ACCA-FIAJ Joint Seminar
Cloud Computing Services
Usage by the Financial Services Industry
Business Models and Regulatory Approach

Overview of Amendments to Personal Information
Protection Act (“PIPA”)
November 1, 2016

弁護士 大橋宏一郎 | OhashiK@gtlaw.com | 03‐4510‐2207
GREENBERG TRAURIG, LLP | ATTORNEYS AT LAW | WWW.GTLAW.COM©2014 Greenberg Traurig, LLP. All rights reserved.

What is PIPA?
> “Act Concerning Protection of Personal Information” (LawNo. 57, May 30, 2003)– Appropriate use of Personal Information will produce newindustries, develop economy, and contribute enrichment oflife– On the other hand, due to the rapid development of
information technology, the risk of intrusion to rights andinterests of individuals is increased– Accordingly, regulations on business enterprises that handle
Personal Information> Amendment to PIPA (enacted Sept. 3, 2015)– To respond to further development and globalization of
information communication
Greenberg Traurig, LLP | gtlaw.com

Title of Presentation

2

PIPA in the context of Cloud Computing Services> Cloud Computing Services– Cross‐border nature of data administration and storage– Mobility of Personal Information to foreign countries– “Regulations on Data Transfer to Foreign Third Parties”(Amended Article 24)

Greenberg Traurig, LLP | gtlaw.com

Title of Presentation3

Major Amendment Points> Crystallize the definition of Personal Information– “Personal Information”:
 Information concerning a living individual that can identify a specificindividual by name, date of birth or other descriptions, including:• Information that can easily refer to other information which can identify anindividual (e.g., transaction history linked to Personal Information)• Personal Identification Codes, such as:
oCode in which the specification of a body part of specific individual is transformed
for computer processing (e.g., fingerprints, face authentication information, etc.)

oCode exclusively provided to respective person in order to use a service, purchasegoods, or provide to documents (e.g., passport number, driver license number)– Sensitive Personal InformationoE.g., thoughts, briefs, clinical histories, etc.

• Cannot transfer to third parties by Opt Out method

Greenberg Traurig, LLP | gtlaw.com

Title of Presentation4

Major Amendment Points> Anonymously Modified Information– Information that is modified from Personal Information
so as not to identify a specific individual and to restore
it back to the original Personal Information

Greenberg Traurig, LLP | gtlaw.com

Title of Presentation5

Major Amendment Points> Transfer of Personal Information to Foreign Third Parties– Basic Rule of Transfer of Personal Information to Third Parties(including affiliates): Obtain consent from data subject
 Exceptions:• Opt Out: the right to stop transferring Personal Information to a third
party upon request is reserved to a data subjecto Prior disclosure is required••••Purpose of Data Transfer to Third Party
Data Items to be Transferred
Method of Data Transfer
Protocol of Opt Out

o Notification to Personal Information Protection Committee (“PIPC”) isrequired (New requirement)•Greenberg Traurig, LLP | gtlaw.com

Notification will be published

Title of Presentation

6

Major Amendment Points> Transfer of Personal Information to Foreign Third Parties(Cont’d)• Outsourcing: to outsource all or a part of data processing toan outside vendor (including group companies):o The outside vendor

Third partyo Data Security Agreemento Regular Compliance Check• Joint Use: Prior notification to data subject is required:o Data items to be jointly usedo Persons who jointly use the datao Initial purpose of joint use at the time of data acquisitiono Name of data administration officer responsible

Greenberg Traurig, LLP | gtlaw.com

Title of Presentation7

Major Amendment Points> Transfer of Personal Information to Foreign Third Parties (Cont’d)– Basically, it is necessary to obtain consent from data subject for
the transfer of Personal Information to a foreign third party
 Exceptions:• Foreign third parties in those countries that PIPC designates, or• Foreign third parties which comply the standard set forth by PIPC “Foreign Third Party”:• Japan corp. to its foreign branch• Japan corp. to its foreign sub.
• Japan sub. of foreign corp. to its HQGreenberg Traurig, LLP | gtlaw.com

NoYes
Yes

Title of Presentation8

Major Amendment Points> Transfer of Personal Information to Foreign ThirdParties (Cont’d)
 “Transfer”:• Even Outsourcing or Joint Use requires Consent on transfer
to foreign countries• Exceptions: transfer to such countries that PIPC designates,or to a foreign third party that complies with the standard
set forth by PIPC “The Standard Set Forth by PIPC”• OECD Privacy Guidelines• APEC Privacy Framework
Greenberg Traurig, LLP | gtlaw.com

Title of Presentation9

Major Amendment Points> Change in Regulators– Regulators in each industry area (e.g., Financial Services
Agency for financial industries)– PIPC To ensure due handling of Personal Information

Greenberg Traurig, LLP | gtlaw.com

Title of Presentation10Effective Date of Amended PIPA
> First half of 2017

Greenberg Traurig, LLP | gtlaw.com

Title of Presentation

11

Any questions?
> Please contact:
Koichiro Ohashi
Greenberg Traurig Tokyo Law Offices
OhashiK@gtlaw.com
03‐4510‐2207

Greenberg Traurig, LLP | gtlaw.com

Title of Presentation

12