I N S I G H T

HANDBOOK 2020

© Law Business Research

HANDBOOK
2020

Reproduced with permission from Law Business Research Ltd
This article was first published in November 2019
For further information please contact Natalie.Clarke@lbresearch.com© Law Business ResearchPublished in the United Kingdom
by Global Data Review
Law Business Research Ltd
Meridian House, 34–35 Farringdon Street, London, EC4A 4HL, UK© 2019 Law Business Research Ltd
www.globaldatareview.com
To subscribe please contact subscriptions@globaldatareview.com
No photocopying: copyright licences do not apply.
The information provided in this publication is general and may not apply in a specificsituation. Legal advice should always be sought before taking any legal action basedon the information provided. This information is not intended to create, nor does
receipt of it constitute, a lawyer–client relationship. The publishers and authors accept
no responsibility for any acts or omissions contained herein. Although the information
provided was accurate as at October 2019, be advised that this is a developing area.
Enquiries concerning reproduction should be sent to Law Business Research, at
the address above. Enquiries concerning editorial content should be directed tothe editor – tom.webb@globaldatareview.com.
© 2019 Law Business Research Limited
ISBN: 978-1-83862-235-0
Printed and distributed by Encompass Print Solutions
Tel: 0844 2480 112© Law Business Research

CONTENTS
INTRODUCTION�������������������������������������������������������������������������������������������������������������������������� 1
Giles Pratt
Freshfields Bruckhaus Deringer LLP

PrivacyBRAZIL: PRIVACY��������������������������������������������������������������������������������������������������������������������� 9
Fabio Ferreira Kujawski, Paulo Marcos Rodrigues Brancher and Thiago Luís Sombra
Mattos Filho, Veiga Filho, Marrey Jr e Quiroga Advogados

CHINA: PRIVACY�������������������������������������������������������������������������������������������������������������������� 20
Samuel Yang
AnJie Law Firm

EUROPEAN UNION: PRIVACY��������������������������������������������������������������������������������������������� 29
Gernot Fritz, Christoph Werkmeister and Annabelle Hamelin
Freshfields Bruckhaus Deringer LLP

GERMANY: PRIVACY��������������������������������������������������������������������������������������������������������������45
Philip Kempermann
Heuking Kühn Lüer Wojtek

JAPAN: PRIVACY������������������������������������������������������������������������������������������������������������������� 55
Akira Matsuda, Kohei Yamada and Haruno Fukatsu
Iwata Godo

MEXICO: PRIVACY����������������������������������������������������������������������������������������������������������������� 69
Rosa María Franco
Axkati Legal SC

SINGAPORE: PRIVACY��������������������������������������������������������������������������������������������������������� 80
Lim Chong Kin and Janice Lee
Drew & Napier LLC

UNITED STATES: PRIVACY������������������������������������������������������������������������������������������������� 95
Miriam H Wugmeister, Julie O’Neill, Nathan D Taylor and Hayley Curry
Morrison & Foerster LLPiii© Law Business Research

CONTENTS

Cybersecurity
BRAZIL: CYBERSECURITY��������������������������������������������������������������������������������������������������121
Thiago Luís Sombra
Mattos Filho, Veiga Filho, Marrey Jr e Quiroga Advogados

CHINA: CYBERSECURITY���������������������������������������������������������������������������������������������������129
Richard Bird
Freshfields Bruckhaus Deringer LLP

ENGLAND & WALES: CYBERSECURITY��������������������������������������������������������������������������141
Mark Lubbock and Anupreet Amole
Brown Rudnick LLPMEXICO: CYBERSECURITY������������������������������������������������������������������������������������������������159
Guillermo E Larrea
Jones DaySINGAPORE: CYBERSECURITY����������������������������������������������������������������������������������������164
Lim Chong Kin
Drew & Napier LLC

UNITED STATES: CYBERSECURITY�������������������������������������������������������������������������������� 175
Avi Gesser, Matthew J Bacal, Matthew A Kelly, Daniel F Forester,
Clara Y Kim and Gianna C Walton
Davis Polk & Wardwell LLPiv© Law Business Research

CONTENTS

Data in Practice
CHINA: DATA LOCALISATION��������������������������������������������������������������������������������������������195
Samuel Yang
AnJie Law Firm

DATA-DRIVEN M&A��������������������������������������������������������������������������������������������������������������201
Giles Pratt and Melonie Atraghji
Freshfields Bruckhaus Deringer LLP

EUROPEAN UNION AND UNITED STATES: ANTITRUST AND DATA�����������������������216
Ben Gris and Sara Ashall
Shearman & Sterling

UNITED STATES: ARTIFICIAL INTELLIGENCE���������������������������������������������������������������231
H Mark Lyon, Cassandra L Gaedt-Sheckter and Frances Waldmann
Gibson, Dunn & Crutcher LLPRESPONDING TO THE GDPR ENFORCEMENT REGIME�������������������������������������������� 257
Frances McLeod and Simon Taylor
Forensic Risk Alliancev© Law Business ResearchPREFACE
Global Data Review is delighted to publish this inaugural edition of the GDR Insight Handbook.
The handbook delivers specialist intelligence and research to our readers – general
counsel, government agencies and private practitioners – who must navigate the world’s
increasingly complex framework of legislation that affects how businesses handle their data.
The book’s comprehensive format provides in-depth analysis of the global developments in key areas of data law and their implications for multinational businesses. Experts
from across Europe, the Americas and Asia consider the latest trends in privacy and cyber­security. Attention is also given to new legislation in the United States that regulates theuse of artificial intelligence, and strict data localisation rules emerging in jurisdictions
such as China. The handbook provides practical guidance on the implications for companies wishing to buy or sell data sets, and the intersection of privacy, data and antitrust.
A chapter is dedicated to assessing how companies should respond to the GDPR enforcement regime.
In preparing this report, Global Data Review has worked with leading data lawyers andconsultancy experts from around the world and we are grateful for all their cooperationand insight.
The information listed is correct as at October 2019. Although every effort has been
made to ensure that all the matters of concern to readers are covered, data law is a complex
and fast-changing field of practice, and therefore specific legal advice should always besought. Subscribers to Global Data Review will receive regular updates on any changes torelevant laws over the coming year.
We would like to thank all those who have worked on the research and production ofthis publication.
Global Data Review
LondonOctober 2019vi
© Law Business Research

PART 1
Privacy© Law Business Research

JAPAN: PRIVACY
Akira Matsuda, Kohei Yamada and Haruno Fukatsu
Iwata Godo

Key statutes, regulations and adopted international standards
In Japan, data protection regulation for private sector and public sector are separately legislated. We explain below the overview for both sectors, with a focus predominantly on theprivate sector, which is particularly relevant to this book’s readership.

Rules for business operators in the private sector
The Act on the Protection of Personal Information
The Act on the Protection of Personal Information (the APPI) (Act No. 57 of 2003) is theprincipal legislation in Japan dealing with data protection regulating the private sector. The
APPI originally came into force in 2005 and was drastically overhauled in 2017 to take into
account rapid techno­logical developments (artificial intelligence, big data, etc) and globalisation, which have brought about new challenges and the increasing need to protect personal
data in an environment where the scale of data collection and the sharing of personal data
have increased tremendously.
The APPI sets forth obligations imposed on ‘business operators’ (see ‘Foreign groups
with an office in Japan’). As the convenient exemption applicable to small and medium-sizedenterprises was abolished as part of the 2017 amendments, almost all Japan-based business
operators will be covered by the APPI (but not exclusively), regardless of the amount of
personal data they are handling or the size of their business (see ‘The effect of local laws on
foreign businesses’).
To clarify and ensure the enforcement of these obligations, the APPI sets forth a basic
framework regulating the responsibilities and policies of the national and local governmentswith regard to the protection of personal information (see ‘Regulatory bodies’ and ‘The
effect of local laws on foreign businesses’); establishes the Personal Information Protection
Commission (PPC) and defines its roles as the national data protection authority in Japan(see ‘Regulatory bodies’); and provides for a set of enforcement measures such as imprisonment or criminal fines.

55© Law Business ResearchJapan: Privacy  | Iwata Godo

Guidelines
The PPC has adopted guidelines to ensure the proper and effective implementation of action
to be taken by business operators. The PPC’s general guidelines supplement the APPI and
separate guidelines apply to specific sectors such as the finance, medical and telecommunications sectors.

Rules for public-sector organisations
Acts covering the protection of personal information in the public sector
Public-sector organisations need to comply with following:• the Act on the Protection of Personal Information Held by Administrative Organs (ActNo. 58 of 2003); and• the Act on the Protection of Personal Information Held by Incorporated Administrative
Agencies, etc (Act No. 59 of 2003).

Local regulations
All prefectures and municipal governments in Japan have set forth local regulations on theprotection of personal information. The prefectures and municipal governments, and publicschools or public hospitals of the prefectures and municipal governments, are covered bythese local regulations.

Regulatory bodies
The PPC is the sole national data protection authority in Japan. The local watchdog was set
up as an authority independent from other government bodies. Pursuant to the terms of the
APPI, the PPC chairperson and members exercise their judgement and authority independently. The main roles of the PPC are as follows.
• The PPC formulates basic policies on the protection of personal information in accordance with the APPI and promotes the protection of personal information in the public
and private sectors. These basic policies include guidelines,1 which are updated fromtime to time.
• The PPC has the power to issue guidance and advice, request reports, conduct on-site
inspections, make recommendations and issue orders to government institutions andbusiness operators. The range of enforcement measures available is prescribed underarticle 42 of the APPI.
• The PPC promotes cooperation with data protection authorities in foreign countries
through formal and informal exchanges of views with foreign data protection authorities.

1

Guidelines for the Act on the Protection of Personal Information (General Rules); Guidelines for the Act on
the Protection of Personal Information (Obligations of Confirmation and Recording at the Time of Provisionof Personal Data to Third Parties); Guidelines for the Act on the Protection of Personal Information(Provision to a Third Party in a Foreign Country); Guidelines for the Act on the Protection of Personal
Information (Anonymously Processed Information); and Guidelines on Personal Information Protection in the
Financial Industry.

56© Law Business Research

Iwata Godo | Japan: Privacy•

For the purpose of ensuring the proper handling of personal information, the PPC accredits
private organisations (ie, accredited personal information protection-­organisations) thatprovide services such as receiving complaints on the handling of personal information,
the provision of advice to those making a complaint and the investigation of the circumstances surrounding a complaint based on the APPI. In addition, the PPC supervises theseaccredited organisations, requiring them to report on the conduct of their services, andmay order them to improve their services or take any other necessary action.

The effect of local laws on foreign businesses
Foreign groups with an office in Japan
The APPI imposes obligations on business operators handling personal information (ie, business operators). A business operator is defined as ‘an entity using a personal information
database for use in its business’. Public entities are expressly excluded from this definition.
However, there is no similar carve-out for the benefit of companies incorporated in a foreigncountry or entities having their head office located in a foreign country (ie, a foreign company).
This definition reflects the official position of the PPC that the APPI obligations and provisions equally apply to foreign companies if these foreign companies fall under the definitionof business operator in Japan. The PPC takes the view that a foreign company is a business
operator if it uses a personal information database for its business conducted in Japan, regardless of the place of incorporation or location of the head office.
Therefore, if a foreign company has a branch office or a business office in Japan, or if aforeign company conducts its business in Japan, and uses a personal information database forits business in Japan, this foreign company will fall under the definition of ‘business operator’.
Furthermore, if a foreign company has a subsidiary in Japan using a personal information
database for its business in Japan, this subsidiary falls within the definition of a business
operator (although the foreign company itself might not necessarily be covered by the APPI).
Accordingly, if a foreign company has an office in Japan, which falls under the definition of‘business operator’, regardless of whether such office is branch, business office or subsidiary,
APPI-complaint compliance systems must be put in place.

Foreign groups without an office in Japan
Even if a foreign company has no office in Japan, if this foreign company is collecting personal
information from individuals in Japan in connection with a supply of goods or services tothese individuals, certain obligations under the APPI would apply to them on an extra­
territorial basis. Accordingly, these entities must take measures to comply with these provisions of the APPI.

57© Law Business ResearchJapan: Privacy  | Iwata Godo

Core principles on personal data
The key concepts under the APPI are the following:• ‘Personal information’ means information by which a specific living individual is identifiable or information containing an individual identification code (ie, passport number
or driver’s licence number). Personal information includes information that can bereadily combined with other information and make the identification of a specific individual possible.
• ‘Personal data’ means personal information constituting a personal information database.
• ‘Personal information database’ means a collective body of information comprising
personal information systematically organised to be able to retrieve personal information.
• ‘Personal information requiring special care’ means sensitive information categorised anddefined under the APPI that requires special handling measures, including but not limited
to the individual’s race, creed, social status, medical history, criminal record, and status as
the victim of a crime (ie, sensitive personal information).
• ‘Anonymously processed information’ means information processed so that such information can no longer be used to identify a specific individual with the necessary safeguards
prescribed by the APPI being taken to make it impossible to retrieve personal information.

Overview of the main obligations under the APPIThe following chart provides a brief outline of the obligations imposed on business operatorsfor each phase during which information is handled.
Phase

Type of information

Summary of duties

I

Personal
information

Disclosure of the purpose of use prior to collection of personal
information

Collection

No need to obtain the individual’s consent (except for sensitive
personal information)
II

Utilisation

Personal
informationand personal data

No need to obtain the individual’s consent when utilising within thescope of a previously disclosed purpose of use
Duty to take reasonable security measures including preventing
the leakage, loss of, or damage to, personal data when handlingpersonal data58
© Law Business Research

Iwata Godo | Japan: Privacy

Phase

Type of information

Summary of duties

III

Personal data

Consent requirement

Third-party
disclosure

In principle, individual consent is required for disclosure of personal
data to a third party
Consent requirement is exempted in case of entrustment of personaldata, disclosure upon business succession (ie, M&A), and joint use
Regarding joint use, if a business operator informs in advance orensures that the individual can easily become aware of five statutory
elements, the business operator can jointly utilise personal datawith a third party, such as a subsidiary, without obtaining any priorindividual consent to the disclosure
If the business operator meets the opt-out process requirements,
there is no need to obtain the individual’s consent upon eachdisclosure of personal data (except for sensitive personal
information)
Traceability requirement
An entity disclosing personal data to a third party must keep track(ie, records) of disclosure
An entity receiving personal data from a third party must confirm thestatus of the disclosing party and keep track of disclosure
Cross-border transfer restrictions
In principle, individual consent is required for disclosure to a third
party in a foreign country
Consent requirement is exempted in those cases described below.

Cross-border transfer restrictions
Unless exemption requirements are met, a business operator disclosing personal data to athird party in a foreign country must obtain the individual’s prior consent. However, theconsent requirement is exempted in the following cases:• Transfer to a country that is designated by rules of the PPC as a foreign country having
established a personal information protection system recognised as being subject toequivalent standards to those applicable in Japan with regard to the protection of anindividual’s rights and interests (currently, only the European Union is designated as such
(effective as of 23 January 2019))• The disclosing business operator and the recipient ensure that the recipient develops andimplements arrangements through appropriate and reasonable measures for the handlingof personal data to be performed consistently with the APPI obligations provisions. These
measures may include:• contracts between the disclosing business operator and the recipient; or• internal rules that are commonly applied to the disclosing business operator and therecipient.
• The recipient receives certification based on the APEC cross-border privacy rules framework (CBPR). The PPC explicitly accepts the APEC-CBPR certification as qualified to meetthe standards for ’recognition based on a cross-border privacy rules framework’.
59© Law Business ResearchJapan: Privacy  | Iwata Godo

Overview of the main enforcement measures in the APPIThe main enforcement measures are: imprisonment or criminal fine; an order to cease, desist
and take other necessary action to rectify a violation of the APPI against the business operators; or any other action deemed necessary by the PPC within its authority.

Automated processing, profiling and data analytics
There is currently no regulation specifically restricting automated processing, profiling anddata analytics. Under article 12 of the Supplement of the Act amending the APPI, the Japanese
government is required to review the rules governing personal information every three years
in the light of global trends, technological and industrial developments affecting the protection of personal information. Therefore, the Japanese government may have to review the
restrictions on profiling in 2020.
Under the current interpretation of the APPI, even if information that is equivalent tosensitive personal information is generated or presumed as a result of profiling, this information does not qualify as sensitive personal information under the APPI.
In addition, a business operator handling anonymously processed information is notallowed to collate this information with other information to identify an individual towhom the anonymously processed information relates under the APPI. However, if a business
operator identifies a certain individual as a result of profiling using anonymously processed
information, this business operator is not considered to have collated anonymously processed
information with other information to identify an individual to whom the anonymously
processed information relates.

Communications and marketing
Telecommunications
Telecommunications businesses are very large-scale businesses involving the public and,given the nature of their business, operators generally handle large amounts of personal information. Accordingly, the Ministry of Internal Affairs and Communications (MIC), acting as
supervisory authority for the telecommunications sector, has issued the following guidelines.

Guidelines regarding the protection of personal information for thetelecommunications sector
These guidelines contain rules that telecommunication business operators should comply
with when they collect, use and transfer information such as communications history, information on callers that includes callers’ ID and location information (caller information) for
telecommunications (phone calls).

60© Law Business Research

Iwata Godo | Japan: Privacy

Guidelines regarding personal information of the caller in the service of
notification of caller information
Certain telecommunication business operators provide a service of notifying the caller’s
information to the receiver of the call (the caller information notification service). Because
caller information is treated as personal information, the MIC has adopted the ‘Guidelines
regarding personal information of the caller in the context of caller information notification services’.
These guidelines contain rules that caller information notification service providers
should comply with when they record, use and transfer caller information.

Other
The MIC has established a working group regarding the handling of information stored insmartphones such as location information and history of communications (smartphone user
information) and this working group has published a Smartphone Privacy Initiative paperthat reports their conclusions on how smartphone user information should be protected.
The MIC has also established a committee for the review of the handling of location information in the case of emergency. This committee has reviewed how location information
should be utilised for accident prevention. This committee has issued a non-binding reporton how such information be protected.

Marketing
The APPI does not restrict the scope of the purpose of use (including use for marketing
purposes) as long as the purpose of use has been disclosed to the public (ie, privacy policy on
the website) or notified to individuals. E-marketing is also regulated by the Act on Specified
Commercial Transactions (Act No. 57 of 1976) and the Act on Regulation of Transmission ofSpecified Electronic Mail (Act No. 26 of 2002).

The Act on Specified Commercial Transactions
Under this act, sellers or service providers can only make advertisement to consumers via
email when recipients opt in to receive email; when sellers or service providers send email
advertisement with notice of matters regarding contracts (ie, finalisation of an agreement
and shipment of goods); or when sellers or service providers send an email advertisementwith an email newsletter that is sent with consent from a recipient.

The Act on Regulation of Transmission of Specified Electronic Mail
Under this act, senders can only advertise via email when recipients opt in to receive such
email; when recipients notify their email address to the sender in writing (for instance, by
providing a business card); when recipients have a business relationship with the sender; or
when recipients make their email address available on the internet for business purposes.

61© Law Business ResearchJapan: Privacy  | Iwata Godo

Individuals’ rights
Right to request disclosure
A data subject may request disclosure of retained personal data2 to a business operator that
holds such retained personal data. A business operator must disclose the retained personal
data without delay in writing when having received such request.3
However, the business operator is exempt from disclosing the retained personal data
requested pursuant to article 28(1) of the APPI, in whole or in part, if:• there is a possibility of harming a data subject or a third party’s life, body, assets or otherrights and interests;• there is a possibility of seriously interfering with the business operator from running its
business properly; or• the disclosure violates other laws and regulations.

Right to request correction, addition or deletion
A data subject may request a business operator to make a correction, addition or deletion(collectively, correction) in relation to the content of retained personal data when said
retained personal data is incorrect.4 The business operator must conduct a necessary investigation without delay to the extent necessary to achieve a purpose of use and, based on the
result thereof, make a correction of the content of the retained personal data when having
received the request pursuant to article 29(1) of the APPI.5
However, the business operator is exempt from making a correction where a special procedure concerning a correction of the content is prescribed by other laws or regulations.6

Right to request suspension of use or deletion
A data subject may request suspension of use or deletion (suspension of use) of the retained
personal data if that data is handled in violation of article 16 (purpose-of-use limitation)of the APPI, has been acquired in violation of article 17 (proper acquisition) of the APPI, or
has been disclosed to a third party in violation of article 23(1) (Restriction on disclosure toa third party) or article 24 (Restriction on disclosure to a third party in a foreign country)of the APPI.7 A business operator must suspend the use of the retained personal data to the2

Retained personal data is defined as personal data held by a business operator for more than six months(on the other hand, if the personal data is deleted within six months, such personal data does not fallunder the retained personal data and the business operator is not required to respond to the data
subject’s request) (article 2(7) of the APPI).

3	Articles 28(1)–(2) of the APPI.
4	Article 29(1) of the APPI.
5	Article 29(2) of the APPI.
6

id.

7	Article 30(1) and (3) of the APPI.

62© Law Business Research

Iwata Godo | Japan: Privacy

extent necessary to remedy the violation without delay, following receipt of a request madepursuant to article 30(1) or (3) of the APPI and when it has become clear that there is a reason
for the request.8
However, the business operator is exempt from suspension of use where a suspension ofuse of the retained personal data requires a large amount of expenses or other cases where
it is difficult to fulfil a suspension of use, and when necessary alternative action is taken toprotect the rights and interests of the data subject.9

The role of the data protection officer
The APPI has no provision mandating the appointment of a data protection officer. However,a business operator is required to take necessary and appropriate action for the security
control of personal data including preventing the leakage, loss or damage of its handled
personal data.10 In connection with this provision, the PPC Guidelines require a business
operator to take security control measures, including the following:(i) Organisational security control measures: appointing a person responsible for handlingpersonal data, establishing a system to respond to leakage, loss or damage or personaldata, and conducting safety audits on systems that manage personal data.
(ii) Human security control measures: employee training on the handling of personal data.
(iii) Physical security control measures: access control to areas where important personal
data is handled, and storage of documents containing personal data in a cabinet thatcan be locked.
(iv) Technical security control measures: for example, installing a firewall on computersconnected externally through networks, and putting restrictions on access to systems
that handle personal data.
As stated in (1), since the appointment of a person responsible for handling personal data
is listed as one example of organisational safety control measures in the PPC Guidelines, itis the prevailing practice in Japan for a business operator to appoint the responsible person
whose tasks or roles are similar to that of a data protection officer in many other jurisdictions.

8	Article 30(2) and (4) of the APPI.
9	Article 30(2) and (4) of the APPI.
10	Article 20 of the APPI.

63© Law Business ResearchJapan: Privacy  | Iwata Godo

Procedure for dealing with data protection breaches and the consequences
For inspectors and investigators, the PPC has the power to require a business operator to
submit necessary information or materials relating to the handling of personal informationor have its officials enter a business office or other necessary places of a business operator,enquire about the handling of personal information, or inspect books, documents and otherproperties.11
As to corrective measures, the PPC has the power to:• issue guidance or advice against a business operator with regard to handling personal
information;12• recommend a business operator to suspend the violation act or take other necessary
action to rectify the violation when recognising there is a need to protect an individual’s
rights and interests in cases where the business operator has violated the various provisions of the APPI; and• order a business operator to take action in line with the recommendation when recognising that a serious infringement of an individual’s rights and interests is imminent
in cases where the business operator having received a recommendation pursuant toarticle 42(1) of the APPI did not take action in line with the recommendation without
legitimate ground.13
A business operator who has violated an order pursuant to article 42(2) shall be subject toimprisonment with labour for not more than six months or a criminal fine of not more than
¥300,000.14

Updates and trends
Reciprocal adequacy decision (European Union and Japan)
The European Commission adopted its adequacy decision on Japan on 23 January 2019. On
the same date, Japan admitted the European Commission member states as jurisdictions
giving adequate level of protection as regards personal data. These mutual adequacy decisions remove cross-border transfer restrictions of personal data between the European Union
and Japan. Accordingly, the European Union and Japan comprise the world’s largest ‘free tradezone’ of personal data, which is in line with the Economic Partnership Agreement enteredinto between the European Union and Japan as of 1 February 2019.

11	Article 40(1) of the APPI. During fiscal year 2018, there were two cases where the PPC investigated thebusiness offices of the business operators and 391 cases where the PPC required business operators to
submit information or materials.
12	Article 41 of the APPI. During fiscal year 2018, there were two cases where the PPC issued guidance oradvice to business operators.
13	Article 42(2) of the APPI.
14	Articles 84 and 87 of the APPI.

64© Law Business Research

Iwata Godo | Japan: Privacy

Proposed amendment to the APPIThe APPI was originally enacted in 2003 and was revamped in May 2017 to strengthen dataprotection regulations in line with global standards. As mentioned above, at the time of the2017 revision, it was agreed that the revised APPI would be reviewed every three years. At
present, the PPC is reviewing the Act and preparing amendments due to become effective in
2020. Among others, the following three points are likely to be reviewed:• right to request suspension of use regardless of violation of the APPI on business
operators;15••

the introduction of the concept of pseudonymisation; andthe digitalisation of information disclosure.

In addition, the adoption of the ‘right to be forgotten’ has been discussed but is not expected
to be covered in the 2020 review.

Surveillance laws
CCTV
Images of individuals captured by a surveillance camera and facial recognition data obtained
from these images fall under personal information if the images or data can be used to identify a specific individual.
In addition, when such images or facial recognition data are stored in a systematically organised manner, they fall under ‘personal information database’ and are treated as
personal data.
Therefore, the regulations under the APPI would apply to the collection, use or transfer ofimages of individuals captured by a surveillance camera and facial recognition data obtained
from those images.

Email monitoring
Article 21, paragraph 2 of the Constitution of Japan guarantees the secrecy of any means ofcommunications as a basic human right. In accordance with the Constitution of Japan, theTelecommunications Business Act, the Wire Telecommunications Act and the Radio Act in
the area of telecommunications contain provisions protecting the secrecy of communications.
For example, the Telecommunications Business Act provides that ‘the secrecy of communications being handled by a telecommunications carrier shall not be violated’,16 which
prohibits a third party other than originators and recipients from intentionally viewing
communications managed by the telecommunications carrier. Any person who violates
provisions of the Telecommunications Business Act is subject to criminal punishment. For

15	This is an extension of the right to request suspension of use or deletion.
16	Article 4(1).

65© Law Business ResearchJapan: Privacy  | Iwata Godoexample, any person who has violated the secrecy of communications handled by a telecommunications carrier shall be punished by imprisonment with labour of not more than two
years or a criminal fine of not more than ¥1 million.17
Accordingly, private organisations may not conduct email monitoring in principle. If a
company investigates employees’ emails that are stored on an internal server to investigate
misconduct in the company, this investigation may not violate the secrecy of communications or the right of privacy. However, when conducting an investigation, a cautious approach
would be to obtain the consent of the data subject, and if this is not possible, it is recommended to obtain proper legal advice.

Case studies
Benesse Corporation (Benesse) contracted Synform Co Ltd (Synform) for the development
and operation of a system to analyse the personal information of Benesse’s customers. In
2014, it became known that an employee of a subcontractor of Synform had leaked personal
information of multiple Benesse’s customers (such as name, gender, date of birth, address,
telephone number and email address), and this incident attracted significant attention.
Regarding this case, several civil ( Japanese-style) class action lawsuits have been filed
against Benesse and Synform by customers based on tort, claiming damages for mental
suffering. In one of these lawsuits, the Tokyo High Court entered a judgment on 27 June 2019,
admitting the liability of Benesse and Synform and ordering them to pay ¥2,000 to eachindividual plaintiff.
This case demonstrates that it is important to comply with data protection regulations
to mitigate risks of dispute. Furthermore, the judgment refers to the fact that Benesse has
paid voluntary compensation to each victim (¥500 per person to approximately 35 million
people). As a result of such voluntary compensation payment, Benesse recorded a ¥26 billion
special loss during such fiscal year, including ¥6 billion to strengthen security controls and¥20 billion to fund voluntary compensation.

17	Article 179(1).

66© Law Business Research

Iwata Godo | Japan: Privacy

Akira Matsuda
Iwata Godo
Akira Matsuda is an attorney-at-law (admitted in Japan and New York) and a partner
at Iwata Godo heading the AI/TMT and data protection practice group. He is basedin Tokyo and Singapore. His practice focuses on cross-border transactions, including
M&A, as well as international disputes (litigation and arbitration), and advice on
digital and TMT-related matters. Mr Matsuda regularly advises Japanese and foreignclients on data security issues ( Japanese laws, Singapore’s Personal Data Protection
Act and the EU General Data Protection Regulation) including on the structuring of
global compliance systems. He also advises on complicated cross-border corporate
investigation matters.
He is a graduate of the University of Tokyo (LLB) and Columbia Law School (LLM).

Kohei Yamada
Iwata Godo
Kohei Yamada is a Japanese attorney-at-law and an associate at Iwata Godo. His
practice focuses on M&A and corporate law. His diverse corporate practice includes
corporate governance and compliance, shareholders’ meetings (listed companies), anddispute resolution. Mr Yamada has advised many Japanese and foreign clients on dataprotection and privacy issues. He graduated from the University of Tokyo (LLB and JD).

67
© Law Business ResearchJapan: Privacy  | Iwata Godo

Haruno Fukatsu
Iwata Godo
Haruno Fukatsu is a Japanese attorney-at-law and an associate at Iwata Godo. Her practice primarily focuses on corporate law including corporate governance and compliance,
shareholders’ meetings (listed companies), M&A and domestic commercial dispute
resolution. Ms Fukatsu is a member of AI/TMT and data protection practice group andhas advised many clients on data protection, privacy and cybersecurity issues, including
under Japanese laws and the EU General Data Protection Regulation. She graduatedfrom the University of Osaka (LLB) and the University of Kyoto ( JD).

Iwata Godo is one of Japan’s premier and oldest law firms. It was established in 1902 as one of the firstbusiness law firms by Chuzo Iwata, an attorney-at-law who subsequently held various positions, including
serving as Minister of Justice and president of the Japan Federation of Bar Associations. It is a full-service firmwith about 70 attorneys and each of its practice areas is highly regarded. It is the firm of choice for clientswith respect to their most challenging legal issues, including in relation to data protection. Over the past few
years, Iwata Godo has hosted a number of international seminars and conferences on data protection, often incoordination with ‘best friend’ firms that are renowned firms and market leaders in their jurisdictions.

Marunouchi Building 10F
2-4-1 Marunouchi,
Chiyoda-ku, Tokyo
100-6310, Japan
Tel: +81 3 3214 6205

Akira Matsuda
amatsuda@iwatagodo.com

www.iwatagodo.com/english

Haruno Fukatsu
haruno.fukatsu@iwatagodo.com

Kohei Yamada
kyamada@iwatagodo.com

68© Law Business Research

The GDR Insight Handbook delivers specialist intelligence and researchto our readers – general counsel, government agencies and private
practitioners – who must navigate the world’s increasingly complex
framework of data legislation. In preparing this report, Global Data Review
has worked with leading data lawyers and consultancy experts fromaround the world.
The book’s comprehensive format provides in-depth analysis of thedevelopments in key areas of data law. Experts from across Europe, theAmericas and Asia consider the latest trends in privacy and cybersecurity,
providing practical guidance on the implications for companies wishing tobuy or sell data sets, and the intersection of privacy, data and antitrust.

Visit globaldatareview.com
Follow @GDR_alerts on Twitter
Find us on LinkedIn
ISBN 978-1-83862-235-0© Law Business Research