Outline of the amended
Personal Information Protection ActFebruary, 2016
Personal Information Protection Commission
Japan

Back ground of amendment of Personal Information Protection Act
Personal Information Protection Act (PIPA) came into force (2005)
Circumstance has been changed
１．Increasing the possibility of using personal data due todevelopment of Information Technology
Demand for clarifying the definition of “personal information”
２．Evolution of Big Data
Demand for the appropriate use of “Big Data” while protecting personalinformation
３．Globalization
Demand for making rules about cross-border data transfer

Outline of the amendment of the Personal Information Protection Act

1. Clearer definition of “Personal Information”
2. Rules for utilizing Personal Data
3. Establishment of Personal Information
Protection Commission(PPC)
4. Globalization
5. Others1. Clearer definition of “Personal Information”●Define in detail what “ Personal Information” is, so as to remove
any gray areas
Personal Information

・name・address
・date of birth

FacialFingerprint
recognition
data
data

Passport
numberDriver’s
licensenumberMY NUMBER（Individualnumbers）＝newly defined*＝*Other information will be determined as personal information by Cabinet Order.

1. Clearer definition of “Personal Information”●Newly Defined Sensitive Personal Information
Sensitive Information is race, religion,
 medical history
 personal information which has potential to bring about
unjustifiable discrimination or prejudice

Require prior consent in
obtaining Sensitive Personal
Informationconsent
Sensitive
PersonalInformation

2. Rules for utilizing Personal Data
●Set rules for utilization of De-identified Information
De-identified information is
information①processed to be unidentifiable to said person②prohibited from restoring said personal information*both conditions should be metprocess
Personal
Information

restoreDe-identifiedInformation

3. Establishment of Personal Information Protection Commission (PPC)●PPC is an independent comprehensive supervising authority of
personal information protection, while personal information
protection is now under the supervision of the relevant competent
Ministers according to the business field.
Current
Personal Information
Protection Commission

Competent Ministers

After the amended Act
comes into force

PPC

monitor/supervise
Personal
Information relating
to MY NUMBER

PersonalInformation

monitor/supervise
Personal
Information relating
to MY NUMBER

PersonalInformation

4. Globalization●Set 3 permissible types of transfer of personal data toa third party in a foreign state①Obtaining prior consent to do so②The third party is in a state where regulation on personal information protection isconsidered to be equivalent to that of Japan.
③The third party maintains an internal personal information protection system
consistent with standards set by the PPC.

●Set rules of the extraterritorial application of the Act●Cooperation by the PPC in cross-borderenforcement

5. Others●Enable the PPC to trace when and who

provides/receives Personal Information in order toavoid improper use of Personal Information.
PersonalInformation

Business operator ABusiness operator B

RecordAug.17 2016
Provided customer’s
information to B

RecordAug.17 2016
Received customer’s
information from A

5. Others●Introduce criminal penalties for improper use of
Personal Information databases, such as data theft orproviding information to third parties etc., for wrongfulgain.
●Apply to small business operators handling 5,000 orless items of Personal Information, which are notsubject to the current act.

MilestoneJanuary 1, 2014

Established the Specific
Personal Information
Protection Commission

September 9, 2015

Promulgated the amended
Act on the Protection of
Personal Information

January 1, 2016

Establish the Personal
Information Protection
Commission

2017(TBD)

The amended Act fully
comes into force

Supervision

CompetentMinisters

Commission