DIJ Web-Forum

Data and Values
June 10, 2021
Hitomi Iwase

Introduction
Hitomi Iwase

Partner
Attorney-at-Law, admitted inJapan and New YorkTEL: +81-3-6250-6218 (Direct)
Email: h.iwase@nishimura.com
Practice Areas: IP/IT/Data Privacy

Education:
Waseda University (LL.B.)
Stanford Law School (LL.M.)

Ms. Hitomi Iwase is a partner at Nishimura & Asahi
specializing in the areas of intellectual property (IP),information technology (IT) and data privacy. She
handles patents, copyrights, trademarks, trade secrets
and other IP-related matters in multiple business sectors,including IT, life sciences and healthcare, machinery,food, fashion, environment and energy, entertainment,
financial services, and e-commerce. Ms. Iwase’s
expertise encompasses all forms of IP transactional work,
both cross-border and domestic, including licensing,strategic alliances, joint development, and asset transfers,
as well as various types of IP disputes, including
patent/trademark infringement litigation. She also assistsclients in anti-counterfeiting and in the development of
IP portfolios and prosecution strategies. Ms. Iwase
regularly advises clients on emerging legal issues
relating to the latest technology, such as IoT andartificial intelligence (AI), as well as on complex
system-related transactions and disputes over thosetransactions. In the area of data privacy, Ms. Iwase
extensively provides advice on data protection andprivacy compliance, including on establishment ofglobal compliance systems as well as incidents such asdata breaches. Ms. Iwase also advises on related areas
such as e-commerce, advertising, and consumer
protection.
1

Introduction – Nishimura & Asahi Largest law firm in Japan, with more than 700 attorneys, including patent &trademark attorneys and foreign attorneys / approximately 1,700 personnel intotal.

 4 offices in Japan, and 14 offices (including 2 offices in Germany), including

representative offices, outside Japan.

*For details: https://www.nishimura.com/en2

Privacy Law in Japan - APPI Act on the Protection of Personal Information (個人情報保護法)• Key piece of legislation governing personal information in Japan• Purpose: to balance the rights and interests of individuals v. use of personalinformation• Enacted in 2004 and became fully effective in 2005; the first amendment
came into full effect on May 30, 2017, and the latest amendments were in2020 and 2021
• Provides general rules concerning the protection of personal information in
the private sector (regulates the handling (collection, storage and use) of
personal information), as well as protocols for the government- Details are clarified through common guidelines promulgated by the PersonalInformation Protection Commission (PPC)- Enforced by the PPC- The PPC can request a report, conduct investigations, and may issue instructions ororders3

Japanese Privacy LawsConstitution / Court Precedent

Act on the Protection of Personal Information (個人情報保護法)
Basic data protection policies (Ch. 1-3)
Rules applicable toprivate sector (Ch. 4-7)

the[Details are clarified through common
guidelines promulgated by the
Personal
Information
ProtectionCommission (PPC)]Businesses handlingpersonal information in theprivate sector

Act on theProtection of
Personal
Information Heldby Administrative
Organs (行政機関
個人情報保護法)National
government

Act on theProtection of
Personal
Information Heldby Independent
Administrative
Agencies (独立行政機関個人情報保護法)

e.g. National
Hospital Org.,
National University
Hospital

Ordinances on theprotection of
personal
information
established by
local governments

Local governments,
including municipal
hospitals

4

Data Protected under the APPI Three categories  different rules apply• Personal information (PI) (個人情報)- Information about a living individual that falls under any of the following items:i.

information containing a name, date of birth or other descriptions whereby a specificindividual can be identified (including information that allows easy reference to otherinformation that would thereby enable identification of the individual); orii.

information containing an individual identification code, which is a code, including characters,numerical characters and marks, that can be used to identify a specific individual and which isspecified in a cabinet order (e.g., biometric identifiers such as fingerprint data or facialrecognition data, passport or driving licence numbers).

* IP addresses and cookie IDs typically do not fall under Personal Information.

• Personal data (PD) (個人データ)- personal information contained within a personal information database- “personal information database” = a collection of information• Retained personal data (RPD) (保有個人データ)- personal data that a business operator has the authority to disclose, correct,
discontinue the use of, erase, etc.
5Overview of Obligations under the APPI
Obligations of Business Handling PI
Purposes ofuse

PIPD

RPD

Specify purposes of use
Purpose restrictions*No improper use

Collection

Proper collection
Notify or publicly announce the purposes of use

Management

Keep accurate and up to date, etc.
Security control measures
Supervision over employees
Supervision over service providers*Breach notification

Provision toothers

Restriction on provision to third parties
Restriction on provision to third parties located outside Japan
Confirmation and record obligations

Data subject
rightsDisclosure
Correction, deletion, etc.
Cease use/provision to third parties
6

Rules regarding Cross-Border Data Transfer
 General rule: You cannot provide personal data to third parties located in aforeign country without the subject individual’s prior consent• when transferring personal data to a third party (including group companies) in aforeign country, in general, consent from the data subject is required Exceptions: Provision to a third party with a management system conformingto the standards set out in the PPC rules:• recognition by the APEC Cross-Border Privacy Rules (CBP)• when the parties ensure compliance with relevant provisions of the APPI by taking
appropriate and reasonable measures -- by a data transfer agreement (similar to theconcept of SCC under EU law) or intercompany rules (similar to the concept of BCR
under EU law)
• to a country that is designated by the PPC as having legislation equivalent to theAPPI (currently the EEA and the UK)  Japan’s adequacy decision7Harmonization and Data Free Flow “Data Free Flow with Trust” (DFFT) -- Former Prime Minister

Abe’s speech at the Davos World Economic Forum in January
2019• Digital data will increasingly be the engine for growth• We must, on one hand, be able to put our personal data and data
embodying intellectual property, national security intelligence… under careful protection, while on the other hand, we must
enable the free flow of medical, industrial, traffic and other mostuseful, non-personal, anonymous data to see no borders.
 More harmonization?

8