The In-House Lawyer Spring 2020

Brand and reputation management

The top three data protection law topics in Japan
Saori Hanada, partner, Fumiaki Matsuoka, partner, and Osamu Fujiwara, partner, Atsumi & Sakai

In Japan, the Act on the Protection of
Personal Information (APPI) is the primary
law that regulates data protection issues.
In this article, we will cover a few significant
recent amendments to the APPI, including
one currently under consideration, while also
touching on the new guidelines issued by theJapan Fair Trade Commission (JFTC) last year,
which highlight an intersection of the APPIand Japanese competition law, as well as theincreasing significance of personal data in
M&A transactions.

Saori Hanada
Partner, Atsumi & Sakai
saori.hanada@aplaw.jp

Fumiaki Matsuoka
Partner, Atsumi & Sakai
fumiaki.matsuoka@aplaw.jp

Osamu Fujiwara
Partner, Atsumi & Sakai
osamu.fujiwara@aplaw.jp

96 | The In-House Lawyer Spring 20202015 amendments to the APPIThe APPI was enacted in 2003 and went
through its first major amendment in 2015
(the 2015 amendment). In accordance with the2015 amendment, the Personal Information
Protection Commission (PPC) was establishedas the supervisory governmental organisation
for privacy protection on 1 January 2016, andsince then the agency has issued a numberof administrative guidelines concerning
the APPI. The 2015 amendment was fully
enforced in 2017, which led to anothernoteworthy development with regard tothe APPI. The European Commission (EC)recognised the APPI as having an adequatelevel of data protection by GDPR standards in2019. This adequacy decision by EC was met
with open arms by Japanese companies as it
would allow for data transfers from EEA toJapan without additional safeguard measures.

2020 Amendment to the APPIOn 10 March 2020, the cabinet submitted a bill toamend the APPI which is expected to be enacted
into law in 2020 (the 2020 amendment).
Companies will face more stringent
obligations under the 2020 amendment. For
example, while the current APPI does not
stipulate any reporting obligation on data
breach, there will be a legal obligation to reportcertain data breaches after the reform. The
penalties for violating orders issued by the PPC
will also be harsher. In its preparation for the2020 amendment, the PPC, being the agency incharge of this amendment, looked to the GDPR
for guidance as it viewed the GDPR as theglobal standard for data protection, and it wasimportant for the APPI to have an adequatelevel of data protections by the GDPR standard.
Although companies outside of Japan will
be required to be compliant with APPI after
the enforcement of the amendment, there
are currently a substantial number of cases
where companies outside of Japan do not
appropriately process personal information ofindividuals within the country. Companies,
including those non-compliant companies, willdefinitely need to promptly report to the PPC
in the event of data breach taking place outsideof Japan. This is because, after the amendment,
the PPC will be issuing orders to companies
abroad that process personal data of individuals
in Japan inappropriately, and will publish thosecases on its website.

Atsumi & Sakai

The In-House Lawyer Spring 2020

The Guidelines provide a non-exhaustive
list of conducts by digital platform
operators related to the use of personal
information which can amount to an
abuse of superior bargaining position.

Digital platform operatorsand personal information
The JFTC, the primary enforcement
agency of the Antimonopoly Act, the maincompetition law in Japan, published theGuidelines Concerning Abuse of a Superior
Bargaining Position in Transaction between
Digital Platform Operators and Consumers
that Provide Personal Information etc (theGuidelines) on 17 December 2019. An‘abuse of a superior bargaining position’ isa unilateral conduct prohibited under theAntimonopoly Act, which is analogous to an
abuse of dominance. For business operators
to be held accountable for the abuse of asuperior bargaining position, there needs tobe a comparatively superior position vis-àvis a business operator’s counterpart in thetransactions between them, not dominancein the market.
With the aim to clarify and enhance thepredictability for digital platform operators
as to the enforcement of the Antimonopoly
Act, the Guidelines provide a non-exhaustive
list of conducts by digital platform operators
related to the acquisition or use of personal
information which can amount to an abuse ofsuperior bargaining position. Such conducts
include acquiring personal information
without stating the purpose of use toconsumers, acquiring or using personal
information against consumers’ intention
beyond the scope necessary to achieve saidpurpose of use, and acquiring or using
personal data without taking necessary
and appropriate precautions for the safe
management of personal information.
As the Guidelines concern issues
regulated by the APPI, the PPC issued astatement saying that it would co-operatewith the JFTC when it discovers facts thatcan potentially be deemed as an unfair
acquisition or use of personal information
by a digital platform operator which holds
a superior bargaining position. In return,the PPC requested the JFTC to co-operate
when it discovers a potential abuse of asuperior bargaining position related to thetreatment of personal information so that thePPC can evaluate the relevant facts from its
perspective. In response, the JFTC agreed toco-operate with the PPC on the abuse of asuperior bargaining position between digitalplatform operators and consumers providing
personal information to the extent necessary.
Data compliance in M&A deals
The Information Commissioner’s Office(ICO), the supervisory authority in theUK, announced its intention to impose afine of more than £99,200,396 on MarriottInternational, Inc for its infringements ofGDPR last year. It was also revealed by
the ICO that Marriott failed to conduct
sufficient due diligence in its acquisitionof Starwood.

In Japan, this case drew significant
attention as Marriott was found to be
responsible for the vulnerability of Starwood’s
IT system in a cybersecurity incident which
took place prior to the acquisition. Throughthis case, Japanese companies reaffirmed
the importance of compliance with personal
data protection laws in M&A transactions.
In particular, as a purchaser, companies mustemphasise the importance of due diligence
focused on data protection (DDDP) of theirtarget companies in M&A transactions. The
results of DDDP should then be used by thepurchasers for not only deciding whether or
not to proceed with the M&A transactionand examining the validity of purchaseprices but also for establishing action plans
to properly process personal informationof their target companies post-closing. It isalso advisable for the purchasers to consider
inserting into their M&A agreements
essential clauses such as representations andwarranties as well as covenants in order tohedge the risks related to data protection.
In practice, however, purchasers cannot
always conduct a full DDDP for various
reasons such as sellers refusing to disclose
all the necessary information about them,
the purchasers being unable to bear costsof the DDDP etc. It is therefore advisable
for Japanese companies to determine thescope of their DDDP, by prioritising in eachindividual transaction. nAtsumi & Sakai | 97