On June 12 2020, the amendment of the Act on the Protection of Personal Information was promulgated.
The amended act will strengthen restrictions on the provision of personal data to third parties in countries other than Japan (foreign countries).
Under the Act on the Protection of Personal Information (before the amendment), if a business operator which uses personal information databases for its business (business operator) provides personal data to third parties in foreign countries, the business operator is required to obtain the person’s consent, except in the following cases:
where the third party is in a foreign country that is designated as providing the same degree of personal information protection as in Japan;
where the third party has developed a system for taking measures, on a continuous basis, that are equivalent to those required to be taken by a business operator under the Act on the Protection of Personal Information (‘equivalent measures’);
where the provision of personal data is based on laws and regulations, and where it is necessary for the protection of life, body or property and difficult to obtain the consent of the person etc.
The amended act stipulates that when providing personal data to third parties in foreign countries based on the consent of a person, the business operator must provide the following information to the person before obtaining the consent of the person: systems for the protection of personal information in such foreign country; measures for the protection of personal information taken by such third party; and other information that will be helpful to the person.
In addition, the amended act stipulates that when providing personal data to a third party in a foreign country on the grounds that the third party has developed a system to take the ‘equivalent measures’, the following measures shall be taken:
taking necessary measures to ensure the continuous implementation of the equivalent measures by such third party;
providing information on such necessary measures to the person at the person’s request.
The amended act will be effective by June 2022. Related Guidelines and a Q&A are expected to be published subsequently. Interested parties should keep a close eye on developments.
Naoya Matsuo, Nagashima Ohno & Tsunematsu