Global Strategyof the Personal Information Protection Commission
27 March 2024
1.

BackgroundAs the importance of safe and smooth cross-border transfer of data, including personal
information, has further increased with the development of the digital society, the Governmentof Japan is now promoting “Data Free Flow with Trust” (DFFT). In particular, the Personal
Information Protection Commission of Japan (PPC Japan) plays a leading role in the promotion
and operationalization of DFFT in the field of personal information protection and privacy inJapan.
In this context, the PPC Japan chaired “the 3rd meeting of G7 Data Protection and PrivacyAuthorities Roundtable” (Roundtable) in 2023, where the leaders of the Data Protection andPrivacy Authorities (DPA(s)) from the G7 Members discussed issues on DFFT, emerging
technologies and enforcement cooperation. As the outcome documents of the G7 Roundtable
meeting, G7 DPAs’ Communiqué and Action Plan were adopted.
Regarding the emerging technologies in particular, the PPC Japan compiled the discussions
into G7 DPAs’ “Statement on Generative Artificial Intelligence”, which was adopted as anadditional outcome document at the G7 Roundtable meeting, against the background thatconcerns about the risks of generative AI against personal information protection and privacy
have swiftly escalated in the situation where the generative AI has developed and proliferated
rapidly. The G7 Statement on Generative AI influenced other forums internationally. Specifically,
it paved the way for the adoption of the “Resolution on Generative Artificial Intelligence Systems”,
which welcomed the Statement and delivered its G7 DPAs’ message to the worldwide beyond
the G7, at the Global Privacy Assembly (GPA) conference in October 2023.
In FY2024, the PPC Japan will continue its commitment not to adopt an exclusive approach but
to aim at realizing an international environment in which different personal information protection
systems and international frameworks can be interoperable while respecting the diversity ofthem. In taking this commitment into action, the PPC Japan would also appropriately takeaccount of the needs of businesses, which were identified through the “Survey on Cross-Border1

Transfer of Personal Data and Compliance with Foreign Regulations by Private-Sector
Businesses " published on December 6, 2023.
Based on the above, the PPC Japan's Global Strategy for FY2024 shall be defined as follows.

2.

Developing an international environment for the safe and smooth cross-bordertransfer of personal information

The PPC Japan will support businesses for their transfer of personal information across borders
in a safe and smooth manner for the purpose of promoting and operationalizing DFFT. Inaddition, the PPC Japan will promote developing an international environment that allows
businesses to choose the cross-border transfer scheme suitable for their own needs and otherfactors from multiple options. At the same time, the PPC Japan will aim to develop tools for crossborder data transfer on a global scale and work towards establishing global standards.
(1) Further developing the mutual adequacy arrangements
The PPC Japan will continue to work toward the further development of the mutual adequacy
arrangements that facilitate smooth personal data transfers, with countries and regions that haveestablished a personal information protection system recognized to have substantiallyequivalent standards to that in Japan, as a top priority issue, inter alia, by:➢Aiming for an early conclusion of consultations on expanding the scope of the mutualadequacy arrangement with the EU or the UK to the academia and the public sector,
in line with the 2021 amendment of the Act on the Protection of Personal Information(APPI).

➢Furthermore, initiating consultations with like-minded countries and regions having
shared fundamental values with Japan with a view to increasing the target countries
and regions on the mutual adequacy arrangement.

(2) Promoting the international corporate certification systems
The PPC Japan will lead a discussion on the international corporate certification systems,
particularly under the Global Cross-Border Privacy Rules (CBPR) Forum, and actively work toencourage stakeholders’ participation in the Forum, inter alia by:➢

Leading a discussion on enhancing program requirements and other issues of theGlobal CBPR System after its operationalization.

2

➢Working on promoting membership and participation by jurisdictions and uptake of theSystem through outreach activities such as a workshop which the PPC Japan will cohost with the United States and others.

➢Creating an environment that facilitates obtaining the certification of the System bycompanies, including through recognition of new Accountability Agents and clarificationof the benefits of the System for certified companies, thus promoting uptake of theSystem domestically.

(3) Introducing the global model contractual clausesWith the aim of introducing the global model contractual clauses (MCCs), the PPC Japan will
work on realizing the interoperability of MCCs on a global scale in stages, including through joint
research on the existing MCCs with like-minded countries and regions having sharedfundamental values with Japan, as well as expressing opinions and thoughts on the global
MCCs at the international fora in multilateral or regional frameworks such as the G7 and theGPA .
(4) Addressing the risks surrounding personal information protection
The PPC Japan will continue to engage in the dialogues about unlimited government accessand data localization and to make an effort that the outcomes of the dialogues will be reflectedin the OECD Privacy Guideline including its relevant documents. In addition, the PPC Japan will
work towards ensuring that the “Declaration on Government Access to Personal Data Held byPrivate Sector Entities” adopted by the OECD members can be adhered to non-member
countries.

3.

Strengthening and building international cooperative relationships with like-mindedcountries and regions, including cross-border enforcement cooperation

In the framework of cooperation with like-minded countries, the PPC Japan will exchange
information on the legal system and enforcement practices regarding personal information
protection, as well as discuss ways to enhance cooperative relationships so that the PPC Japan
can take part in the global policy-making discussions and strengthen cross-border enforcement
cooperation. Furthermore, the PPC Japan will work towards strengthening and building bilateraland regional cooperative relationships to address the development of cross-border businessactivities and the increase of data transfers by businesses.
(1) Strengthening cooperative relationships in the multilateral and regional frameworks➢ Collating the outcomes of the Roundtable as the unified voice of the G7 DPAs, and ,3

spreading that voice toward other international forums such as the GPA and Asia PacificPrivacy Authorities (APPA) Forum by leveraging of the G7’s influence, as well asrecommending them to endorse or incorporate that voice in new resolutions andexpanding the common perspectives with that voice among them.
➢Further enhancing the PPC Japan's presence in the Asia-Pacific region by hosting theAPPA Forum in the second half of 2024, thereby strengthening cooperativerelationships,➢In addition to the international forums mentioned above, actively participating in otherforums including conferences organized by the private sector and continuing todisseminate information on the PPC Japan's initiatives through various opportunities,
while engaging in exchanges of information or discussions on international promotionand enhancement of the personal data protection with DPAs, government bodies,businesses and researchers from participating jurisdictions.

(2) Strengthening and building bilateral and regional cooperative relationships➢ Promoting collaboration with relevant authorities on individual enforcement cases tofurther strengthen cooperative relationships, thereby ensuring that support is available
when it is needed.

4.

➢With reference to the Memorandum of Cooperation (MOC) on personal information
protection between the PPC Japan and the UK ICO, which was concluded in October
2023, working on signing new MOCs with like-minded countries and regions having
shared fundamental values with Japan, with the aim of expanding the group of MOC
signatories.

➢Pursuing the possibility of specific bilateral and regional cooperation, including technicalassistance such as supporting the development of personal information protection
legislation, with a priority given to the Asia-Pacific region.

Understanding international trends and disseminating information

The PPC Japan will work to build and develop networks with DPAs and experts in the field of
personal information protection, and to cooperate with them in exchanging relevant informationand opinions to address issues such as technological innovations and social challenges. The
PPC Japan will also make policies by incorporating such information and opinions, while taking
global trends into consideration.

4In addition, the PPC Japan will spread the information widely and make it available to businesses
that operate internationally, in particular regarding foreign legislations on the protection of
personal information in line with the needs for the business.

5.

Strengthening the foundation of the institutional arrangement of the international
affairs teams and training the skills of officials engaged in the international affairs

To achieve the aforementioned goals of the global strategy, the PPC Japan will enhance thefoundation of institutional arrangement of the international affairs teams and focus on improving
the following capabilities as part of the human resource development of officials being engaged
in the international affairs:(1) Strengthening the foundation of the institutional arrangement of the international affairs teams➢ Further ensuring enough human resources for the proper implementation of tasks
related to the issues, such as emerging technologies and cross-border enforcement
cooperation.
➢Considering secondment of our officials to an overseas counterpart organization,
including embassies of Japan and foreign DPAs, in addition to internationalorganizations where our officials have been already deployed, for the purpose of having
direct communication channel with foreign DPAs and international organizations andgathering information on relevant matters from them.

(2) Training the skills of officials engaged in the international affairs➢ Enhancing presentation skills to deliver the PPC Japan's policies to the public in a global
occasion.
➢Enhancing facilitation skills to lead a discussion at international forums.

➢Enhancing information gathering skills of the latest developments in personal
information protection, including emerging technologies such as Privacy Enhancing
Technologies (PETs).

5