[image] [image] Ressource protégée - Inria - Institut national de recherche en sciences et technologies du numérique [Accéder directement au contenu](#)

[image] [image]

* [Documentation](#)

* FR
  Français (FR)

* Anglais (EN)
  Se connecter

* [Portail HAL Inria](#)

* Recherche
  Loading...

## Recherche avancée

Information de documents

Titres

○ Titres

○ Sous-titre

○ Titre de l'ouvrage

○ Titre du volume (Série)

○ Champ de recherche par défaut (multicritères) + texte intégral des PDF

○ Résumé

○ Texte intégral indexé des documents PDF

○ Mots-clés

○ Type de document

○ Sous-type de document

○ Tous les identifiants du document

○ Identifiant HAL du dépôt

○ Langue du document (texte)

○ Pays (Texte)

○ Ville

○ À paraître (true ou false)

Ajouter
# Possible Utilization of Personal Data and Medical Care in Japan, Focusing on Japan's Act on Anonymously Processed Medical Information to Contribute to Medical Research and Development

Mayu Terada

<figure><img src="image_1.png" /></figure>

## To cite this version:

Mayu Terada. Possible Utilization of Personal Data and Medical Care in Japan, Focusing on Japan's Act on Anonymously Processed Medical Information to Contribute to Medical Research and Development. 15th IFIP International Conference on Human Choice and Computers (HCC), Sep 2022, Tokyo, Japan. pp.67-85, 10.1007/978-3-031-15688-5_7. hal-04395451

HAL Id: hal-04395451

https://inria.hal.science/hal-04395451v1

Submitted on 15 Jan 2024

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
## Auteur

### Auteur (multicritères)

○ Auteur (multicritères)

○ Auteur : Nom complet

○ Auteur : Nom de famille

○ Auteur : Prénom

○ Auteur : Complément de nom, deuxième prénom

○ Auteur : Organisme payeur

○ Auteur : IdHal (chaîne de caractères)

○ Auteur : Fonction

○ Auteur : personID (entier)

○ Auteur : Identifiant de l'organisme payeur

○ Auteur : Identifiant de la structure

○ Directeur de thèse

○ Éditeur

○ Éditeur scientifique

○ Éditeur de la série

## Ajouter

### Structure

### Structure (multicritères)

○ Structure (multicritères)

○ Structure : Acronyme

○ Structure : Nom

○ Structure : Code

○ Structure : Pays

○ Structure : Type

○ Structure : État dans le référentiel

○ Structure : Identifiant HAL de la structure

○ Structure/équipe de recherche : Pays

○ Structure/regroupement d'équipes : Pays

○ Structure/laboratoire : Pays

○ Structure/regroupement de laboratoires : Pays

○ Structure/institution : Pays

○ Structure/regroupement d'institutions : Pays

## Ajouter
<figure><img src="image_3.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
Autres

Champ de recherche par défaut (multicritères)

○ <u>Champ de recherche par défaut (multicritères)</u>

○

○ <u>Revues (multicritères)</u>

○ <u>Revue : Éditeur</u>

○ <u>Revue : Titre abrégé</u>

○ <u>Revue : Titre</u>

○ <u>Revue : Identifiant interne</u>

○ <u>Revue : Date de début de publication</u>

○ <u>Revue : ISSN électronique</u>

○ <u>Revue : ISSN</u>

○ <u>Revue : Éditeur</u>

○ <u>Revue : Couleur dans SHERPA/RoMEO</u>

○ <u>Revue : État dans le référentiel</u>

○

○ <u>Colloque (multicritères)</u>

○ <u>Colloque : Titre</u>

○ <u>Colloque : Organisateur</u>

○ <u>Colloque : date de début (Année)</u>

○ <u>Colloque : date de fin (Année)</u>

○ <u>Conférence invitée (oui/non)</u>

○

○ <u>Projets ANR (multicritères)</u>

○ <u>Projet ANR : Acronyme</u>

○ <u>Projet ANR : Acronyme du programme</u>

○ <u>Projet ANR : Code décision (référence)</u>

○ <u>Projet ANR : Nom</u>

○ <u>Projet ANR : Identifiant interne</u>

○ <u>Projet ANR : État dans le référentiel</u>

○

○ <u>Projets européens (multicritères)</u>

○ <u>Projet européen : Acronyme</u>

○ <u>Projet européen : Identifiant de l'appel à projet</u>

○ <u>Projet européen : Référence</u>

○ <u>Projet européen : Nom</u>

○ <u>Projet européen : Date de fin</u>

○ <u>Projet européen : Financement</u>

○ <u>Projet européen : Date de début</u>
Possible Utilization of Personal Data and Medical Care in
Japan, Focusing on Japan's Act on Anonymously
Processed Medical Information to Contribute to Medical
Research and Development

Mayu Terada¹²

¹ Senior Associate Professor, International Christian University, 3-10-2 Osawa Mitaka Tokyo
181-0015 Japan

² Visiting Scientist, RIKEN AIP, Nihonbashi 1-chome Mitsui Building, 15th floor, 1-4-1 Nihonbashi, Chuo-ku, Tokyo 103-0027, Japan
tmayu@icu.ac.jp

**Abstract.** In Japan, there is no special law for the comprehensive utilization of personal data in the medical field, and a comprehensive legal system has been lacking for decades. This paper examines the background and issues of the cancer registration law specific to cancer and the legal structure of medical information in Japan and points out that one of the problems that has become clear in dealing with COVID-19 is the difficulty of handling the complicated system of anonymously processed information and the difficulty of using it for the purpose. The report also points out that the Medical Big Data Law, which is also based on the premise of anonymous use, has a complex mechanism in addition to that of the Personal Information Protection Law. A system to certify certification bodies and other protection measures will be introduced yesterday, but before examining the specifics of anonymization, it is necessary to establish a fundamental system that enables the use of more basic information in a way that can be easily understood by healthcare professionals. In conclusion, this paper points out that in the future, while protecting personal information, it will be useful to reorganize it into a special law that is easier to understand from a comprehensive point of view, and to construct a law that makes medical information available to contribute to medical research and development, to reduce the increase in medical costs.

**Keywords:** Utilization of Personal Data, Medical Information, Medical Big Data.
○ Projet européen : État dans le référentiel

○ Projet européen : Identifiant interne

○

○ Date de production : année

○ Date de mise en ligne : année

○ Date de publication : année

○ Date d'écriture : année

○ Date de modification du dépôt : année

○ Date de dépôt : année

○ Date de publication électronique : année

○

○ Collection HAL (multicritères)

○ Collection HAL : catégorie

○ Collection HAL : Code

○ Collection HAL : Nom

○ Collection HAL : Identifiant interne

○

○ Identifiant interne du contributeur/déposant

○ Nom complet du contributeur/déposant

○

○ Domaines

○ Domaine primaire

○ Domaine racine

○ Sous-domaine niveau 1

○ Sous-domaine niveau 2

○ Sous-domaine niveau 3

○

○ Statut du document

○ Version du document

○ Type de dépôt

○ Type de document

○ ISBN

○ Numéro - référence

○ Identifiant DOI

○

○ Classification

○ Audience

○ Vulgarisation

○ Comité de lecture - texte (oui ou non)

○ Actes de colloque
# 1 Introduction

Until now, a comprehensive legal system on the utilization of personal information in the medical field is lacking in Japan<fnref n="1" />. And it is heavily discussed as a problem to hinder the utilization and development of various knowledge of the medical field<fnref n="2" />.

In response to COVID-19 (new coronavirus infection), these problems have become apparent because the Japanese medical system and the protection of personal information are insufficient<fnref n="3" />. As will be seen later, Japan is currently collecting various medical information on a request basis, and many points have been raised from the viewpoint of the effectiveness of regulations and the future use of information.

For example, it has been pointed out that there is not enough data to determine the cost of medical care in our country.

Therefore, in this paper, current situation of Japanese law on medical big data including the handling of medical data in an emergency such as COVID-19 is reviewed<fnref n="4" />. Specifically, the current situation in Japan where there have been no regulations on personal information in the medical field is introduced, and the so-called "accreditation body" enacted under the Act on Anonymously Processed Medical Information<fnref n="5" /> to contribute to research and development in the medical field is considered. Then, issues related to the development of regulations on the handling of personal information in the medical field in Japan is discussed, while referring to the regulations in Europe and other countries to the extent possible.

# 2 Current Situation on Privacy Law and Medical Care in Japan

## 2.1 Personal Data Protection Law

In recent years in Japan, various regulations have been put in place regarding personal information in general, including reorganization into the Personal Information Protec-

<footnote n="1">¹ Japan's Kantei (the prime minister's official residence) website, The Healthcare Policy and The New System of Medical R&D, https://www.kantei.go.jp/jp/singi/kenkouiryou/en/pdf/doc1.pdf.</footnote>

<footnote n="2">² Fumio Shimpo, The revised Japanese Personal Information Protection Act and the utilization of Big Data from Medical Records, Igaku no Ayumi, vol. 259, No.7, at 787-791. See also, George Shishido, 'Personal Information Protection Law and Privacy: For the Cross-linking of Medical Affairs Law and Information Law (Records of the 48 Annual Meeting of the Medical Affairs Law Society) -- (Symposium Frontier of Medical Information), Medical Law (34), at 87-96, (2019).</footnote>

<footnote n="3">³ Shimpo, above note 2, at 790-791.</footnote>

<footnote n="4">⁴ Shimpo, above note 2, at 789-791.</footnote>

<footnote n="5">⁵ It is also described a Next Generation Medical Infrastructure Bill.</footnote>
○ Référence interne

○ Financement

○ Collaborations

Ajouter

Lancer la recherche

Recherche experte (SolR)

Recherche experte (SolR)

Lancer la recherche
Vers la recherche avancée

• Déposer

Portail INRIA.HAL.SCIENCE
Les publications, logiciels... des scientifiques Inria

• Accueil

• Publications Inria

○ Consulter les derniers dépôts

○ Par équipe de recherche

○ Par auteur

○ Rapports de recherche et techniques

○ Livres blancs

○ Rapports d'activité des équipes

○ Statistiques

• Boite à Outils

○ X2Hal : importer par lot

○ Logiciels : créer le Codemeta.json

○ Créer mon IDHal

○ Créer mon CVHal

○ Haltools : créer ma page de publications

○ Haltools : extraire des données (réservé Inria)

○ Les bonnes pratiques

■ Comment bien s'affilier ?
tion Commission<fnref n="6" />. The Act on the Protection of Personal Information revised in 2015⁷, the Act on the Protection of Personal Information Held by Administrative Organs was revised in 2016⁸, and the Act on the Protection of Personal Information Held by Incorporated Administrative Agencies came into full force on May 30, 2017⁹. Plus, major revisions were made in 2019 and 2020, and the 2020 revision is expected to be a major reform of the personal information protection system<fnref n="10" />.

In particular, the 2015 revised Personal Information Protection Law in Japan created a new "anonymously processed information" framework. The idea of anonymously processed information is that after personal data is processed to become "anonymously processed information", it can be used with flexibility<fnref n="11" />. However, in the first place, the Act on the Protection of Personal Information requires the handling of medical records (history of illness), results of medical and genetic examinations as equivalent to medical records, health guidance, medical examination and prescription information, etc. in a particularly careful manner, stating that "Special care-required personal information"<fnref n="12" />. Therefore, in the medical field, it has been pointed out that it may not be possible to utilize personal information in the fields of community comprehensive care and home care<fnref n="13" />.

The status of anonymous processing has been integrated into pseudonym processing information. However, as will be looked at later, there is no comprehensive legal system regarding how to handle medical information in a special manner, and the handling of medical data is left to the interpretation.

Thus, at 2.2 and below, a specific example of the Cancer Registration Act, which only specifies data for specific diseases, will be examined as an example for processing medical data.

<footnote n="6">⁶ Kaori Ishii, Present and Future of Personal Data Protection Law, Keiso Shobo Publishing, 2017, pp. 443-452.</footnote>

<footnote n="7">⁷ Ishii, above note 6, pp. 443-452. See also, Kaori Ishii, Masahiro Sogabe, Ryoji Mori ed., Commentar for Personal Information Protection Law, Keiso Shobo publishing, 2021, pp. 654-705.</footnote>

<footnote n="8">⁸ Ishii, above note 6, pp. 443-452.</footnote>

<footnote n="9">⁹ Ishii, above note 6, pp. 443-452.</footnote>

<footnote n="10">¹⁰ Shizuo Fujiwara, George Shishido, Background and Future of the 2020 Revision of the Personal Information Protection Law, Jurist 1551, Nov 2020, pp. 14-29., Personal Information Protection Commission website,</footnote>

<footnote>The revised Personal Information Protection Act of 2021</footnote>

<footnote>(Review of the Personal Information Protection System through the Public and Private Sec-
tors)(https://www.ppc.go.jp/personalinfo/minaoshi/).</footnote>

<footnote n="11">¹¹Tomomi Hioki, Yoichiro Itakura, 'Structure of the Personal Information Protection Law' Shoji Homu Publishing, 2017, p. 104.</footnote>

<footnote n="12">¹² Article 2, sentence 3 of Act on Protection of Personal Data, and Article 2 of the Order for the Act on Protection of Personal Data.</footnote>

<footnote n="13">¹³ Above note 2, Shishido, 'Future and Present of Information Law' at 175.</footnote>
■ Quelle version puis-je déposer ?

■ Choisir le bon « type de document »

■ Mettre en valeur ses publications

○ Les tutos IES Inria

■ Lier les notices dans HAL

■ Umbrhal Inria pour l'accessibilité

■ Personnaliser son CVHAL

■ Créer et Personnaliser sa collection

• Documentation

○ Aide en ligne HAL

○ Aide en ligne Haltools

○ Aide en ligne X2hal

○ Tutoriels video HAL

○ Documentation API HAL

○ Ajouter des vignettes

○ Identifiant auteur IdHAL et CV

○ Compléter son dossier ORCID avec ses dépôts HAL

○ Inria et la Science Ouverte

X

X

X

Loading...

X

Le document que vous demandez est en access restreint
jusqu'au 2025-01-01 !

Revenir a la notice

Retourner à l'accueil

Contact

•

Ressources
## 2.2 Cancer Registration Act

Regarding "cancer" as a specific disease, the "Act on Promotion of Cancer Registration"<fnref n="14" /> has been established. Based on this law, the government is aiming to record and maintain databases on cancer and other diseases nationwide.

However, there was a problem that this cancer registration method was for the specific disease of "cancer". In fact, with the law, only information related to "cancer" is recorded and stored in databases for the utilization of personal information to provide medical care by integrating information. As a result, this law only has a database for specific diseases such as cancer, and it does not contribute to the overall utilization of medical information.

Plus, there was a problem that this cancer registration method was for the specific disease of "cancer". In fact, only information related to "cancer" is recorded and stored in databases for the utilization of personal information to provide medical care by integrating information. After all, this law only has a database for specific diseases such as cancer, and it is not in a situation that contributes to the utilization of overall medical information<fnref n="15" />.

# 3 Background History and Issues of the Cancer Registration Law in Japan

The background and issues of the Cancer Registration Act are discussed below.

The "Cancer Registration Act" was enacted through coordination with various related organizations in order to collect information on the specific disease of cancer, which is the leading cause of death in Japan, and thereby contribute to the improvement of cancer medical care<fnref n="16" />.

<footnote n="14">¹⁴ Act No. 111 of 2013, hereinafter referred to as "Cancer Registration Act</footnote>

<footnote n="15">¹⁵ The number one death rate in Japan is "cancer" and statistics show that one in two people will have cancer at least once in their lifetime, so the existence of such a database has its own side.</footnote>

<footnote n="16">¹⁶ The purpose of this Act is, in light of the current situation where cancer is a serious problem for the lives and health of the people, such as that cancer is the largest cause of death due to the disease of the people, to improve the quality of medical care for cancer (Refers to the improvement of the quality of cancer medical care and cancer screening (Hereinafter referred to as "Cancer treatment, etc.".) and the promotion of cancer prevention. The same shall apply hereinafter.), enhance the provision of information on cancer, medical care for cancer, etc. and prevention of cancer, and implement other cancer measures based on scientific knowledge, in accordance with the purpose of the Basic Act on Cancer Control (Act No. 98 of 2006), by stipulating matters concerning the implementation of the National Cancer Registration and the use, provision, and protection of information pertaining to the implementation of the National Cancer Registration, as well as matters concerning the promotion of in-hospital cancer registration, etc., and stipulating the utilization of information obtained through cancer registration, etc., to promote understanding and analysis of the status</footnote>
* Documentation

* FAQ

* API

* OAI-PMH

* AuréHAL

## Informations

* À propos

* Données personnelles

* Mentions légales

* Accessibilité

* Conformité RGAA

## Questions juridiques

* Je publie, quels sont mes droits ?

* Loi pour une République numérique

* Stratégie de non-cession des droits

* SHERPA/RoMEO

## Portails

* Portails institutionnels

* HAL

* HAL SHS

* HAL Thèses

* MédiHAL

## CCSD

* CCSD

* Episciences

* Sciencesconf
**3.1 Brief Background to the establishment of the Cancer Registration Law**

In Japan, the regional cancer registration as an exception of the personal information
protection ordinance was made in each region. In many countries, especially in Eu-
rope and the United States, this has created a situation in which regional differences
exist in that regional cancer registries are not based on a nationwide legal system,
compared with the fact that regional cancer registries were legally established as a
basic measure of cancer countermeasures.

As background to the Cancer Registration Act, for example, from around 2005, the "A Study on the Development of a Legal Ethical Environment for Local Cancer Registration" was conducted as part of the Ministry of Health, Labour and Welfare's Third Comprehensive Research Project on Cancer<fnref n="17" />, and in 2007 a proposal was made to the effect that the local cancer registration system should be legislated in order to comprehensively implement the local cancer registration system, not as an exception to the local ordinances on the protection of personal information<fnref n="18" />. Against this background, the Basic Act on Cancer Control Measures was enacted on June 16, 2006¹⁹. Afterwards, the designation of the cancer medical care cooperation base hospital began to be made based on the idea of cancer fundamental law enacted in 2006. In addition, the Act on the Promotion of Cancer Registration was enacted as a legislature of the Diet in December 2013. This "Cancer Registration Act" was enforced in January 2016²⁰.

**3.2 Overview of the Cancer Registration Act**

The purpose of cancer registration is to collect, store, and analyze information on the
diagnosis, treatment, and outcomes of cancer patients, to understand the occurrence of
cancer and the actual conditions of cancer medical care, and to contribute to the im-
provement of cancer medical care itself and the formulation and evaluation of cancer
countermeasure policies. The Cancer Registration Law defines national cancer regis-
tration information, prefectural cancer information, and in-hospital cancer infor-
mation, and indicates the utilization of information by the national and prefectural
governments, hospitals and clinics, researchers, etc., respectively.

of cancer, medical care, outcomes, etc. and other cancer research and studies, thereby con-
tributing to further enhancement of cancer measures.

<footnote n="17">17 Group leader was Eiji Maruyama, Professor, Graduate School of Law, Kobe University.</footnote>

<footnote n="18">¹⁸ Katsunori Kai, "Regional Cancer Registration Law System and Criminal Regulations: Focusing on Legislative Proposals" Waseda Law Review, Vol. 83, No. 4 (2008), p. 36</footnote>

<footnote n="19">¹⁹ Act No. 98 of June 23, 2006</footnote>

<footnote n="20">²⁰ Act on Promotion of Cancer Registration (Act No. 111 of December 13, 2013).</footnote>
The flow of the cancer registration is as follows<sup>21</sup>. (1) Medical information on all cancer patients diagnosed and treated at hospitals and designated clinics is collected and organized for use in national and prefectural cancer control. (2) Complementary registration of patients not included in the notification based on death information from cancer, etc., and patient death information is also registered. (3) The collected information will be used to develop cancer statistics and contribute to the survival rate, number of cases, extent of disease, and secondary prevention of cancer.

With the enactment of the Cancer Registration Act, it has become more and more recommended that not only the national government but also local governments (especially the prefectures) make use of the data of cancer registration as a framework of the Act, to actively plan and implement cancer countermeasures.

### 3.3 Limitations of the Cancer Registration Act

The limitation of the Cancer Registration Law is that it is limited to "cancer" as a matter of course. One of the limitations of the Cancer Registration Law is that it cannot be linked to information on diseases other than cancer, so that the medical information database has a defect that it cannot deal with diseases other than cancer, and it cannot deal with complex diseases including cancer.

## 4 Legal Structure on Medical Information in Japan

Based on the above issues, a bill submitted to the 193rd session of the Diet in 2017 was titled "Draft Law Concerning Anonymously Processed Medical Information to Contribute to Research and Development in the Medical Field<sup>22</sup>" and the purpose of the submission was to "Establishment of regulations for businesses that process medical information anonymously so that specific individuals cannot be identified, and promotion of advanced research and development on health and medical care and

<figure><img src="image_4.png" /></figure>

<footnote n="21"><sup>21</sup>Graphic of the website of the Japan Cancer Registration Association "What is cancer registration?".</footnote>

<footnote n="22"><sup>22</sup> Next Generation Medical Infrastructure Bill.</footnote>
creation of new industries through safe and appropriate use of anonymously processed
medical information, thereby contributing to the formation of a healthy, longevity
society"<fnref n="23" />. In the following, the history of the examination on the utilization of medi-
cal information and the outline of the law are examined.

4.1 Awareness of the need to consider personal information in the medical field

Regarding medical information, the necessity of the utilization of the medical infor-
mation was recognized for various needs in the field of medical treatment and nursing, that is, for efficient utilization of the insurance system by the related organiza-
tions and utilization by the administrative organizations, etc. as well as advance and
development of the medical science.

Therefore, the Ministry of Health, Labour and Welfare held the review meeting for utilization and protection of information in the medical field from April to September, 2012, and the "Report on the ideal environment for the utilization and protection of information in the medical field" was summarized<fnref n="23" />.

In this review meeting, although it is difficult to say that medical information made
personal identification impossible only by mechanically masking personal identifica-
tion information such as names, etc., the basic direction of the examination of the
utilization of personal information in the medical field was discussed, including the
discussion that the regulation of anonymization in the medical field should be divided
into unlinkable anonymization and linkable anonymization in light of the fact that the
provision of medical care, etc. and medical research itself would not be possible if
information such as physical characteristics were not available.

4.2 Subsequent review of personal information in the medical field

Prior to the examination of the next generation medical infrastructure bill, the follow-
ing history existed. In other words, with the growing recognition of the importance of
building digital infrastructures in the medical, nursing, and health fields, it is neces-
sary to improve the efficiency of medical quality, improve the convenience of citizens
and patients, promote research and development, and strengthen industrial competi-
tiveness by building and utilizing information infrastructures in the medical, nursing,
and health fields. In response, the "Next Generation Medical ICT Task Force" was

<footnote n="23">²³ Ministry of Health, Labour and Welfare, Study Group on the Protection of Personal Infor-
mation at Medical Institutions Report, Report on the Utilization of Information in the Medi-
cal and Other Fields and the Establishment of an Environment for Protection,
http://www.mhlw.go.jp/stf/shingi/2r9852000002k0gy-att/2r9852000002k0kz.pdf. At page 6-
10 of the report, it is analyzed that accumulated anonymously processed data could be uti-
lized in order to contribute to the improvement of medical care that enables the quality of
medical service to be improved.</footnote>
established under the Health and Medical Strategy Promotion Headquarters of the Cabinet Secretariat in collaboration with the IT Strategic Headquarters.

After that, the "Next Generation Medical ICT Infrastructure Council" was estab-
lished by adding related medical groups, related academic societies, and industries,
etc. to the members of the task force, and the councils were held in April and Decem-
ber, 2015, and in March, 2016. Among them, working groups such as the Working
Group for the Promotion of Standardization of the Collection and Exchange of Digital
Data, the Working Group for the Adjustment of Medical Information Handling Sys-
tems, the Working Group for the Promotion of the Composition of Digital Data Col-
lection and Utilization Projects, and the Working Group for the Promotion of the
Introduction of Next Generation ICT to Medical Care were established. Especially,
concerning the utilization of medical information, the summary of the "Working
Group for the Coordination of Medical Information Handling Systems of the Next
Generation Medical ICT Infrastructure Council" was issued in December 2016 24.

4.3 Utilization of Medical Information and Protection of Personal
Information

The aforementioned summary of the "Working Group for the Coordination of
Medical Information Handling Systems of the Next Generation Medical ICT
Infrastructure Council" at present states the recognition that medical data that can be
utilized on a nationwide scale in our country is based on receipt (medical fee
schedule) data, which is the input of medical treatment acts (implementation
information), and that the utilization of data concerning the results of medical
treatment acts (Outcome) is not prepared, and that the data itself is held in a dispersed
manner across the country due to the fact that medical institutions are mainly
composed of the private sector and the separation of the insurance system.

In addition, as the Personal Information Protection Law was revised, it was
analyzed that the burden of costs for the acquisition of personal information based on
consent, the processing of data to be anonymized, the construction of systems, etc.
increased. This is largely related to the fact that, as mentioned above, information
including medical history, etc. was conceptualized as "Special care-required personal
information" and as a result, provision to a third party by opt-out was prohibited.
Therefore, in order to appropriately utilize medical information in the future, it is
necessary to establish a system that enables individuals and medical institutions to
provide medical and other information with peace of mind, while carefully
considering the protection of individual rights and interests.

<footnote n="24">24 The Working Group for Adjustment of the Medical Information Handling System of the Council for Next-Generation Medical ICT Infrastructure, summarized on December 27, 2016 http://www.soumu.go.jp/main_content/000462278.pdf</footnote>
4.4 So-Called "accreditation body"

The main content of the Medical Big Data Act is that the so-called "accreditation
body" system has been established as a new basis to collect clinical trial and inspec-
tion data widely, safely manage and anonymize them, and link them to the use for the
promotion of drug discovery and research and development utilizing information in
the medical field, etc.

In other words, the Act on the Use of Personal Information in Medical Care adopts
a system to certify "Anonymously processed medical information preparation busi-
ness operator" as "Medical Information Handling Business Operators"<fnref n="25" />

Specifically, the aim is to create a system that enables individuals and medical in-
stitutions, etc. to provide medical information with peace of mind while giving con-
sideration to the protection of high rights and interests<fnref n="26" />.

(1) A new system will be established to certify private organizations (= Certified Anonymously Processed Medical Information Producer) that can secure high information security, meet certain standards such as having sufficient anonymization processing technology, and conduct anonymization for the management and utilization of medical information in a secure and reliable manner.

(2) Medical institutions, etc. shall be able to provide medical information to ac-
credited institutions if the person does not refuse to provide such information, and
accredited institutions shall anonymize collected information and use it as big data for
research and development as well as for medical administration, etc. (The provision

<footnote n="25">25 Article8 A person who performs anonymously processed medical information preparation work (limited to juridical persons.) may, upon application, receive approval from the competent minister to the effect that it is recognized that the person is capable of conducting anonymously processed medical information preparation work properly and reliably. The present law provides a framework for the recognition of a so-called recognition organization, but it does not specify in detail what kind of information is collected and how it can be used by the recognition organization. These parts depend on future operation.</footnote>

<footnote n="26">²⁶ Of the provisions of the relevant bills, the following are particularly important is Article 2. The term "anonymously processed medical information" as used in this Act means information about an individual that is obtained by processing medical information so that a specific individual cannot be identified by taking the measures specified in the following items according to the categories of medical information listed in those items and so that the medical information cannot be restored:.

(i) Medical information falling under Paragraph 1, Item (i): Delete a part of the description contained in the medical information (Including the replacement of a part of the description, etc. with another description, etc. by a method without regularity that can restore the description, etc.).

(ii) Medical information falling under Paragraph 1, Item (ii): To delete all of the Individual Identification Codes included in the applicable medical institution (Including replacing the said personal identification code with other descriptions etc. by a method having no regularity capable of restoring the said personal identification code.). See also, Ishii, Sogabe, Mori ed., above note 7, pp. 954-977.</footnote>
of medical information from medical institutions, etc. to certified business operators is
optional.)

Based on these systems, the national government is responsible for (1) the national government's responsibility to implement necessary measures and (2) a basic policy to comprehensively and integrally promote measures with regard to anonymously processed medical information to contribute to research and development in the medical field.

**4.5 Consideration of the situation in Japan**

In Japan, the accumulation of information on cancer by the Cancer Registration Law and the preparation of some other databases have progressed to some extent. However, the cooperation between databases has not progressed, and how to utilize the databases has not been decided yet. Also, the COVID-19 and diseases other than cancers are not included in the database.

**5 Exceptions to the Protection of Personal Information in Research and Development in Europe and Other Countries**

The exceptions to the European rules, treatment in the United States, and other national databases are discussed below.

**5.1 Exceptions to European regulations**

In Europe (EU), the EU General Data Protection Regulation (General Data Protection Regulation, GDPR) was passed in April 2016 27. The new data protection rules recognize the right to data portability and other rights of reference in other countries (Article 22 on forgotten rights, etc.). Regarding medical information, Article 89, paragraph (2) allows exceptions when it is used for research and development. That is, as an exception to the new EU Data Protection Regulation, exceptions to protective measures for scientific purposes are allowed, and exceptional treatment is allowed when personal data are handled for scientific or statistical purposes28.

This regulation allows the EU and its Member States to assert the right of data subjects to scientific research29 and to be exempt from the right to access and correct

<footnote n="27">27 Article 89 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)</footnote>

<footnote n="28">28 Mayu Terada, Public Law on Advanced Technology and Regulation, Keiso shobo publishing 2020, pp. 46-70. See also, Ishii, Sogabe, Mori ed., above note 7, pp. 954-977.</footnote>

<footnote n="29">29 Paragraph 2 of Article 89</footnote>
their data, to restrict or oppose the processing of their data, and to be informed of their
use as patients<fnref n="30" />.

It also states that exceptions can be made that require or do not require consent <fnref n="31" />.
However, adequate safeguards should be applied to these exceptions, and the EU and
its member states require the careful preparation of guidelines and the appropriate use
of the data for research that is truly necessary in the application of exceptions to per-
sonal data of patients<fnref n="32" />.

In this regard, it appears that COVID-19 is regarded as an exception based on this
provision.

## 5.2 HIPAA privacy regulations in the United States

In the United States, there is a privacy rule of HIPAA (The Health Insurance Portability and Accountability Act of 1996), and in the privacy rule, the method of anonymization in the form which guarantees that the individual identifiability disappears is not used. Although the Federal Health Insurance Ministry has been criticized for its insufficient protection of privacy in the implementation of these regulations, it can be said that it is rather important to be able to identify patients in clinical practice<fnref n="33" />.

## 5.3 Utilization of medical data in other foreign institutions

For example, in U.S.A., the utilization of the database which accumulates enormous
medical information such as CMS (Center for Medicare and Medicaid Services)<fnref n="34" /> and
SUS (Secondary Uses Service)<fnref n="35" /> is advancing. Specifically, the SUS website explains
that SUS is a single, comprehensive repository for medical data in the UK, enabling
various reports and analyses to support the National Health Service (National Health
Service) in providing medical services<fnref n="36" />.

# 6 Medical Data Collection relating to COVID 19 and Legal Structure in Japan

In Japan, the first -19 COVID cases from Wuhan City were reported for the first time
on January 16, 2020. Furthermore, from February 1, 2020, COVID -10 positive pa-

<footnote n="30">³⁰ Paragraph 4 b of Article 14 and paragraph 3 b of Article 17</footnote>

<footnote n="31">³¹ Paragraph 4 b of Article 14</footnote>

<footnote n="32">³² Ibid.</footnote>

<footnote n="33">³³ U.S. Department of Health & Human Services, Your Rights Under HIPAA, https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html.</footnote>

<footnote n="34">³⁴ https://www.cms.gov/</footnote>

<footnote n="35">³⁵ https://digital.nhs.uk/services/secondary-uses-service-sus/secondary-uses-services-sus-guidance</footnote>

<footnote n="36">³⁶ Ibid.</footnote>
tients were reported on cruise ships, and measures were taken to deal with the spread
of infection.

In order to respond to COVID-19, a bill to partially revise the Act on Special Measures Concerning Countermeasures against Novel Influenza was approved by the Cabinet on March 10, 2020, and was passed and promulgated on the 13th of the same month.

This is an expansion of the special law, which was previously a law against H1N1
influenza, to COVID-19. Therefore, the COVID-19 is based on the Act on Special
Measures Concerning Countermeasures against Novel Influenza (Act No. 31 of 2012,
hereinafter referred to as "new flu law"). This was regarded as "New strains of influ-
enza". In addition, the government ordinance (Cabinet Order No. 11 of 2020) that
new type coronavirus infectious disease is decided as a designated infectious disease,
etc. has been instituted. In addition, various provisions in the Act on Prevention of
Infectious Diseases and Medical Care for Patients with Infectious Diseases (Act No.
104 of 1998, hereinafter referred to as "Infectious Disease Law".) now apply to
COVID-19. These revisions also made it possible to take further measures, such as
restricting the entry of buildings and requesting people to refrain from going out<fnref n="37" />.

Furthermore, on March 26, 2020, the Minister of Health, Labour and Welfare re-
ported to the Prime Minister that there was a high risk of the spread of COVID-19
based on Article 14 of the New Influenza Act, which is applied by replacing certain
terms pursuant to Article 1-2, paragraphs (1) and (2) of the Supplementary Provisions
of the New Influenza Act, because "In Japan, there have been sporadic outbreaks in
areas where the number of patients with unknown routes of infection has increased,
and infection has spread in some areas." On the same day, the Government estab-
lished a government task force based on Article 15, paragraph (1) of the same Act,
and on March 28 of the same year, the basic action policy for measures against the
New Coronavirus Infection was established. On April 7, 2020, the Director-General
of the Headquarters for Countermeasures for Novel Coronavirus Infection declared a
state of emergency under Article 32, paragraph (1) of said Act (Until May 6 of the
same year Saitama Prefecture, Chiba Prefecture, Tokyo Metropolis, Kanagawa Pre-
fecture, Osaka Prefecture, Hyogo Prefecture and Fukuoka Prefecture). In addition, all
prefectures were subject to emergency measures on April 16 of the same year <fnref n="38" />.
In order to prevent the spread of COVID-19, the government has the basic recogni-
tion that "It is important to further promote the avoidance of "three dense" (Author's
Note: "closed" "dense" "closely") and to contain the occurrence of clusters (The popu-
lation in which there was an association between patients<fnref n="39" />. Hereinafter referred to as

<footnote n="37">³⁷ Cabinet Order enacted on January 28, 2020, Cabinet decision on revision of entry restriction, etc. decided on March 26, 2020.</footnote>

<footnote n="38">³⁸ Basic Policy for Countermeasures against Novel Coronavirus Infection (March 28, 2020 (Changed on April 16, 2020): Decision of the New Coronavirus Infection Control Center in Japan).</footnote>

<footnote n="39">³⁹ It is explained as ‘Avoid the Three Cs’. Government explained that particularly common contributory factors in outbreaks as "Closed spaces with poor ventilation," "Crowded spaces with many people nearby," and "Close-contact settings such as close-range conversations". See, https://www.mhlw.go.jp/stf/covid-19/kenkou-iryousoudan_00006.html.</footnote>
"cluster".) through active epidemiological studies, etc., in order to prevent the occur-
rence of so-called overshoot, which is an explosive spread of infection (Hereinafter
referred to as "overshoot".) and to minimize the number of infected, seriously ill, and
dead persons." "In addition, it is important to limit the speed of the spread of infection
as much as possible by implementing a combination of measures to reduce contact
opportunities, such as requesting people to refrain from going out, as necessary, in
order to achieve the containment described above and to prevent the collapse of the
medical supply system."<fnref n="40" />

6.1 Gathering of Medical Information from the Government and Provisions
of the Act related to Covid-19

(1) Obtaining information from patients

In relation to medical information, the question is how to deal with it under the cur-
rent law. First of all, when a patient with a COVID-19 (Confirmed patients, asymp-
tomatic pathogen carriers, suspected disease patients, cadavers of infectious disease
fatalities, cadavers of suspected infectious disease fatalities) is identified, the existing
law has already mandated that the physician, etc. must report to the prefectural gover-
nor, etc. (Prefectural governors, mayors of public health centers and special ward
mayors. In addition, the Infectious Disease Law) via the health center using the fol-
lowing form "immediately" (Article 12, paragraphs (1) and (6) of said Act). It was
also stipulated that prefectural governors, etc. must report the content of the notifica-
tion to the Ministry of Health, Labour and Welfare (Minister of Health, Labour and
Welfare) "immediately" (Paragraph 2 of the said article) <fnref n="41" />.

<footnote n="40">⁴⁰ In Japan, because of the universal health insurance system, anyone can basically access low-cost, high-quality medical care at any time. However, because there is no spare capacity and limited medical resources to deal with infectious diseases that require special systems, such as coronavirus infection, the Ministry of Health, Labour and Welfare decided to call on the government to minimize the number of infected people in order to reduce the number of people accessing medical institutions. The Ministry of Health, Labour and Welfare website: Plan to Secure a System for Providing Health and Medical Care for COVID-19, https://www.mhlw.go.jp/stf/seisakunitsuite/newpage_00056.html.</footnote>

<footnote n="41">⁴¹ Prefectural governors, etc. may "When deeming it necessary for preventing the outbreak of an Infectious Disease or for clarifying the status, progress, and cause of the outbreak of an Infectious Disease, the prefectural governor may direct relevant officials to question the patients, Suspected Disease Carriers or Asymptomatic Carriers of a Class I Infectious Disease, a Class II Infectious Disease, a Class III Infectious Disease, a Class IV Infectious Disease, a Class V Infectious Disease or a Novel Influenza Infection, etc., a person with symptoms of a New Infectious Disease, the owners or managers of animals that are likely to transmit an Infectious Disease to humans, or other persons concerned, or to conduct necessary investigations." (Article 15, paragraph (1) of said Act, an aggressive epidemiological survey. Paragraph 8 of the same article reports to the Minister of Health, Labour and Welfare. Paragraph 2 of the same article in the case of the Minister of Health, Labour and Welfare).</footnote>
Therefore, the public health center conducts the investigation on the contact tracing of so-called COVID-19, that is, close contacts, based on the above provisions. For details, "Procedures for the implementation of an aggressive epidemiological survey on patients with new coronavirus infections" (National Center for Infectious Disease Epidemiology, National Institute of Infectious Diseases, April 20, 2020 edition) is stipulated⁴². The forms reached (1) basic information and clinical information questionnaire of new coronavirus infectious disease (Include patients with suspected diseases), (2) new coronavirus infectious disease patient behavior questionnaire (source of infection), (3) new coronavirus infectious disease patient behavior questionnaire (contact person), (4) contact person list of new coronavirus infectious disease patient, (5) health observation questionnaire in the contact of new coronavirus infectious dis-

列印様式6 1

新型コロナウイルス感染症 発生図

郵通府衛和事(保健所設置市長・特別区長) 段

感染症の予防及びの発生に関する法律第12条第1項(同条の2において準用する場合に応じ、以下同じ。)

発生年月日 委員 年 月 日 口

医師の姓名

田

(署名又は記名押印のと

医師の職業・診療所の名称

上記医療・診療所の名称

電話番号

1

(※銅印・診療所に従事している医師にあつては、その住所・電話番号を記載)

・診療(診療)した名 (元気)の略記

・患者(患者) (発生)の略記

・発生状況(発生場所) (発生状況)の略記

・発生状況(発生場所) (発生状況)の略記

・発生状況(発生場所) (発生状況)の略記

・発生状況(発生場所) (発生状況)の略記

2 当該患者名

3 性別

4 生年月日

5 当該患者の年齢

6 当該患者年齢

性別

男 女

年 月 日

歿 (か月)

年 月 日

性別

男 女

年 月 日

歿 (か月)

年 月 日

性別

男 女

年 月 日

歿 (か月)

年 月 日

性別

男 女

年 月 日

電 (か月)

年 月 日

性別

男 女

年 月 日

電 (か月)

年 月 日

性別

男 女

年 月 日

電 (か月)

年 月 日

性別

男 女

年 月 日

電 (か月)

年 月 日

性別

男 女

年 月 日

・8 感染拠拠地・感染経路・感染地域

・事実の内容

・その他の感染拠拠地・感染経路

①場所区分・場所経路（特定・推定）

①場所区分・場所経路（特定・推定）

・飛沫検査・飛沫検査（感染経路の検査・状況：）

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

・その他の感染拠拠地・感染経路

(1) 1.11.12. 中国に移動した者(中国)の名前をもつて記入すること。

(2) 段(段)は、死亡を表した場合のみ記入すること。

1. 段は、死亡を表したものに限って記入すること。
Infectious Disease, or the owner or manager of an animal likely to transmit an Infec-
tious Disease to humans or its corpse, or any other person concerned;". This is be-
cause "Other related parties" should be read as "cadaveric". In this way, the so-called
"aggressive epidemiological investigation" which is considered to be necessary under
the Infectious Disease Law in the future, is not in a form that forces the acquisition of
information from people other than patients.

Article 56 30 of the Infectious Diseases Act provides for the collection of reports accompanied by penal provisions (Article 72, item (vi)) on the grounds that "The Minister of Health, Labour and Welfare or a prefectural public safety commission may have a Holder of Specified Pathogens, etc., a person who has imported Class III Pathogens, etc., a person who has imported Class IV Pathogens, etc., a Person Obligated to Sterilize and Transfer Class I Pathogens, etc. or a Person Obligated to Sterilize and Transfer Class II Pathogens, etc. make a report to the extent necessary for the enforcement of the provisions of this Chapter (Provisions of Article 56 paragraph 27 (2) for prefectural public safety commissions).". However, this provision is limited to those possessing pathogens. Therefore, it can be said that this provision is not a provision widely used to obtain information from persons other than patients, etc.

Under these circumstances, Article 6, Clause 7 of the new flu law originally stated
that "The national government may, when it finds it necessary for formulating the
National Government Action Plan, request the heads of local governments and other
executive agencies, designated public institutions, and other relevant persons to pro-
vide materials or information, state their opinions, and offer other necessary coopera-
tion.". Under this provision, it is possible to obtain information from people other than
patients. However, "Other related parties" based on this law is not unlimited, though it
is not as much as Article 15, Paragraphs 1 and 2 of the Infectious Diseases Act. In
addition, since the purpose of collecting information is limited, as in the case of "To
establish a government action plan" it is not a provision that can be expanded in the
form of making predictions in the future and is used to collect a wide range of infor-
mation. Furthermore, there is no penalty for this provision.

In this way, at present, there is no provision in a unified law or a special law for the
government to obtain information from people other than patients.

6.2 Laws and regulations concerning the protection of personal information

(1) Personal Information Protection Law

In principle, the question is whether a private business operator can voluntarily pro-
vide information containing personal information to the government, etc. or in ac-
cordance with a request, etc. that is not based on laws and regulations, without special
provisions on the acquisition of information from other than patients, etc. by the gov-
ernment, etc. In this regard, it is necessary to consider the use of personal information
for purposes other than those specified in the Act on the Protection of Personal Infor-
mation (Act No. 57 of 2003, hereinafter referred to as "Personal Information Protec-
tion Law".) and the provision of personal data to a third party. In particular, in the
case where a private business operator intends to obtain a "Personal Information"
without the consent of the person in question that the person is a new patient, etc. with
a COVID-19, the acquisition without the consent of the person in question of Special Care-Required Personal Information (Article 2, paragraph 3 of the Act on the Protection of Personal Information "medical history") may become a problem. The Act on the Protection of Personal Information stipulates the following four exceptional provisions concerning the use of personal information for purposes other than the intended purpose, provision to a third party, and acquisition of special care-required personal information (the items of Article 16, paragraph (3), the items of Article 23, paragraph (1), and the items of Article 17, paragraph (2) of said Act).

First of all, as mentioned above, there is no special law in the case where there is a provision concerning the acquisition of information from other than patients by the government, etc. In other words, (1) as a case based on laws and regulations, the question is whether or not there is a provision that can be read as a provision requiring provision to be provided, and whether or not there is a case where an exception naturally applies. However, there is no such provision.

The most likely exceptions are (3) public health improvements. The pandemic of COVID-19 is exactly a scene corresponding to "Public health improvement ... especially needed", and it is considered to be basically approved. In addition, in the guidelines of the Personal Information Protection Committee ("Guidelines for the Act on the Protection of Personal Information (General Rules)" (Public Notice No. 6 of the Personal Information Protection Commission of 2016) 3-1-5), there is an example of "Case 1 Cases in which information on the results of medical examinations conducted by insurers of health insurance associations, etc. is used for planning health promotion measures, improving the effectiveness of health services, epidemiological studies, etc. (The provisions of Chapter 4 shall not apply to cases that fall under Article 76 (1) (iii) of the Act.)". In addition, when the government, etc. conducts surveys to prevent the spread of COVID-19 infectious diseases and collects information for the planning of measures, responding to these surveys can be considered to fall under exceptional circumstances.

However, it should be noted that the above provisions also state that "if particularly necessary". Surveys and measures for COVID-19 require a certain level of concrete-ness, and when the purpose of use, etc. by the government, etc. is still at an abstract stage, there is a possibility that business operators will make risk judgments that it is more risky for them to comply with them.

In addition, there is an exception to this rule: (4) cooperation in the performance of government affairs. Examples listed in the Personal Information Protection Commission's guidelines (General Rule 3-1-5) also assume this exception. In other words, "Case 1 A business operator submits personal information in response to a voluntary request from a tax office or customs official, etc." "Case 2 When a business operator submits personal information in response to a voluntary request from the police" and "Case 3 Responses to general statistical surveys and statistical surveys conducted by local governments". In this way, it is possible to collect information in relation to the execution of administrative work related to the New Flu Law and the Infectious Disease Law. However, as in (3) above, it is necessary to provide cooperation in the execution of specific clerical work after organizing it in relation to risk judgment.
In addition to the above exceptions, statistical information (Data obtained by ex-
tracting items related to common elements from information of multiple persons and
aggregating them for each of the same categories, which quantitatively grasp trends or
characteristics of groups, etc., guideline anonymously processed information part 2 -
1) and anonymously processed information may be used for other purposes or provid-
ed to a third party without the consent of the user.

With regard to the use of such exceptional circumstances, the Personal Information
Protection Commission also publishes the Secretariat of the Personal Information
Protection Commission "Handling of Personal Data for Preventing the Spread of New
Coronavirus Infection" (April 2, 2020) and confirms that it can provide information in
cases that fall under the provisions of (2) to (4) above. However, the same document
also issued a warning that "In accordance with specific cases, take into consideration
the items of data to be provided, their purpose of use, and safety management
measures.". In this way, it is assumed that the determination of the applicability of
each exceptional event will be made on a case-by-case basis. As a result, there is a
need to minimize the data provided and to take safety control measures when provid-
ing the data.

6.3 Government and other public sector personal information protection legislation

In Japan, personal information held by public organizations and that held by the pri-
vate sector are regulated by separate laws. Personal information in the public sector,
including the government, is regulated by the Act on the Protection of Personal In-
formation Held by Administrative Organs (Act No. 58 of 2003. Hereinafter referred
to as "Act on the Protection of Personal Information by Administrative Organs".) and
the Act on the Protection of Personal Information Held by Incorporated Administra-
tive Agencies, etc.<fnref n="44" /> ". With regard to the restrictions on the use outside the intended
purpose and the use outside the intended purpose, both of these stipulate, in addition
to permitting the provision outside the intended purpose for the purpose of interpreta-
tion (Article 8, paragraph (1) of the Act on the Protection of Personal Information
Held by Administrative Organs, and Article 9, paragraph (1) of the Act on the Protec-
tion of Personal Information Held by Incorporated Administrative Agencies, etc.), the
following exceptions (Items of Article 8, Paragraph 2 of the Act on the Protection of
Personal Information Held by Administrative Agencies, etc., and Items of Article 9,
Paragraph 2 of the Act on the Protection of Personal Information Held by Incorpo-
rated Administrative Agencies, etc.).

In relation to measures to prevent the spread of infectious diseases, it is generally
accepted that (2) use outside the purpose within an administrative organ is the execu-
tion of the affairs under the jurisdiction, and (3) external provision does not fall under
the provision inside or outside the purpose, but for reasonable reasons.

<footnote n="44">⁴⁴ Act No. 59 of 2003. Hereinafter referred to as Act on the Protection of Personal Information Held by Incorporated Administrative Agencies, etc.</footnote>
## 6.4 Ordinance on the Protection of Personal Information by Local Governments

In addition, all local government ordinances for the protection of personal information have been enacted separately. Therefore, it is necessary to individually examine (so-called 2000 issues). The prefecture, etc. which controls the health center is not an exception, and the examination of individual personal information protection ordinance is necessary for the judgment of the exception reason.

## 6.5 Provision of Statistical Information from Platform Operators

When government tries to utilize the big data of private business operators for measures to prevent the spread of infectious diseases, there are no special provisions concerning the acquisition of information from other than patients, etc. by the government, etc., and although the range of personal information and personal data that can be permitted due to exceptional reasons is wide to some extent, there are strict requirements concerning the confidentiality and location of communications.

In addition, it should be noted that the fact that it can be provided under exceptional circumstances does not mean that it must be provided, and whether or not it is provided by the project proponent is completely voluntary, so it can be said that it is not enforceable.

In response to the situation regarding COVID-19, the Ministry of Health, Labour and Welfare announced on March 27, 2020, "A call for the conclusion of an agreement on the provision of information contributing to measures against clusters of new coronavirus infections" and called for the conclusion of agreements among platform companies that can collect information. This is addressed to "To the press," and is not intended for a specific business operator.

# 7 Conclusion

The mechanism of utilization of medical information in our country is complicated by the mechanism of anonymously processed information itself, and it cannot be said that it is sufficiently arranged. our country's system for protecting personal information is very complicated. In addition, as we have already seen, no special system for the use of medical information has been established yet, even after the Personal Information Protection Law was revised in 2020 and 2021⁴⁵. At present, a change in the system is under consideration. However, the framework for promoting the use of anonymously processed information is also unique, and it is not yet clear what constitutes "anonymously processed" even on the basis of multiple documents released by

<footnote n="45">⁴⁵ See above note 7, Ishii, Sogabe, Mori ed., Commentar for Personal Information Protection Law, pp. 19-26. See also, In the field of academic research
Principles of the Rules for the Protection of Personal Information
(Revised Personal Information Protection Act of 2021)(
https://www.ppc.go.jp/files/pdf/210623_gakujutsu_kiritsunokangaekata.pdf).</footnote>
the Personal Information Protection Commission. In this context, in the special law on the use of medical information, there is an additional "anonymously processed medical information" on medical care.

As we have seen, the United States has HIPPA and GINA on the prohibition of ge-
netic discrimination, but since the health insurance systems are completely different,
there are many cases in which a comprehensive agreement is obtained before treat-
ment. In cooperation with GOOGLE and other organizations, new AI technologies are
being developed to link with medical care.

As reviewed in this paper, there is a cancer registration law in Japan, but it only covers cancer, and it is not relevant in this case, for example, COVID-19.

In the special law (Also known as the next-generation medical infrastructure law) for the medical big data, the mechanism of the accreditation of the accredited anonymously processed medical information preparation business on the anonymously processed information for contributing to the research and development in the medical field is constructed. However, it is still unknown how medical information, which is supposed to be "Medical information that does not identify a specific individual" by this law, will contribute to research and development, since a certifying organization has just been certified. In addition, since there are no exceptional provisions for R & D, including the fact that it is not possible to deal with cases such as those in which the person concerned refuses to provide information, it is often unclear whether there will be a mechanism to flexibly provide information for R & D.

The Next Generation Medical Care Infrastructure law can be considered to have been formulated for the time being as a mechanism to certify "accreditation body" which intends to promote at least the utilization of medical information for research and development among various laws. However, in light of the fact that medical information should be utilized in a manner that helps to reduce the increase in medical costs as much as possible from a broader perspective and from a viewpoint other than research and development, a system should be established for the utilization of basic information, including the degree of anonymous processing, which allows more flexible utilization. In addition, since it is undeniable that the system is difficult to understand for the people, medical workers, and related persons, it is necessary to change the system as appropriate in order to make it easier to understand.

The Next Generation Medical Care Infrastructure was designed to do this, but it created a law to use anonymously processed information, which could prevent the use of anonymously processed information. (The law should be revised in this respect.)

Therefore, in view of the fact that medical information should be used in a manner that helps to control the increase in medical expenses as much as possible from a broader perspective and from a viewpoint other than research and development, a necessary system including a new law and administrative institution that governs the infrastructure should be established for the utilization of basic information, including the degree of anonymous processing, which allows more flexible utilization<fnref n="46" />.

<footnote n="46">⁴⁶ Shimpo, above note 2, pp. 790-791.</footnote>