資料１−１

ACCJ Comments for the Personal Information Protection
Commission Public Hearing
The ACCJ believes the approach to put users’ privacy and security at the center of
their regulatory guidance aligned to global data protection and privacy practices
is important. At a time when an increasing number of bad actors are working
towards undermining privacy and security e.g., by breaking certain kinds ofencryption, we encourage the PPC to continue with its principles-led risk based
approach, and ensure that the APPI remains interoperable with global standards.

With the need for interoperability in mind, it would be helpful for the PPC to provide
more guidance with clear, actionable and measurable outcomes based on practicaluse cases that enable industry to implement or enhance the existing APPI without
necessarily having to add more powers, introduce new laws etc. For instance,businesses sometimes face the challenge by the lack of consistency among userorganizations for personal data protection, and we hope the PPC’s guidance will
be beneficial for encouraging user organizations to take consistent, reasonable,and appropriate actions. We also recommend that the PPC’s guidance considers
and explains the benefit that individuals and society can gain by data flow andutilization and shows the way to protect privacy while returning the benefit toindividuals and society. This would include testing and proving that some of theassumptions in the APPI are capable of achieving effective results. We also
encourage the assessment of effective regulation instead of relying on penalties
or fines. Moreover, we recommend the PPC to consider the global effects ofregulation and how APPI can also be more effective on a multi stakeholder basis
to achieve privacy outcomes that ensure interoperability with global regulations.

We think it is prudent in the current market and economic conditions to take stockof the cybersecurity measures and best practices that are already in place. Many
global organizations already invest in security in order to adhere to global
standards, and some have industry-specific obligations. We therefore
recommended that any PPC guidance permit organizations to leverage widely
recognized cybersecurity standards. The PPC can also use the guidance to give
positive incentives for Japanese businesses as well as global organizations toinvest more in cybersecurity to earn trust in the course of handling personal data
in Japan. Recently, the unwanted leakage of personal data is increasing in relation
to the growing tension in the international situation. We believe enhancing theability to advance cybersecurity while leveraging existing standards is necessary
in line with the need to advance national security.

In this respect, a detailed consultation study with industry, civil society, and awide range of stakeholders for insights into the specific privacy and securitychallenges would go a long way towards informed policy and regulatory changes.
At the same time, the PPC can keep to a principles led and risk-based approach.

As the PPC further deepens these discussions, the ACCJ is happy to further
coordinate and appreciates the opportunity to engage throughout the process.