September 14, 2018

Collection and use of personal information by Japanese publicauthorities for criminal law enforcement and national security
purposes
The following document provides an overview of the legal framework for thecollection and use of personal (electronic) information by Japanese public authorities
for criminal law enforcement and national security purposes (hereinafter referred toas "government access"), in particular as regards the available legal bases,
applicable conditions (limitations) and safeguards, including independent oversightand individual redress possibilities. This representation is addressed to the European
Commission with a view to express the commitment and provide assurances thatgovernment access to personal information transferred from the EU to Japan will belimited to what is necessary and proportionate, subject to independent oversight andthat concerned individuals will be able to obtain redress in case of any possible
violation of their fundamental right to privacy and data protection. This representation
also provides for the creation of a new redress mechanism, administrated by the
Personal Information Protection Commission (PPC), to handle complaints by EU
individuals concerning government access to their personal data transferred from the
EU to Japan.
I. The general legal principles relevant for government access
As an exercise of public authority, government access must be carried out in fullrespect of the law (legality principle). In Japan, personal information is protectedacross both the private sector and the public sector by a multi-layered mechanism.
A. Constitutional framework and reservation of law principle
Article 13 of the Constitution and case law recognize the right to privacy as aconstitutional right. In this respect, the Supreme Court has held that it is natural that
individuals do not want others to know their personal information without good reason,and that this expectation should be protected. 1 Further protections are enshrined in
Article 21(2) of the Constitution, which ensures respect for the secrecy ofcommunications, and Article 35 of the Constitution, which guarantees the right not tobe subject to search and seizure without warrant, meaning that the collection of
personal information, including access, by compulsory means must always be based1

Supreme Court , Judgement of September 12, 2003(2002 (Ju) No.1656)1

on a court warrant. Such a warrant may only be issued for the investigation of analready committed crime. Therefore, in the legal framework of Japan, informationcollection by compulsory means for the purpose of (not a criminal investigation but)national security is not allowed.
Moreover, in accordance with the reservation of law principle, compulsory
information collection must be specifically authorised by law. In case of noncompulsory/voluntary collection, information is obtained from a source that can be
freely accessed or received based on a request for voluntary disclosure, i.e. arequest that cannot be enforced against the natural or legal entity holding theinformation. However, this is only permissible to the extent the public authority iscompetent to carry out the investigation, given that each public authority can only act
within the scope of its administrative jurisdiction prescribed by the law (irrespective ofwhether or not its activities interfere with the rights and freedoms of individuals). This
principle applies to the authority’s ability to collect personal information.
B. Specific rules on the protection of personal information
The Act on the Protection of Personal Information (APPI) and the Act on theProtection of Personal Information Held by Administrative Organs (APPIHAO), which
are based on and further detail the constitutional provisions, guarantee the right topersonal information in both the private and public sectors.
Article 7 of the APPI stipulates that the PPC shall formulate the "Basic Policy on
the Protection of Personal Information" (Basic Policy). The Basic Policy, which isadopted through decision of the Cabinet of Japan as central organ of the Japanese
government (Prime Minister and Ministers of State), shall set the direction for theprotection of personal information in Japan. In this way, the PPC, as an independent
supervisory authority, serves as the "command centre" of Japan's personal
information protection system.
Whenever administrative organs collect personal information, and irrespective ofwhether they do so by compulsory means or not, they in principle 2 have to comply
with the requirements of the APPIHAO. The APPIHAO is a general law applicable tothe processing of "retained personal Information" 3 by "administrative organs" (asdefined in Article 2(1) of the APPIHAO). It therefore also covers data processing in
the area of criminal law enforcement and national security. Among the public2

For exceptions with respect to Chapter 4 of the APPIHAO, see below at p.16.

3

Retained Personal Information” in Article 2(5) of the APPIHAO means personal information prepared or
obtained by an employee of an administrative organ in the course of that employee’s duties and held by thatadministrative organ for organizational use by its employees.

2authorities authorized to implement government access, all authorities, except thePrefectural Police, are national government authorities that fall under the definition of"administrative organs". The handling of personal information by the Prefectural
Police is governed by prefectural ordinances 4 that stipulate principles for theprotection of personal information, rights and obligations equivalent to the APPIHAO.
II. Government access for criminal law enforcement purposesA) Legal bases and limitations
1) Collection of personal information by compulsory meansa) Legal bases
According to Article 35 of the Constitution, the right of all persons to be secure in
their homes, papers and effects against entries, searches and seizures shall not be
impaired except upon a warrant issued for “adequate cause” and particularly
describing the place to be searched and things to be seized. Consequently, thecompulsory collection of electronic information by public authorities in the context of acriminal investigation can only take place based on a warrant. This applies to boththe collection of electronic records containing (personal) information and the real-time
interception of communications (so-called wiretapping). The only exception to thisrule (which however is not relevant in the context of an electronic transfer of personal
information from abroad) is Article 220(1) of the Code of Criminal Procedure 5 ,according to which a public prosecutor, a public prosecutor's assistant officer or a
judicial police official may, when arresting a suspect or "flagrant offender", ifnecessary carry out a search and seizure "on the spot at the arrest".
Article 197(1) of the Code of Criminal Procedure provides that compulsory
measures of investigation "shall not be applied unless special provisions have been
established in this Code". With respect to the compulsory collection of electronic
information, the relevant legal bases in this regard are Article 218(1) of the Code of
Criminal Procedure (according to which a public prosecutor, a public prosecutor's
assistant officer or a judicial police official may, if necessary for the investigation of
an offense, conduct a search, seizure or inspection upon a warrant issued by a4

Every prefecture has its own “prefectural ordinance” applicable to the protection of personal information by
the Prefectural Police. No English translations for these prefectural ordinances exist.

5

Article 220(1) of the Code of Criminal Procedure provides that when a public prosecutor, a publicprosecutor's assistant officer or a judicial police official arrests a suspect, (s)he may, if necessary, take thefollowing measures: (a) entry into the residence of another person etc. to search for the suspect; (b) search,
seizure or inspection on the spot at the arrest.

3

judge) and Article 222-2 of the Code of Criminal Procedure (according to which
compulsory measures for the interception of electronic communications without theconsent of either party shall be executed based upon other Acts). The latter provisionrefers to the Act on Wiretapping for Criminal Investigation (Wiretapping Act), which in
its Article 3(1) stipulates the conditions under which communications relating tocertain serious crimes can be wiretapped based on a wiretapping warrant issued by ajudge. 6
Regarding the police, the investigate authority lies in all cases with the Prefectural
Police, whereas the National Police Agency (NPA) does not conduct any criminal
investigations based on the Code of Criminal Procedure.
b) Limitations
The compulsory collection of electronic information is limited by the Constitution
and empowering statutes, as interpreted in case law, which in particular provide forthe criteria to be applied by courts when issuing a warrant. In addition, the APPIHAO
imposes a number of limitations applicable to both the collection and handling of
information (while local ordinances reproduce essentially the same criteria for thePrefectural Police).
(1) Limitations following from the Constitution and the empowering statuteAccording to Article 197(1) of the Code of Criminal Procedure, compulsory
dispositions shall not be applied unless special provisions have been established inthis Code. Article 218(1) of the Code of Criminal Procedure then stipulates that
seizure, etc. may be carried out based on a warrant issued by a judge only "ifnecessary for the investigation of an offense". Although the criteria for judging

6

More specifically, this provision prescribes that “the public prosecutor or the judicial police may, in thecases falling under any of the following items, when there is a situation sufficient to suspect that
communications will take place concerning commitment, preparations, conspiracies on follow-up actions
such as suppression of evidence, etc., instructions and other intercommunication of the crime prescribed ineach of the said items (hereinafter referred to as “a series of crimes” in the second and third items), as wellas communications containing the matters related to the said crime (hereinafter referred to as"communications relating to crime" in this paragraph) and in the cases where it is extremely difficult to
identify the criminal or clarify the situations/details of the perpetration by any other ways, wiretap
communication relating to crime, based on the wiretapping warrant issued by a court judge, regarding ameans of communications, which is specified by phone number and other numbers/codes to identify sourceor destination of the phone and is used by the suspect based on the contract with telecommunications
carriers, etc. (except those which can be regarded as there is no suspicion to be used as “communications
relating to crime”) , or those on which there are grounds to suspect to be used as “communications relatingto crime”, wiretapping of the communications relating to crime by this means of communications can be
conducted.”4necessity are not further specified in statutory law, the Supreme Court 7 has ruled that,when assessing the necessity of dispositions, the judge should make an overall
assessment, taking into consideration notably the following elements:(a) Gravity of the offense and how it was committed;(b) Value and importance of the seized materials as evidence;(c) Probability of concealment or destruction of seized materials;(d) Extent of the disadvantages caused by a seizure;(e) Other related conditions.
Limitations follow also from the requirement in Article 35 of the Constitution toshow "adequate cause". Under the "adequate cause" standard, warrants can beissued if: [1] there is the necessity for criminal investigation (see the Supreme Court
Ruling on March 18, 1969 (1968 (Shi) No.100) mentioned above), [2] there is asituation where the suspect (the accused) is considered to have committed an
offense (Article 156 (1) of the Rules of Criminal Procedure) 8 [3] The warrant on
investigation for body, articles, residence or any other place of a person other than
the accused should be issued only when it is reasonably supposed that articles whichshould be seized exist .(Article 102 (2) of the Code of Criminal Procedure ). When ajudge considers that the documentary evidence submitted by investigative authorities
presents insufficient grounds to suspect a crime, he/she will dismiss the request for awarrant. It should be noted in this regard that under the Act on Punishment ofOrganized Crimes and Control of Crime Proceeds, “preparatory acts to commit” aplanned crime (e.g. preparation of money for committing a terrorism crime)themselves constitute a crime and can thus be subject to compulsory investigation
based on a warrant.
Finally, where the warrant concerns the investigation of the body, articles,
residence or any other place of a person other than the suspect or accused, it shall
only be issued when it can reasonably be assumed that the articles which shall be
seized exist (Article 102(2) and 222(1) of the Code of Criminal Procedure).
As regards specifically the interception of communications for the purpose of
criminal investigations based on the Wiretapping Act, it may be conducted only when
the strict requirements provided in its Article 3(1) are satisfied. According to thatprovision, the interception always requires a court warrant in advance, which may
only be issued in limited situations 9.

7Judgement of March 18th, 1969 (1968 (Shi) No.100).

8

Article 156(1) of the Rules of Criminal Procedure provides: "In filing the request set forth in paragraph (1)of the preceding Article, the requester shall provide materials based on which the suspect or the accusedshould be considered to have committed an offense."

9

See footnote 6.

5

(2) Limitations following from the APPIHAO
As regards the collection 10 and further handling (including notably the retaining,
managing and using) of personal information by administrative organs, the APPIHAO
stipulates in particular the following limitations:(a) According to Article 3(1) of the APPIHAO, administrative organs may retain
personal information only when the retention is necessary for performing theduties falling within their jurisdiction as provided by laws and regulations. Upon
retention, they are also required to specify (as much as possible) the purposeof use of personal information. According to Article 3(2), (3) of the APPIHAO,
administrative organs shall not retain personal information beyond the scopenecessary for the achievement of the purpose of use thus specified, and shallnot change the purpose of use beyond what can reasonably be considered as
appropriately relevant for the original purpose.
(b) Article 5 of the APPIHAO provides that the head of an administrative organ
shall endeavour to maintain the retained personal information accurate and up
to date, within the scope necessary for the achievement of the purpose of use.
(c) Article 6(1) of the APPIHAO provides that the head of an administrative organ
shall take the measures necessary for the prevention of leakage, loss, or
damage, as well as for the proper management of the retained personal
information.
(d) According to Article 7 of the APPIHAO, no (including: former) employee shalldisclose the acquired personal information to another person without ajustifiable ground, or use such information for an unjust purpose.
(e) Moreover, Article 8(1) of the APPIHAO provides that the head of an
administrative organ shall not, except as otherwise provided by laws andregulations, use or provide another person with retained personal information
for purposes other than the specified purpose of use. While Article 8(2)contains exceptions from this rule in specific situations, these only apply ifsuch exceptional disclosure is not likely to cause "unjust" harm to the rights
and interests of the data subject or a third party.

10

Article 3(1) and (2) of the APPIHAO restrict the extent of retention and, thereby, also the collection of
personal information.

6

(f)

According to Article 9 of the APPIHAO, where retained personal information isprovided to another person, the head of an administrative organ shall, if
necessary, impose restrictions on the purpose or method of use, or any othernecessary restrictions; it may also request the receiving person to takemeasures necessary for the prevention of leakage and for the proper
management of the information.

(g) Article 48 of the APPIHAO provides that the head of an administrative organ
shall endeavour to process any complaints regarding the handling of personal
information properly and expeditiously.
2) Collection of personal information through requests for voluntary cooperation(Voluntary investigation)a) Legal basis
Aside from using compulsory means, personal information is obtained either from asource that can be freely accessed or based on voluntary disclosure, including by
business operators holding such information.
As regards the latter, Article 197(2) of the Code of Criminal Procedure empowers
the prosecution and judicial police to make "written inquiries on investigative matters"(so-called "enquiry sheets"). Under the Code of Criminal Procedure, the inquired
persons are requested to report to investigative authorities. However, there is no way
to force them to report, if the public offices, or the public and/or the privateorganizations, who received the inquiries, refuse to comply. If they do not report for
the inquiries, no criminal punishment or other sanction can be imposed. If theinvestigative authorities consider the requested information indispensable, they willneed to obtain the information through search and seizure based on a court warrant.
Given the growing awareness of individuals as regards their privacy rights, as wellas the workload created by such requests, business operators are more and morecautious in answering such requests 11. In deciding whether to cooperate, business
operators in particular take into account the nature of the information requested, theirrelationship with the person whose information is at stake, risks to their reputation,
litigation risks, etc.
b) Limitations

11

See also the notification issued by the National Police Agency on December 7th, 1999 (below at p.9) whichstates the same point.

7

As for the compulsory collection of electronic information, voluntary investigation islimited by the Constitution, as interpreted in case law, and the empowering statute. In
addition, business operators are not legally allowed to disclose information in certain
situations. Finally, the APPIHAO provides for a number of limitations applicable toboth the collection and handling of information (while local ordinances reproduce
essentially the same criteria for the Prefectural Police).
(1) Limitations following from the Constitution and the empowering statute
By taking the purpose of Article 13 of the Constitution into consideration, theSupreme Court in two decisions of December 24th, 1969 (1965 (A) No.1187) and
April 15th, 2008 (2007 (A) No.839) has imposed limits to voluntary investigations
conducted by investigatory authorities. While these decisions concerned cases
where personal information (in the form of images) was collected throughphotography/filming, the findings are relevant for voluntary (non-compulsory)investigations interfering with an individual's privacy in general. They therefore apply,and have to be complied with, as regards the collection of personal information
through voluntary investigation, taking into account the specific circumstances ofeach case.
According to these decisions, the legality of voluntary investigation depends on thefulfilment of three criteria, namely:− "suspicion of a crime" (i.e. it must be assessed whether a crime has beencommitted);− "necessity of investigation" (i.e. it must be assessed whether the request
stays within the scope of what is necessary for the purposes of theinvestigation); and− "appropriateness of methods" (i.e. it must be assessed whether voluntary
investigation is "appropriate" or reasonable in order to achieve the purposeof the investigation). 12

In general, taking into account the above three criteria, the legality of voluntary
investigation is judged from the viewpoint of whether it can be considered reasonablein accordance with socially accepted conventions.

12

Gravity of the crime and urgency are relevant factors to assess the "appropriateness of methods".

8

The requirement for the investigation to be "necessary" also follows directly from
Article 197 of the Code of Criminal Procedure, and has been confirmed in the
instructions issued by the National Police Agency (NPA) to the Prefectural Police as
regards the use of "enquiry sheets". The NPA Notification of 7th December 1999
stipulates a number of procedural limitations, including the requirement to use"enquiry sheets" only if necessary for the purposes of the investigation. In addition,
Article 197(1) of the Code of Criminal Procedure is limited to criminal investigations,and can thus be applied only where there is a concrete suspicion of an alreadycommitted crime. Conversely, this legal basis is not available for the collection anduse of personal information where no violation of the law has yet occurred.
(2) Limitations with respect to certain business operators
Additional limitations apply in certain areas based on the protections provided inother laws.
First, investigative authorities as well as telecommunication carriers holding
personal information have a duty to respect the secrecy of communications as
guaranteed by Article 21(2) of the Constitution. 13 Besides, telecommunication
carriers have same duty under Article 4 of the Telecommunication Business Act 14.
According to the “Guidelines on Personal Information Protection in
Telecommunications Business", which have been issued by the Ministry of Internal
Affairs and Communications (MIC) based on the Constitution and theTelecommunication Business Act, in cases where the secrecy of communications is
at stake, telecommunication carriers must not disclose personal information
regarding the secrecy of communication to third parties, except where they haveobtained the individual's consent or if they can rely on one of the "justifiable causes"
for non-compliance with the Penal Code. The latter relate to “justifiable acts” (Article
35 of the Penal Code), “Self-Defense” (Article 36 of the Penal Code) and “Averting
Present Danger” (Article 37 of the Penal Code). "Justifiable acts" under the Penal
Code are only those acts of a telecommunication carrier by which it complies withcompulsory measures of the State, which excludes voluntary investigation. Therefore,
if the investigative authorities request personal information based on an "enquiry

13

Article 21(2) of the Constitution states: "No censorship shall be maintained, nor shall the secrecy of anymeans of communication be violated."

14

Article 4 of the Telecommunication Business Act states: "(1) The secrecy of communications being handled
by a telecommunications carrier shall not be violated. (2) Any person who is engaged in atelecommunications business shall not disclose secrets obtained, while in office, with respect tocommunications being handled by a telecommunications carrier. The same shall apply even after he/she has
left office."9

sheet" (Article 197(2) of the Code of Criminal Procedure), a telecommunication
carrier is prohibited from disclosing the data.
Second, business operators are bound to refuse requests for voluntary cooperation
where the law prohibits them from disclosing personal information. As an example,
this includes cases where the operator has a duty to respect the confidentiality of
information, for instance pursuant to Article 134 of the Penal Code 15.
(3) Limitations based on the APPIHAO
As regards the collection and further handling of personal information byadministrative organs, the APPIHAO provides for limitations as explained above insection II.A.1) b) (2). Equivalent limitations follow from the prefectural ordinances
applicable to the Prefectural Police.
B) Oversight1) Judicial oversight
As regards collection of personal information by compulsory means, it must be
based on a warrant 16 and is thus subject to the prior examination by a judge. In casethe investigation was illegal, a judge may exclude such evidence in the subsequentcriminal trial of the case. An individual may request such exclusion in his/her criminal
trial claiming that the investigation was illegal.
2) Oversight based on the APPIHAO
In Japan, the Minister or Head of each ministry or agency has the authority ofoversight and enforcement based on the APPIHAO, while the Minister of Internal
Affairs and Communications may investigate the enforcement of the APPIHAO by allother ministries.

15

Article 134 of the Penal Code states: "(1) When a physician, pharmacist, pharmaceuticals distributor,
midwife, attorney, defense counsel, notary public or any other person formerly engaged in such a profession
discloses, without justifiable grounds, another person's confidential information which has come to be
known in the course of such profession, imprisonment with work for not more than 6 months or a fine of not
more than 100,000 yen shall be imposed. (2) The same shall apply to the case where a person who is or was
engaged in a religious occupation discloses, without justifiable grounds, another person's confidential
information which has come to be known in the course of such religious activities."

16

Regarding the exception to this rule, see footnote 5.

10

If the Minister of Internal Affairs and Communications – based for instance on theinvestigation on the status of the enforcement of the APPIHAO 17, the processing ofcomplaints, or inquiries directed to one of its Comprehensive Information Centres –find it necessary for achieving the purpose of the APPIHAO, he/she may request thehead of an administrative organ to submit materials and explanations regarding
handling of personal information by the concerned administrative organ based on
Article 50 of the APPIHAO. The Minister may address opinions to the head of
administrative organ regarding processing of personal information in theadministrative organ when he or she finds it necessary for achieving the purpose ofthis Act. In addition, the Minister may, for instance, request a revision of themeasures through the actions he/she can take pursuant to Articles 50 and 51 of the
Act when it is suspected that a violation or inappropriate operation of the Act has
occurred. This helps to ensure the uniform application of and compliance with the
APPIHAO.
3) Oversight by the Public Safety Commissions as regards the police
Regarding the police administration, the NPA is subject to oversight by the
National Public Safety Commission, while the Prefectural Police is subject tooversight by one of the Prefectural Public Safety Commissions established in eachprefecture. Each of these oversight bodies secures democratic management andpolitical neutrality of the police administration.
The National Public Safety Commission is in charge of the affairs which fall under
its jurisdiction pursuant to the Police Law and other laws. This includes theappointment of the Commissioner General of the NPA and local senior police officers
as well as the establishment of comprehensive policies which lay out basic directions
or measures with respect to the administration of the NPA.
The Prefectural Public Safety Commissions are composed of members
representing the people in the respective prefecture based on the Police Law and17

To ensure transparency and facilitate the oversight by the MIC, the head of an administrative organ isrequired, pursuant to Article 11 of the APPIHAO, to record each item prescribed in Article 10(1) of the
APPIHAO, such as the name of the administrative organ which retains the file, purpose of use of the file,method of collection of the personal information, etc. (so-called “Personal Information File Register”).
However, personal information files which fall under Article 10(2) of the APPIHAO, such as those preparedor obtained as part of a criminal investigation or concerning matters relevant for national security, areexempted from the obligation to notify the MIC and to include them in the public register. However,pursuant to Article 7 of the Public Records and Archives Management Act, the head of an administrative
organ is always required to record the classification, title, retention period and storage location, etc. ofadministrative documents (“Administrative Document File Management Register”). The index information
for both registers is published on the internet and allows individuals to check what kind of personal
information the file contains and which administrative organ retains the information.

11manage the Prefectural Police as an independent council system. Members areappointed by the prefectural governor with the consent of the prefectural assembly
based on Article 39 of the Police Law. Their term of office is three years and they can
only be dismissed against their will for specific reasons enumerated in law (such asincapacity to perform their duties, violation of duties, misconduct etc.), thus ensuring
their independence (see Articles 40, 41 of the Police Law). Furthermore, in order toguarantee their political neutrality, Article 42 of the Police Law prohibits a member of
the Commission from concurrently serving as a member of a legislative body,
becoming an executive member of a political party or any other political body, or
actively engaging in political movements. While each Commission falls under thejurisdiction of the respective prefectural governor, this does not entail any authority of
the governor to issue instructions as to the exercise of its functions.
Pursuant to Article 38(3) in conjunction with Article 2 and 36(2) of the Police Law,
the Prefectural Public Safety Commissions are responsible for "the protection ofrights and freedom of an individual". To that end, they shall receive reports from the
Chiefs of the Prefectural Police concerning the activities within their jurisdiction,
including at regular meetings held three or four times a month. The Commissions
provides guidance on these matters through the establishment of comprehensive
policies.
Moreover, as part of their supervisory function, the Prefectural Public Safety
Commissions may issue directions to the Prefectural Police in concrete, individual
cases when they consider this necessary in the context of an inspection of theactivities of the Prefectural Police or misconduct of its personnel. Also, theCommissions may, when they consider this necessary, have a designatedCommission member review the state of implementation of the issued direction(Article 43-2 of the Police Law).
4) Oversight by the Diet
The Diet may conduct investigations in relation to the activities of public authorities
and to this end request the production of documents and the testimony of witnesses(Article 62 of the Constitution). In this context, the competent committee in the Diet
may examine the appropriateness of information collection activities conducted by
the Police.
These powers are further specified in the Diet Act. Pursuant to its Article 104, theDiet may require the Cabinet and public agencies to produce reports and records
necessary for carrying out its investigation. Furthermore, Diet members may submit“written inquiries” under Article 74 of the Diet Act. Such inquiries must be approvedby the Chair of the House and, in principle, must be answered by the Cabinet in12writing within seven days (when it is impossible to reply within that period, this mustbe justified and a new deadline set, Article 75 of the Diet Act). In the past, written
inquiries by the Diet have also covered the handling of personal information by theadministration. 18
C) Individual Redress
According to Article 32 of the Constitution of Japan, no person shall be denied theright of access to the courts. In addition, Article 17 of the Constitution guarantees
every person the right to sue the State or a public entity for redress (as provided bylaw) in case he/she has suffered damage through the illegal act of a public official.
1) Judicial redress against compulsory collection of information based on awarrant (Article 430 Code of Criminal Procedure)
According to Article 430(2) of the Code of Criminal Procedure, an individual who isdissatisfied with the measures undertaken by a police official concerning a seizure ofarticles (including if they contain personal information) based on a warrant may file arequest (so-called "quasi-complaint") with the competent court for such measures tobe "rescinded or altered".
Such a challenge can be brought without the individual having to wait for theconclusion of the case. If the court finds that the seizure was not necessary, or that
there are other reasons to consider the seizure illegal, it may order such measures tobe rescinded or altered.
2) Judicial redress under the Code of Civil Procedure and State Redress Act
If they consider that their right to privacy under Article 13 of the Constitution has
been violated, individuals can bring a civil action requesting that personal informationcollected through a criminal investigation be deleted.
Also, an individual can bring an action for the compensation of damages based on
the State Redress Act in combination with relevant articles of the Civil Code if he/she
considers that his/her right to privacy has been infringed and he/she has sufferedharm as a result of the collection of his/her personal information or surveillance 19.
18

See e.g. written enquiry of the House of Councillors no. 92 of 27 March 2009 regarding handlinginformation collected in the context of criminal investigations including violations of confidentiality
obligations by police and prosecutorial authorities.

19

An example for such an action is “The Case of Defense Agency’s List” (Niigata District Court, decision of
May 11, 2006 (2002(Wa) No.514)). In this case, an official of the Defense Agency prepared, kept, anddistributed a list of those individuals who had filed requests for disclosure of administrative documents with

13

Given that the "damage" which is subject to a claim for compensation is not limited todamage to property (Article 710 of the Civil Code), this may also cover "mental
distress". The amount of compensation for such moral harm will be assessed by thejudge based on a "free evaluation in consideration of various factors in each case" 20.
Article 1(1) of the State Redress Act grants a right to compensation where (i) the
public officer who exercises public authority of the State or of a public entity has (ii) in
the course of his/her duties (iii) intentionally or negligently (iv) unlawfully (v) inflicteddamage on another person.
The individual must file the lawsuit in accordance with the Code of Civil Procedure.
According to the applicable rules, he/she may do so with the court that has
jurisdiction over the place where the tort was committed.
3) Individual redress against unlawful/improper investigations by the Police:complaint to the Prefectural Public Safety Commission (Article 79 Police Law)
According to Article 79 of the Police Law 21, as further clarified in an instruction by
the Head of the NPA to the Prefectural Police and Prefectural Public Safety
Commissions 22 , individuals may lodge a written complaint 23 with the competent
Prefectural Public Safety Commission against any illegal or improper behaviour by apolice officer in the execution of his/her duties; this includes duties with respect to thethe Defense Agency. There were descriptions of the plaintiff's personal information on that list. Insistingthat his privacy, right to know, etc. were infringed, the plaintiff requested the defendant to pay compensation
for damages under Article 1(1) of the State Redress Act. This request was partially granted by the court thatawarded the plaintiff a partial compensation.
20

Supreme Court, decision of April 5, 1910 (1910(O) No.71).

21

Article 79 of the Police Law (excerpt):
1. Whoever has a complaint against the execution of duties by the personnel of the Prefectural Police may
lodge a complaint in writing to the Prefectural Public Safety Commission through the procedure prescribedin the National Public Safety Commission Ordinance.
2. The Prefectural Public Safety Commission which received a complaint provided for in the previous
paragraph shall faithfully handle it in accordance with laws and local ordinances, and shall notice its result
to the complainant in writing, except in the following cases:(1) The complaint can be recognized as brought in order to obstruct the lawful execution of the duties of thePrefectural Police;(2) The current residence of the complainant is unknown;(3) The complaint can be recognized as brought jointly with other complainants and other complainants
have already been notified with the result of the joint complaint.

22

NPA, Notice on the proper handling of complaints on the execution of duties by police officers, April 13th,
2001, with Attachment 1 "Standards on interpretation/implementation of Article 79 of the Police Act".

23

According to the NPA Notice (see previous footnote), individuals with difficulties in formulating acomplaint in writing shall receive assistance. This expressly includes the case of foreigners.

14

collection and use of personal information. The Commission shall faithfully handle
such complaints in accordance with laws and local ordinances, and shall notify the
result of the investigation to the complainant in writing.
Based on its supervisory authority according to Article 38(3) of the Police Law, thePrefectural Public Safety Commission shall issue an instruction to the Prefectural
Police to investigate the facts, implement the necessary measures according to theresult of the examination and report the results to the Commission. Where it deems
this necessary, the Commission may also issue an instruction on the handling of thecomplaint, for instance if it considers the investigation carried out by the police to be
insufficient. This implementation is described in the Notice issued by the NPA to theheads of the Prefectural Police.
The notification to the complainant of the result of the investigation is made in lightalso of the reports from the police concerning the investigation and the measurestaken on request of the Commission.
4) Individual redress under the APPIHAO and the Code of Criminal Procedurea) APPIHAO
Under Article 48 of the APPIHAO, administrative organs must endeavour toproperly and expeditiously process any complaints on the handling of personal
information. As a means to provide consolidated information to individuals (e.g. on
the available rights to disclosure, correction and suspension of use under the
APPIHAO) and as a contact point for inquiries, the MIC has establishedComprehensive Information Centres on Information Disclosure/Personal Information
Protection in each of the prefectures based on Article 47(2) of the APPIHAO.
Inquiries by non-residents are also possible. As an example, in FY2017 (April 2017 toMarch 2018), the total number of cases in which the comprehensive information
centres responded to inquiries, etc. was 5,186.
Articles 12 and 27 of the APPIHAO grant individuals the right to request disclosureand correction of retained personal information. Furthermore, pursuant to Article 36of the APPIHAO, individuals may request the suspension of use or deletion of theirretained personal information where the administrative organ has not obtained theretained personal information lawfully, or retains or uses such information in violationof law.

15

However, as regards personal information collected (either based on a warrant or by
way of an "enquiry sheet") and retained for criminal investigations 24, such information
generally falls within the category of “personal information recorded in documents
relating to trials and seized articles”. Such personal information is therefore excluded
from the scope of application of the individual rights in Chapter 4 of the APPIHAO
pursuant to Article 53-2 of the Code of Criminal Procedure 25. The processing of such
personal information and the rights of the individual to access and correction are
instead subject to special rules under the Code of Criminal Procedure and Act on
Final Criminal Case Records (see below). 26 This exclusion is justified by various
factors such as the protection of the privacy of persons concerned, the secrecy ofinvestigations and the proper conduct of the criminal trial. This been said, theprovisions of Chapter 2 of the APPIHAO governing the principles for the handling ofsuch information remain applicable.
b) Code of Criminal Procedure
Under the Code of Criminal Procedure, the possibilities for access to personal
information collected for the purposes of a criminal investigation depend both on thestage of the procedure and the role of the individual in the investigation (suspect,accused, victim, etc.).
As an exception to the rule in Article 47 of the Code of Criminal Procedure that
documents relating to the trial shall not be made public prior to the commencement of
the trial (as this could violate the honor and/or privacy of the individuals concernedand hinder the investigation/trial), the inspection of such information by the victim of acrime is in principle permitted to the extent that it is deemed reasonable by taking into
account the purpose of the provision of Article 47 of the Code of Criminal
Procedure. 27

24

On the other hand, there would be documents which are not classified as “documents relating to trials” asthey are not themselves information obtained by a warrant or written inquiries on investigative matters but
created on the basis such documents. This would be a case where private information is not subject to
Article 45 (1) of the APPIHAO, and therefore such information would not be excluded from the applicationof Chapter 4 of the APPIHAO.

25

Article 53-2(2) of the Code of Criminal Procedure prescribes that the provisions of Chapter IV of the
APPIHAO shall not apply to the personal information recorded in documents relating to trials and seized
articles.

26

Under the Code of Criminal Procedure and the Act on Final Criminal Case Records, access to and thecorrection of seized articles as well as documents/personal information regarding criminal trials are subject
to a unique and distinctive system of rules that aims at protecting the privacy of persons concerned, thesecrecy of investigations and the proper conduct of the criminal trial, etc.

27

More specifically, the inspection of information related to objective evidence is in principle permitted forcrime victims regarding the non-prosecution records on the cases subject to the victim participation

16

As regards suspects, they will typically learn about the fact that they are subject toa criminal investigation upon interrogation by either the judicial police or publicprosecutor. If subsequently the public prosecutor decides not to institute prosecution,
he/she shall promptly notify the suspect of this fact upon his/her request (Article 259of the Code of Criminal Procedure).
In addition, following the institution of prosecution, the public prosecutor shall givethe accused or his/her counsel an opportunity to inspect the evidence in advance
before requesting its examination by the court (Article 299 of the Code of Criminal
Procedure). This allows the accused to check his/her personal information collected
through criminal investigation.
Finally, the protection of personal information collected in the context of a criminal
investigation, be it of a suspect, the accused or any other person (e.g. a crime victim)
is guaranteed through the confidentiality obligation (Article 100 of the National PublicService Act) and the threat of penalty in case of leakage of confidential information
handles in the course of the exercise of public service duties (Article 109 (xii) of the
National Public Service Act).
5) Individual redress against unlawful/improper investigations by public authorities:
complaint to the PPC
According to Article 6 of the APPI, the Government shall take necessary action incollaboration with the governments of third countries to construct an internationallyconformable system concerning personal information through fostering cooperation
with international organizations and other international frameworks. Based on thisprovision, the Basic Policy on the Protection of Personal Information (adopted by
Cabinet Decision) delegates to the PPC, as the authority competent for the overall
administration of the APPI, the power to take the necessary action to bridge
differences of the systems and operations between Japan and the concerned foreigncountry in view of ensuring the appropriate handling of personal information received
from such country.
Furthermore, as provided for under Article 61, items (i) and (ii) of the APPI, the
PPC is entrusted with the task of formulating and promoting a basic policy, as well aswith the mediation of complaints lodged against business operators. Finally,administrative organs shall closely communicate and cooperate with one another(Article 80 of the APPI).
stipulated in Article 316-33 thereafter of the Code of Criminal Procedure in order to make the protection ofcrime victims more satisfactory.

17

Based on these provisions, the PPC will deal with complaints lodged by individuals
as follows:a)

An individual who suspects that his/her data transferred from the EU has beencollected or used by public authorities in Japan, including the authorities
responsible for the activities referred to in Chapter II and Chapter III of thepresent "Representation", in violation of the applicable rules, including thosesubject to this "Representation", can submit a complaint to the PPC(individually or though his/her DPA).

b)

The PPC handles the complaint, including by making use of its powers under
Article 6, 61(ii), and 80 of the APPI, and informs the competent publicauthorities, including the relevant oversight bodies, of the complaint.
These authorities are required to cooperate with the PPC under Article 80 of
the APPI, including by providing the necessary information and relevantmaterial, so that the PPC can evaluate whether the collection or thesubsequent use of personal information has taken place in compliance withthe applicable rules. In carrying out its evaluation, the PPC will cooperate with
the MIC.

c)

If the evaluation shows that an infringement of the applicable rules has
occurred, cooperation by the concerned public authorities with the PPC
includes the obligation to remedy the violation.
In case of unlawful collection of personal information under the applicable
rules, this shall include the deletion of the personal information collected.
In case of a violation of the applicable rules, the PPC will also confirm, before
concluding the evaluation, that the violation has been fully remedied.

d)Once the evaluation is concluded, the PPC shall notify the individual, within areasonable period of time, of the outcome of the evaluation, including any
corrective action taken where applicable. Through this notification, the PPC
shall also inform the individual about the possibility of seeking a confirmationof the outcome from the competent public authority and about the authority towhich such a request for confirmation shall be made.
Detailed information on the outcome of the evaluation can be restricted aslong as there are reasonable grounds to consider that communicating suchinformation is likely to pose a risk to the ongoing investigation.
18

Where the complaint concerns the collection or use of personal data in thearea of criminal law enforcement, the PPC will, in the event that the evaluation
reveals that a case involving the personal information of the individual has
been opened and that the case is concluded, inform the individual that thecase record can be inspected pursuant to Article 53 of the Code of Criminal
Procedure and Article 4 of the Act on Final Criminal Case Records.
Where the evaluation reveals that an individual is a suspect in a criminal case,
the PPC will inform the individual about that fact and about the possibility tomake a request pursuant to Article 259 of the Code of Criminal Procedure.
e)

If an individual is still dissatisfied with the outcome of this procedure, he/she
can address the PPC which shall inform the individual of the various
possibilities and detailed procedures for obtaining redress under Japaneselaws and regulations. The PPC will provide the individual with support,
including counselling and assistance in bringing any further action to therelevant administrative or judicial body.

III. Government access for national security purposes
A. Legal bases and limitations for the collection of personal information
1) Legal bases for information collection by concerned ministry/agency
As indicated above, the collection of personal information for the purpose ofnational security by administrative organs needs to be within the scope of theiradministrative jurisdiction.
In Japan, no law exists that enables information collection by compulsory means
for the purpose of national security only. Pursuant to Article 35 of the Constitution, it
is possible to collect personal information forcibly only on the basis of a warrant
issued by a court for the investigation of an offence. Such a warrant can thus only be
issued for the purpose of a criminal investigation. This means that, in the Japanese
legal system, collection of/access to information by compulsory means for national
security reasons is not allowed. Instead, in the area of national security, concerned
ministries or agencies can only obtain information from sources that can be freely
accessed, or receive information from business operators or individuals throughvoluntary disclosure. Business operators receiving a request for voluntarycooperation are under no legal obligation to provide such information and, hence,
face no negative consequences if they refuse to cooperate.
19

A number of different ministerial departments and agencies have responsibilities in
the area of national security.
(1) Cabinet Secretariat
The Cabinet Secretariat conducts information collection and research concerning
important policies of the Cabinet 28 prescribed in Article 12-2 of the Cabinet Law. 29
However, the Cabinet Secretariat has no power for collecting personal information
directly from business operators. It collects, incorporates, analyses and assesses
information from open source materials, other public authorities, etc.
(2) The NPA/Prefectural Police
In each prefecture, the Prefectural Police is empowered to collect information
within the scope of its jurisdiction under Article 2 of the Police Law. It can happen that
the NPA directly collects information within the scope of its jurisdiction under the
Police Law. This concerns in particular the activities of the NPA's Security Bureau
and the Foreign Affairs and Intelligence Department. Pursuant to Article 24 of the
Police Law, the Security Bureau is in charge of matters concerning the security
police 30 and the Foreign Affairs and Intelligence Department is in charge of the affairs
concerning foreign nationals as well as Japanese nationals whose bases of activity
are located in foreign countries.
(3) Public Security Intelligence Agency (PSIA)
The application of the Subversive Activities Prevention Act (SAPA) and the Act on
the Control of Organizations Which Have Committed Acts of Indiscriminate Mass
Murder (ACO) falls mainly under the authority of the Public Security Intelligence
Agency (PSIA). This is an agency of the Ministry of Justice.
SAPA and the ACO stipulate that administrative dispositions (i.e. measuresordering the limitation of the activities of such organisations, their dissolution, etc.)
can be adopted, under strict conditions, against organisations committing certain
serious acts (“Terroristic Subversive Activity” or “Act of Indiscriminate Mass Murder”)
in violation of “public security” or the "fundamental system of society" under the28

It is conducted by the Cabinet Intelligence and Research Office based on Article 4 of the Cabinet Secretariat
Organization Order.

29

This includes "the collection and research of intelligence concerning important policies of the Cabinet".

30

The security police is responsible for crime-control activities relating to public safety and the interest of the
Nation. This includes crime-control and information gathering on illegal acts related to extreme leftist
groups, rightist groups and harmful anti-Japan activities.

20

Constitution. “Terroristic Subversive Activities” fall within the scope of SAPA (seeArticle 4 covering activities such as insurrection, instigation of foreign aggression,
homicide with political intent, etc.), while the ACO addresses "Acts of Indiscriminate
Mass Murder" (see Article 4 of the ACO). Only precisely identified organisations
posing specific internal or external threats to public security can be subject todispositions under SAPA or ACO.
To this end, SAPA and ACO provide legal authority of investigation. The
fundamental investigative powers of the officers of the PSIA (PSIO) are set out in
Article 27 of SAPA and Article 29 of ACO. Investigations by the PSIA under theseprovisions are conducted to the extent they are necessary with respect to the aboveorganization-control dispositions (e.g. Radical Leftist Groups, the Aum Shinrikyo sectand certain domestic group closely linked to North Korea have been exemplified as a
subject of investigation in the past). However, these investigations cannot rely on
compulsory means and thus an organisation holding personal information cannot becompelled to provide such information.
Collection and use of information disclosed to the PSIA on a voluntary basis issubject to the relevant safeguards and limitations provided by law such as, inter alia,
the secrecy of communication guaranteed by the Constitution and the rules on thehandling of personal information under the APPIHAO.
(4) Ministry of Defense (MOD)As for the information collection by the Ministry of Defense (MOD), the MOD
collects information based on Article 3 and 4 of the Act for the Establishment of the
MOD to the extent necessary for the exercise of its administrative jurisdiction affairs,
including with respect to defence and guard, action to be taken by the Self-Defense
Forces as well as the deployment of the Ground, Maritime and Air Self-Defense
Forces. The MOD can only collect information for these purposes through voluntarycooperation and from freely accessible sources. It does not collect information on thegeneral public.
1) Limitations and safeguardsa) Statutory limitations(1) General limitations based on the APPIHAO
The APPIHAO is a general law that applies to the collection and handling of
personal information by administrative organs in any field of activity of such organs.
Therefore, the limitations and safeguards described in section II.A.1) b)(2) also apply
21

to the retention, storage, use etc. of personal information in the area of national
security.
(2) Specific limitations applicable to the police (both NPA and Prefectural Police)
As specified above in the section dealing with the collection of information for law
enforcement purposes, the police may only collect information within the scope of its
jurisdiction and when doing so it may, pursuant to Article 2(2) of the Police Law, only
act to an extent "strictly limited" to the performance of its duties and in a way which is"impartial, nonpartisan, unprejudiced and fair". Moreover, its powers "shall never beabused in any way such as to interfere with the rights and liberties of an individual
guaranteed in the Constitution of Japan”.
(3) Specific limitations applicable to the PSIA
Both Article 3 of the SAPA and Article 3 of the ACO stipulate that investigations
carried out under these acts shall be conducted only to the minimum extent
necessary to achieve the purpose pursued and shall not be carried out in a way that
unreasonably restricts fundamental human rights. Moreover, pursuant to Article 45 of
the SAPA and Article 42 of the ACO, if an officer of the PSIA abuses his/her authority,
this constitutes a crime that is punishable by heavier criminal sanctions than"general" abuses of authority in other fields of the public sector.
(4) Specific limitations applicable to the MOD
As regards information collection/organization by the MOD, as referred to in
Article 4 of the Act for the Establishment of the MOD, this Ministry's activity to collectinformation is limited to what is "necessary" to conduct its duties concerning (1)defense and guard, (2) action to be taken by the Self-Defense Forces, (3) theorganizations, number of personnel, structure, equipment, and deployment of the
Ground, Maritime and Air Self-Defense Forces.
b) Other limitations
As explained earlier in section II.A.2) b) (1) concerning criminal investigations, itfollows from the case law of the Supreme Court that, in order to address a request forvoluntary cooperation to a business operator, such a request must be necessary forthe investigation of a suspected crime and must be reasonable in order to achieve
the purpose of the investigation.
Although investigations conducted by investigative authorities in the area ofnational security differ from investigations conducted by investigative authorities in22the area of law enforcement as regards both their legal basis and purpose, thecentral principles of “necessity for investigation” and “appropriateness of method”
similarly apply in the area of national security and have to be complied with taking
appropriate account of the specific circumstances of each case.
The combination of the above limitations ensures that the collection andprocessing of information takes place only to the extent necessary to theperformance of specific duties of the competent public authority as well as on thebasis of specific threats. This excludes mass and indiscriminate collection or accessto personal information for national security reasons.
B. Oversight1) Oversight based on the APPIHAO
As explained above in section II.B.2), in Japan's public sector, the Minister or the
Head of each ministry or agency is vested with the power to oversee and enforce
compliance with the APPIHAO in his/her ministry or agency. Moreover, the Ministerof Internal Affairs and Communications may investigate the status of enforcement of
the Act, request each Minister to submit materials and explanations based on Article
49 and 50 of the Act, address opinions to each Minister based on Article 51 of the Act.
For example, he/she may request a revision of the measures through the actions
pursuant to Article 50 and 51 of the Act.
2) Oversight over the police by the Public Safety Commissions
As explained in the above section "II. Information collection for criminal law
enforcement purpose", the independent Prefectural Public Safety Commissions
supervise the activities of the Prefectural Police.
As regards the National Police Agency (NPA), supervisory functions are exercisedby the National Public Safety Commission. Pursuant to Article 5 of the Police law,
this Commission is responsible, in particular, for "the protection of rights and freedomof an individual". To that end, it shall notably establish comprehensive policies which
set out regulations for the administration of affairs prescribed in each item of Article
5(4) of the Police Law and lay out other basic directions or measures that should be
relied on to carry out the said activities. The National Public Safety Commission(NPSC) has the same degree of independence as the Prefectural Public Safety
Commissions (PPSCs).

233) Oversight of the MOD by the Inspector General’s Office of Legal compliance
The Inspector General’s Office of Legal Compliance (IGO) is an independent officein the Ministry of Defense (MOD), which is under the direct supervision of the
Minister of Defense pursuant to Article 29 of the Act for the Establishment of theMOD. The IGO can carry out inspections of compliance with laws and regulations byofficials of the MOD. These inspections are called “Defense Inspections”.
The IGO conducts inspections from the standpoint of an independent office so as
to ensure legal compliance across the entire ministry including the Self-Defense
Forces (SDF). It performs its duties independently from MOD's operational
departments. Following an inspection, the IGO reports its findings, together with thenecessary ameliorative measures, directly to the Minister of Defense without delay.
On the basis of the IGO's report, the Minister of Defense may issue orders to
implement the measures necessary to remedy the situation. The Deputy ViceMinister is responsible for implementing these measures and must report to the
Minister of Defense on the status of such implementation.
As a voluntary transparency measure, the findings of Defense Inspections are now
made public on the MOD's website (although this is not required by law).
There are three categories of Defense Inspections:(i)Regular Defense Inspections, which are conducted periodically 31;(ii)
Defense Inspections for checks, which are conducted to check whether
ameliorative measures have been effectively taken; and(iii)
Special Defense Inspections, which are conducted for specific mattersordered by the Minister of Defense.
In the context of such inspections, the Inspector General can request reports fromthe concerned office, request the submission of documents, enter sites to conduct
the inspection, request explanations from the Deputy Vice-Minister, etc. In
consideration of the nature of the inspection tasks of the IGO, this office is headed byvery senior legal experts (former Superintending Prosecutor).

31

As an example of an inspection relevant to the issues covered by this Representation, reference
can be made to the 2016 Regular Defence Inspection with respect to “Awareness/Preparation for
Legal Compliance” as personal information protection was one of the focal points of the inspection.
More specifically, the inspection concerned the status of management, storage, etc. of personal
information. In its report, the IGO identified several inappropriate aspects in the management of
personal information that should be improved, such as the failure to protect the data through apassword. The report is available on the website of the MOD.

24

4) Oversight of the PSIA
The PSIA carries out both regular and special inspections on the operations of its
individual bureaus and offices (Public Security Intelligence Bureau, Public Security
Intelligence Offices and Sub Offices, etc.). For the purposes of the regular inspection,
an Assistant Director General and/or a Director is designated as inspector(s). Suchinspections also concern the management of personal information.
5) Oversight by the Diet
As for information collection for law enforcement purposes, the Diet, through its
competent committee, may examine the lawfulness of information collection activities
in the area of national security. The Diet's investigatory powers are based on Article
62 of the Constitution and Articles 74, 104 of the Diet Act.
C. Individual redress
Individual redress can be exercised through the same avenues as in the area of
criminal law enforcement. This also includes the new redress mechanism,
administrated and supervised by the PPC, for handling and resolving complaints
lodged by EU individuals. In this regard, please see the relevant passages of section
II.C.
In addition, there are specific individual redress avenues available in the area ofnational security.
Personal information collected by an administrative organ for national security
purposes is subject to the provisions of Chapter 4 of the APPIHAO. This includes theright to request disclosure (Article 12), correction (including addition or deletion)(Article 27) of the individual's retained personal information as well as the right torequest suspension of use of the personal information in case the administrative
organ has obtained the concerned information unlawfully (Article 36). That said, inthe national security area, the exercise of such rights is subject to certain restrictions:requests for disclosure, correction or suspension will not be granted when they
concern “information for which there are reasonable grounds for the head of an
administrative organ to find that disclosure is likely to cause harm to national security,
cause damage to the relationship of mutual trust with another country or aninternational organization, or cause a disadvantage in negotiations with anothercountry or an international organization" (Article 14(iv)). Hence, not all voluntarycollection of information related to national security falls with this exemption as thelatter always requires a concrete assessment of the risks involved in their disclosure.
25

Furthermore, if the request of the individual is rejected on the grounds that theconcerned information is considered non-disclosable within the meaning of
Article 14(iv), the individual may lodge an administrative appeal for the review of suchdecision, claiming for example that the conditions set forth in Article 14(iv) are notfulfilled in the case at issue. In that case, before taking a decision, the Head of theconcerned administrative organ shall consult the Information Disclosure andPersonal Information Protection Review Board. This Board will review the appeal
from an independent standpoint. The Board is a highly specialized and independent
body whose members are appointed by the Prime Minister, with consent of bothHouses of the Diet, amongst people with outstanding expertise. 32 The Board enjoys
strong investigative powers, including the possibility to request documents and thedisclosure of the personal information in question, hold in-camera deliberation, andapply the Vaughn index procedure 33. The Board then establishes a written reportwhich is communicated to the concerned individual. 34 The findings contained in thereport are made public. Although the report is not formally speaking legally binding,almost all the reports are complied with by the concerned administrative organ. 35
Finally, pursuant to Article 3(3) of the Administrative Case Litigation Act, theindividual may bring a court action seeking the revocation of the decision taken by
the Administrative Organ not to disclose the personal information.
IV. Periodic review
In the framework of the periodic review of the adequacy decision, PPC and theEuropean Commission will exchange information on the processing of data under theconditions of the adequacy finding, including those set out in this Representation.

32

See Article 4 of the Act for Establishment of the Information Disclosure and Personal Information
Protection Review Board.

33

See Article 9 of the Act for Establishment of the Information Disclosure and Personal Information
Protection Review Board.

34

See Article 16 of the Act for Establishment of the Information Disclosure and Personal Information
Protection Review Board.

35

Over the last 3 years, there is no precedent where the concerned administrative organ took a decision thatdiffered from the Board's conclusions. Going back in the years, there are extremely few cases where thishappened: only two instances out of total 2,000 cases between 2005 (the year in which the APPIHAO
entered into force). When the administrative organ makes a determination/decision which differs from theBoard's conclusions, pursuant to Article 50(1), item 4 of the Administrative Complaint Review Act asapplied with the replacement of Article 42(2) of the APPIHAO, it shall clearly indicate the reasons for that.

26