill does not try to import a new across-the-board lawful-basis model into the APPI. Instead, it works more surgically, by changing specific consent-sensitive parts of the APPI and building new rules around higher risk practices. 

Under Japan's private-sector framework, the more important questions are usually about purpose limitation, use beyond the stated purpose and rules on third-party sharing and overseas transfers. So, for most privacy teams, the more useful question is not whether Japan is moving closer to Europe. It is which APPI rules would be loosened, and which would get tougher under the amendment bill. 

A new statutory concept, not a free pass 

The most significant change is the introduction of a new statutory concept, "statistical processing," defined as the creation of statistics and similar analytical acts that derive trend- or characteristic-level information from large volumes of information, excluding information about individuals, where the activity is low risk to individuals' rights and interests.