Comments on the “Policy Outline of the Institutional Revision for the Utilization of Personal Data” [Overview]
July 2014, The Consumer Commission
The “Policy Outline of the Institutional Revision for the Utilization of Personal Data” (approved by the Strategic Headquarters for the Promotion of an Advanced
Information and Telecommunications Network Society on June 24, 2014) contains many areas that are not specifically defined, such as the scope of personal
data to be protected and details of measures to be taken. Therefore, the Consumer Commission has provided some comments on the policy outline forprotecting the benefits of consumers in order to provide an insight when details of system design and other factors are put in a bill.
Policy Outline of the Institutional Revision for the Utilization of Personal Data
1. Providing personal data to third parties and unintended use(1) Handling of data with reduced possibility of certain individuals being identified⇒ making it possible to provide personal data to third parties and use it for
purposes other than those specified without obtaining consent from thepersons by defining proper handling.
(2) The scope of personal information ⇒ clarifying personal data to be protectedamong “those pertinent to the physical characteristics of individuals, such as
fingerprint recognition data and face recognition data”.
(3) The process to change the purpose of the use of personal data ⇒establishing a system that enables people to request that their personal data
should not be utilized for a new purpose (the opt-out method), while devisinga procedure that enables them to acknowledge the changes fully.
2. Creating of a framework for the establishment and compliance with theself-regulations led by the private sector
Non-governmental organizations shall be able to lay down self-regulations(the third-party authority shall be able to certify the applicable regulations,non-governmental organizations or others).
3. Ensuring enforcement of an effective system by developing a third-party
authority system(1) Developing a third-party authority system ⇒the third-party authority shallhave the powers and functions of performing onsite inspections in addition to
the powers and functions which the competent minister currently has, andcertify self-regulations and others.

Comments from the Consumer Commission○ The level of reduction and details of “the proper handling” should be clarified.
Ensuring transparency that is sufficient enough to substitute obtaining
consent of the persons and prohibiting re-identification form the key details of“the proper handling.” It is also important to ensure that the third-party
authority responds quickly if problems occur.
○ When the scope of personal information is clarified, it is necessary toconsider not to limit personal data as the scope of protection excessively.
○ On the process to change the purpose, the general rules that require consentof the persons should be applied preferentially. Moreover, permittingchanging the purpose of the use of personal data by using the opt-out method
without careful consideration is not appropriate.
○ Consumer protection should be ensured by the consumer’s practicalparticipation in the process of establishment of self-regulations rule. The thirdparty authority is required to create a new guideline which will be applied forthe areas where there is no self-regulations rule.
○ The third-party authority is required to serve proper function and roll fordeveloping the system to ensure effective enforcement and efficient operation.
Experts who become involved from the perspective of customer protection
should participate in the decision-making process by the third-party authority
as commissioner.

(2) System for accepting complaints ⇒ no clear specifics about contact points
that consumers can consult directly.

○ If new contact points cannot be created, it is expected that many complaints
will be lodged against Consumer affairs center around Japan. Close
coordination between the third-party authority and local public organizations(Consumer affairs centers) is required, and information and training must beprovided for consultants for consumers.

(3) Limitation of the scope of warnings and orders for corrections of the breach⇒ excluding the breach of those that do not meet certain requirements
caused by an intentional act or act of gross negligence.

○ Establishment of the system proposed by the policy outline should be avoided
because the purpose of the system is not clear, and there are possibilities ofcircumvention and decrease of effectiveness of law.

4. Issues to be further discussed(1) Dispute resolution structure ⇒ being issues to be discussed further inaccordance with the actual state of disputes that will occur in the future.
(2) Issues related to so-called list brokers ⇒ actions that can be taken toprevent criminal acts and the victimization of consumers from occurring andthe victimization from increasing shall be issues to be further discussed.

○ It is required to prepare the dispute resolution structure from the beginning ofstarting the new system. The third-party authority should take charge ofdispute resolution as administrative ADR organ and advance the utilization of
ADR in the private sector.
○ Implementation of the effective measures at the same time as theestablishment of the new system is an urgent issue.