Personal Information Protection Law～How to deal with leakage of personal information～
In recent years, there has been a growing interest in personal information,
but at the same time, there has also been an increased scrutiny of leakage ofpersonal information. In the event of a leakage of personal information, thefollowing actions are primarily required.

1. How to deal in case of leakage
In the event of a leakage of personal information, it is important not only toidentify the cause and prevent recurrence, but also to make appropriate disclosure
as soon as possible. In addition to reporting to the Personal Information Protection
Commission and notifying the individual, in some cases, explanations toshareholders, press releases, etc. are also required. If these countermeasures are
made incorrectly, they can result in a "blow up".

2. Reporting to the Personal Information Protection Commission
aiand notification to the individual in the event of a leakage
In addition, in accordance with the revision of the Act, from April 1, 2022, inthe event of a leakage of personal information, notification to the Personal
Information Protection Commission or the individual (i.e., the specific individual
identified by the personal information) may be required (Article 26 of the Act on theProtection of Personal Information).
According to the annual report for fiscal year 2020, there were 4,141 reportsof leakage to the Personal Information Protection Commission in fiscal year 2020,
which is, although, a statistic from before the establishment of this article (※1).
Thus, a considerable number of leakages have been reported to the PersonalInformation Protection Commission alone, and it is estimated that a considerable
number of leakages have occurred, including those that have not been officiallyreported.
※1 https://www.ppc.go.jp/aboutus/report/annual_report_2020/(Chapter 2, Section 3, Referred on January 14, 2022)

3. Compensation for damages in the event of leakage
If personal information is leaked, the subject of the leakage may claim
compensation for damages.

The amount of damages for information leakage is calculated inconsideration of various factors, as determined by the Osaka High Court
rendered on November 20, 2019.
“In considering whether or not a person whose personal information
has been leaked to the outside has suffered mental anguish and theamount that is reasonable to compensate for the mental damages
suffered when his or her privacy has been infringed, a judgement
should be made by comprehensively considering the circumstancesthat emerged in this case, including the content of the leaked
personal information, the extent of the leakage, whether any actual
damage has occurred, and the measures taken by the person who
had control of the personal information.”
Even if the amount of damage per person is small, if the number of
persons whose information is leaked is large, the amount of damage will belarge.
Recent statistics on the amount of damages show that the average
estimated damages per person is 29,768 yen (average estimated damages
per leakage case is 637,670,000 yen) (※2).
(※2 Japan Network Security Association “2018 Survey Report on
Information Security Incidents [Preliminary]” Referred on January 14, 2022
https://www.jnsa.org/result/incident/2018.html)

4. Consultation with an Attorney
In the unlikely event of a leakage of personal information, pleasecontact us as soon as possible so that we can take appropriate initial action
and provide legal support to minimize the damage.
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

WriterAkira WATANABE
Attorney at Law[a_watanabe☆nakapat.gr.jp]

Yuriko SAGARA
Attorney at Law

Hidekazu NISHIMURA
Attorney at Law[y_sagara☆nakapat.gr.jp] [h_nishimura☆nakapat.gr.jp]

Please replace ☆ by @.
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝