Anderson Mori & Tomotsune Special Counsel Takashi Nakazaki has a wide-ranging background in technology law, including specialization on privacy matters. Nakazaki's privacy work includes helping clients establish and update their privacy policies, data-processing rules and technical and organizational security measures.

Nakazaki has also been a leading privacy and IAPP advocate in Japan since 2014. For the IAPP, he was one of the founding members of the KnowledgeNet chapter in Tokyo, organizing meetings and events as its co-chair until 2019. Additionally, Nakazaki has spoken at numerous IAPP international events.

In this Volunteer Spotlight, Nakazaki provides a deeper look into his work, thoughts on amendments to Japan's privacy law and what he is looking forward to on Japan's privacy scene.

The Privacy Advisor: Talk about the privacy matters that you’re currently working on. Any particular focus at this time?

Nakazaki: Many Japanese companies have introduced remote work under the COVID-19 pandemic, and it might cause data security issues. To avoid data breaches, employers want to monitor employees’ working situations during remote work, which might cause invasions of privacy. With these potential data breach cases, I advise clients on how to make notifications to the data protection authorities, affected people and then announcements to the general public. 

I'm also focused on advising clients on how to utilize personal data legally. Many Japanese companies intend to collect and utilize customer data for marketing activities, including utilizing cookies. It is not clear whether cookies are protected as personal data under Japanese law, and there are no clear standards for utilizing cookies for marketing activities, which all differ from the EU General Data Protection Regulation. I regularly advise them from the viewpoint of not only the legal perspective, but also risk approach perspective.

The Privacy Advisor: How has Japan’s privacy regime been affected by COVID-19? Any specific examples of positive or negative changes that have shown up?

Nakazaki: The Personal Information Protection Commission clarified the interpretation of implied consent when a hospital intends to transfer a patient and disclose the relevant patient’s personal information to another hospital. The interpretation was issued since only specialized hospitals have capabilities to cure COVID-19 patients, and it was difficult to obtain the patient’s consent in many cases. The interpretation clarified the typical instances for a hospital to obtain the implied consent of a patient and the exceptions that allow a hospital to disclose patient information without obtaining a patient’s consent.

The Privacy Advisor: It was recently revealed Japanese police are employing facial recognition in some investigations. As a privacy professional, what’s your stance or best advice on the proper use of this technology by law enforcement?

Nakazaki: Japanese police have not relied much on investigations that utilize advanced technologies so far, and it should be welcomed to employ facial recognition. From the privacy protection viewpoint, it is important to limit storing facial recognition data and utilization purposes.

The Privacy Advisor: In June, Japan enacted amendments to the Act on the Protection of Personal Information. What are your thoughts on those updates to the law, and are there any changes or additions to the law you’d like to see made in the future?

Nakazaki: The amendment introduces a new concept of personal related information, which is not protected as personal information by itself but would be subject to legal protection under certain conditions. It would regulate the utilization of online identifiers, such as cookies for marketing activities, and affect online advertising business, including targeted advertising.

Also, the amendment makes it easier for individuals to demand that business operators stop utilizing their personal data. Under current law, even if the personal data was fraudulently obtained, users may seek to stop the use of their personal information or have information deleted only if the company bears some fault.

The amendment would allow users to demand the cessation of the utilization of their personal data when their personal rights and interests are at risk of harm, such as when data is stored even after the business operator has finished using it for its stated purposes. It would increase requests to stop utilizing personal information for business purposes, and Japanese companies would have to pay more cost to update operations and database systems to respond to such requests adequately.

On the other hand, the amendment introduces the concept of pseudonymized data. Many Japanese companies pseudonymize customer personal information for security reasons, and the new concept would reduce the burden of them.

The Privacy Advisor: Aside from everything we are talking about above, what is maybe the most overlooked privacy topic in Japan right now, and why isn’t it being discussed more?

Nakazaki: After Prime Minister Shinzo Abe resigned and new Prime Minister Yoshihide Suga entered office in September, the government announced that they plan to establish a new department for digital government issues. The government intends to share personal data among various government departments through "My Number," a Social Security and tax number identification allocated to each Japanese citizen. The plan might bring a discussion on privacy protection in the near future.

Photo by Keagan Henman on Unsplash