The Rise of“Global Information Law”:
Centennial Perspectives on the Conceptualizationof Japanese Information Law
Itsuko Yamaguchi*

1.

Introduction

1.1

Unprecedented challenges of hybrid tradeoffs

Surrounded by the unprecedented uncertainty

regulations on platforms and algorithms, it isdiseaseextremely difficult for an individual end-user(COVID-19) crisis, digitalization of conventionaland even for a sovereign state to have a clear

paper-based processes has been accelerated,

overview of what is going on in today’s globallythusconnected societies.

due

to

the

inducing

ongoingacoronavirus

wider

range

of

digitaltransformations in how we communicate, work,

How can we know, assess, and verify theand live our daily lives. This raises concerns

unprecedented benefits and risks brought by

about some recent trends in global data

innovative cyber-physical hybrid technologies,

governance, where flow of data and informationand make laws to meet new challenges in

is increasingly mediated and controlled by abalancing tradeoffs especially relating to civil

limited number of multi-country private platformrights and liberties such as free speech, privacy,

operators and technology companies, and so-data protection, national security, and secretcalled“black-box”algorithmic decision-making

surveillance? What lessons, if any, can be drawn

systems are gradually implemented for practicalfromuses1.

comparative law perspective?

theJapaneseexperience

from

a

While there are pros and cons to tougher

1.2

Celebrating the 100th issue of the journal

To celebrate the 100th issue of the Journal of
Information Studies, whose first issue was

new challenges emerging with the latest
technologies of the time2.

published in 1952, this article honors a founding

This article aims to clarify a strand offrontier spirit of this journal in responding to

intriguing recent phenomena in global data

* Professor of Information Law and Policy, Interfaculty Initiative in Information Studies, Graduate School of Interdisciplinary
Information Studies, The University of Tokyo
Key Words：Information, Law, Privacy, National Security, Online Platform, Algorithm, Transparency

The Rise of“Global Information Law”: Centennial Perspectives on the Conceptualization of Japanese Information Law

47

governance, which might be broadly conceived

These cases highlight the increasing role ofas the rise of “global information law”
. It

online intermediaries and platforms in US

investigates the global reach of domestic andgovernment secret surveillance, and concomitantregional laws that govern transborder flows of

EU judicial and legislative moves to extend thedata and information.

global reach of laws relating to privacy and data

It proceeds with theprotection beyond borders (Section 3).

following four steps.
First, this article starts with terminology ofThird, this article points out another line of

key terms, in particular,“information”, whichrecent legislative proposals pertaining to suchhas a connotation of a dynamic “flow” orglobal reach of the EU laws, which lean toward

circulation and underlies the conceptualizationa more expanding scope of platform regulations,of“information law”in Japan in response to theand also takes up “black box” issues of

so-called “informatization” of society roughly

algorithmic decision-making systems in thesince the 1960s (Section 2).

public sector (Section 4).

Second, it reviews some cases of power

Fourth and lastly, it concludes by discussing

struggles relating to transborder data flows,

the potential global reach of Japanese information

privacy, data protection, national security, andlaw as a way of illuminating what we value

onlinefrom

beyond borders today and tomorrow - a mattercomparative perspectives on laws of the United

requiring further investigation in today’s globally

States (US), of the European Union (EU), and ofconnected societies (Section 5).

intermediaries

andplatforms

Japan.

2.

Terminology of Information, Data, and Knowledge

Let us take a brief look at key terms.

AI”, together with“algorithms”, and“[w]ithout“Information”,“data”, and“knowledge”are notdata, the development of AI and other digital

always interchangeable terms. “Data”seems to4applications is not possible”.

have gained a wide symbolic use in the context“Information” is typically contrasted withofmachinesomething tangible or physical, but it has been

artificial

conferred a deeper and richer meaning in Japan.

intelligence (AI) during the last decade, being a

For example, while information is frequently

vital raw resource to fuel innovation and theperceived as“equivalent to a mere fragment ofdigital economy . For example,“data”is said to‘data’”, it can also be understood as one of the

be one of the“the main elements that compose“foundational concepts in the Universe” like

digitallearning

technologies
and

deep

includinglearning

of

3

48

東京大学大学院情報学環紀要

情報学研究

№100

“informatization”[Joho-ka in Japanese] of society

5“materiality”and“energy.”

been

6
or“information society”. It is noteworthy thatconceived in socio-historical analysis in Japan toinformation is essentially conceived as a dynamic

be closely associated with the aspect of military“flow” or circulation, whereas knowledge is“intelligence”during the 1920s and 30s. Later,

ratherin the 1960s, its principle area of application

capable of accumulation or storage, as a static

Furthermore,“information”

hasshifted from the military to the economy, whengenerally7“stock”.

understoodassomethingThis article uses these terms withpeople became aware of numerous social

suchchanges triggered by the advancement ofconceptualization of Japanese“information law”,

computing and communication technologies, a

as referred later in Section 5.

phenomenon

3.

collectively

known

as

connotations,

which

underlythethe

The Rise of Platform Powers and the Global Reach of EU laws

Since the global proliferation of Internet use,

services, such as search engines, social media,

there have been constant power struggles

and cloud hosting, have grown to be essential

across national borders over who governs,

societal infrastructure, a nascent ideal of laissez-

controls and owns information, data, knowledge,

faire openness and the Internet’s democratizing

and any new intangible form of values.

effect have undergone changes, especially in theYet, as online intermediaries or platform

3.1

context of clandestine intelligence surveillance8.

Foreign intelligence in corporation with online intermediaries

Particularly since the revelations by Edward

the constitutionality and statutory authorization

Snowden in 2013 , individual Internet usersof certain intelligence-gathering practices by thearound the globe who depend upon US-based

US government for national security reasons.

9online services have become alarmed about how

For instance, regarding the issue of whether

far the US National Security Agency (NSA)

or not the NSA’s bulk telephone metadata

could go to access bulk telephone meta data andprogram for virtually all U.S. citizens constitutes

Internet content within and outside the country,

an unreasonable “search” under the Fourthhowtelecommunication

Amendment of the US Constitution, the US

carriers and Internet service providers could

federal district court in Klayman v. Obama

play in cooperation with the NSA, and how

courageously held that it does, whereas thedifficult it is to establish standing to challenge

district court in ACLU v Clapper did not10.

significant

a

role

The Rise of“Global Information Law”: Centennial Perspectives on the Conceptualization of Japanese Information Law

49

flatly

revisited this issue on November 21, 2017, added

refused to address the issue of the NSA’sdetails in the reasoning, but eventually dismissed“PRISM” program, which allegedly collected

the plaintiff’s challenge to the PRISM program12.

Internet data content of targeted non-US

This inevitably ignited serious transnational

persons located outside the US, pursuant to

privacy concerns for the rest of the world.

SectionIntelligence

The US government subsequently introduced

Surveillance Act (FISA) of 1978. This is mainly

legislative amendments, organizational reforms,

because the plaintiffs had not alleged sufficientand strengthened commitments to transparency

facts to satisfy their burden to establish standing

principles

under the standard set by the U.S. Supreme

Nevertheless, more significant repercussions

Court’
s decisioncame from the other side of the Atlantic, as

Nevertheless,

702

the

of

the

in

KlaymanForeignClappercourtv.

Amnesty

International USA on February 26, 201311.

inintelligencecommunities13.

explained next.

The same district court in Klayman v. NSA

3.1.1

The CJEU in Schrems I: The “essentially equivalent”

The Court of Justice of the European Union

protection of personal data against surveillance(CJEU) handed down a landmark ruling in

activities by public authorities, with reference toSchrems I (C-362/14) in October 2015, which

the Snowden revelations14.

invalidated the European Commission’s SafeInthereasoning,

the

CJEU

took

into

Harbor Decision on transfers of personal dataconsideration particularly that US law permits

from the EU to the US, pursuant to thethe public authorities to have “access on a“adequacy” requirement of Article 25 of thegeneralised basis to the content of electronic

then-effective Data Protection Directive 95/46/

communications”, without providing “for any

EC.

possibility for an individual to pursue legal

The original proceeding of this case wasremedies” relating to access, rectification or

based on a complaint by a user of the Facebook

erasure of personal data.

social network, who was an Austrian national

CJEU, the Commission must find that the US

residing in his home country. This Facebook

ensures a level of protection of human rights

user asked the Data Protection Commissioner to“essentially equivalent”to that guaranteed inprohibit Facebook Ireland from transferring his

the EU legal order, but the said Commission

personal data to Facebook Inc. located in the US,

Decision failed to do so15.

According to theclaiming that the US did not ensure“adequate”

50

東京大学大学院情報学環紀要

情報学研究

№100

3.1.2The CJEU in Schremes II: Mandating a tough assessment job?

After the CJEU ruling in Schremes I, arenegotiated framework of the EU-US transfers

not grant data subjects“actionable rights before
17
the courts against the US authorities”.

of personal data, the European Commission’sRegarding a data transfer pursuant to thePrivacy Shield Decision, was declared invalid by

SCC, under Article 46(2)(c) of the General Data

the CJEU in the Schremes II (C-311/18) case inProtection Regulation (GDPR) enforced in May

July 2020, whereas the validity of the Standard

201818, the CJEU says that the controller or theContractualwasprocessor would be required to "verify”on amaintained by adding up certain stricter

case-by-case basis whether“the law of the third

requirements16.

country

Clauses(SCC)

Decision

In so doing, the CJEU avoided fatal practicalconsequences

on

EU-US

data

transfers.

ofdestination” ensuresadequate

protection, and to provide“additional safeguards”
if necessary19.

However, the CJEU still maintains that it is

It appears that the CJEU mandates a quite“apparent”that Section 702 of the FISA does

tough assessment job for not only the European

not indicate“any limitations on the power it

Commission and the Member States, but also

confers to implement surveillance programmes

the controllers around the world who transfer

for the purposes of foreign intelligence or the

personal data pursuant to the SCC to probe into

existence of guarantees for non-US persons

national security laws of the third countries ofpotentially targeted by those programmes”, anddestination around the globe20.

the US Presidential directive issued in 2014 does

3.2

The Global Reach of EU Law: The GDPR and “Adequacy Decision”

3.2.1

The global scalability of EU data protection law

The CJEU rulings in the Schremes case isThis case is renowned for recognizing a righton

to request the search engine operator to delisttransborder data flows, but this was not the firstcertain search results or a so-called“right to becase.

The CJEU ruling in Google Spain (C-21
forgotten”
under the then-effective EU Data

131/12) in May 2014 was a forerunner that

Protection Directive of 1995 (95/46/EC) andpaved the way for a globally scalable reach of

relevant laws of the Member States, which wasdata protection laws of the EU and of thelater explicitly codified in Article 17 of theMember States.

GDPR22.

pathbreaking

for

their

globalimpact

The Rise of“Global Information Law”: Centennial Perspectives on the Conceptualization of Japanese Information Law

51

3.2.2The CJEU in Google Spain under the Directive of 1995

Even under the Directive of 1995, the CJEU in

must be regarded as the“controller”in respect

Google Spain had already indicated a strikingof the processing of personal data within theway of scaling up the territorial applicability of

meaning of Article of 2(d) of the Directive 95/46/

the EU data protection law, through an

EC, and the activities of Google, Inc. and those ofinterpretation of a“controller”of the processing

Google Spain are "inextricably linked".
Therefore, Google Inc. would fall within theof personal data.
According to the reasoning of the CJEU, theoperatorofthesearchengine(i.e.,

thescope of Article 4(1)(a) of the Directive and theMember States’local laws23.

headquarters of Google, Inc. located in the US)

3.2.3

A less spatial “territorial” scope: Article 3 of the GDPR

In comparison with Article 4(1)(a) of the

Article 3(2) of the GDPR goes further to state

Directive 95/46/EC, Article 3(1) of the GDPR

that a controller or a processor who is not evendelineates the territorial scope of application of“established in the Union” will be covered

EU data protection law in a less spatial sense .

under certain circumstances. The scope of such

For instance, Article 3(1) stipulates that thecoverage is said to be determined by the

GDPR applies to the processing of personal data

following two-pronged approach: firstly, whether

“in

an

the processing relates to personal data of“dataestablishment of a controller or a processor”insubjects who are in the Union”, and if so, thenthe Union, as previously provided in thesecondly, whether the processing relates to“theDirective,phrase:offering of goods or services” or to “the“regardless of whether the processing takes

monitoring”of data subjects’behavior in theplace in the Union or not”.

Union25.

24

the

3.2.4

context

with

of

a

the

newly

activities

added

of

The EU-Japan Adequacy Decision: An equal footing task for Japan?

Turning back to the issue of the CJEU’
s

2019.

The Japanese government adopted

requirement of an“adequate”level of protection

supplementary

rules

complementing

thein the context of transborder data transfers,

relevant domestic law to ensure the same levelpursuant to Article 45 of the “adequacy”

of protection as the EU law, applicable only torequirement of the EU GDPR, the European

personal data transferred“from”the EU26.

Commission Decision with respect to Japanese

The EU-Japan Adequacy Decision after years

information privacy law was adopted in Januaryof negotiation was a relief for Japanese business52

東京大学大学院情報学環紀要

情報学研究

№100

operators in the private sector engaging in EU-

think about a resultant domestic consequence

Japan trade. This illustrates another example ofbrought about by an international agreement in

the remarkably scalable reach of the EU data

terms of an equal footing. It would be up to theprotection law.

Japanese government to decide whether or not

However, this created the slightly odd

additional domestic measures should be taken.

situation, making those who reside in Japan

4.

The Next Agenda of EU Global Law and Algorithmic Systems

The previous section highlighted a set ofinterrelated phenomena of rising global platform

effects of the EU laws relating to privacy anddata protection.

powers and the concomitant global reach and4.1

Another global reach: A broader assessment on systemic risks in Article 26 of the
proposed DSA

Yet another set of legislative proposals

familylife,

freedomofexpression

andrelating to digital intermediaries, platforms, andinformation, the prohibition of discrimination

marketplaces was released by the European

and the right of the child”, andCommission: the Digital Services Act (DSA),(c)“intentional manipulation”of their service,accompanied with the Digital Markets Act

including by means of “inauthentic use or(DMA), in December 202027.

As to the risk-

automated exploitation”of the service, with anbased approach under Article 26 of the DSA,

actual or foreseeable negative effect on the

“very

be

protection of “public health, minors, civic

required to “identify, analyse and assess” at

discourse”, or actual or foreseeable effects

least once a year“any significant systemic risks

related to “electoral processes and public

stemming from the functioning and use made of

security”.

large

onlineplatforms” would

their services in the Union”, including:(a) the dissemination of “illegal content”
through their services,(b) any negative effects for the exercise of thefundamental rights to respect for“private andThat could be a strikingly encompassing
range of risk assessment, given that Article 1(3)and Article 2(d) of this DSA proposal stipulate asimilar kind of less spatial scope of application,
like the GDPR mentioned above.

The Rise of“Global Information Law”: Centennial Perspectives on the Conceptualization of Japanese Information Law

53

4.2

Public-sector algorithmic systems and due process

In addition to global platform regulatoryof recidivism in criminal justice, and theissues, there is another point of concern on

evaluation of teachers in public schools relating

related recent phenomena whereby algorithmic

to the termination of employment, raisingdecision-making systems procured from thesignificant concerns in terms of due process28.

private sector is gradually expanding in theIf such algorithmic systems were to be

decision-making of government and the public

implemented in the public sector in a way that

sector, meeting demands for efficiency, evidence-

undulybased practice, outsourcing, privatization, andpossibly because of overly assertive private

probably cost-cutting.

vendors’ trade

For instance, in the United States, there havebeen relevant litigated cases over the prediction

4.3

restricted

accesssecretsbystakeholders,andproprietary

information protection, the algorithmic“blackbox”problem29 would be exacerbated.

The Dutch SyRI algorithm on welfare fraud detection and transparency

In this regard, another instructive case is the
Dutch district court of the Hague decision on
February 5, 2020 on legislation for the Dutch

as

a

lower

socio-economic

statusoranimmigration background”.
30

This Dutch district court decision provides agovernment’s use of the SyRI (System Risk

good

Indication) algorithm system to detect various

principle

forms of fraud, including social benefit, allowance,

combination with other principles, to assess theand tax fraud.

The district court assessedbalance between competing rights and interests,

closely whether or not the current form ofin the case of an application of algorithmic

legislation complied with Article 8 of thesystems in the public sector.

illustration
of

of

how

transparency

prominently

thestandsinout,European Convention on Human Rights (ECHR),

Nevertheless, transparency obligations have awhich protects the right to respect for private

persistent downside of being too instrumental

and family life, home and correspondence, andand burdensome for both regulators andruled that it did not.

regulated with nominal values for remedy.

In the reasoning, the court declared that the

Even in the case of the EU GDPR, according torisk model and risk indicators were“secret”,

theand the application of SyRI was insufficiently

problems for vigorous enforcement remain31.

two-yearassessment

report,resource“transparent”and“verifiable”. The court also

Furthermore, besides the data protection

mentioned that there is “a risk that SyRI

issues, the European Commission released the

inadvertently creates links based on bias, such

legislative proposal of the Data Governance Act

54

東京大学大学院情報学環紀要

情報学研究

№100

in November 2020, which facilitates “datasector bodies. The proposed Act is said to be

sharing”based on“data altruism”, particularlycompatible with existing laws of data protection,

relating to re-use of health data held by public

intellectual property, and trade secrets32.

5.

Conclusion

5.1

Centennial research collaborations

Lastly, coming back to this article’s mission tocelebrate the 100th issue of the Journal of
Information Studies, whose first issue wasof domestic and regional laws that governtransborder flows of data and information.
There have already been discussions on thefocused on social science research in the areas

so-called “Brussels

Effect”, whichistheof mass communications, newspapers, and“unilateral regulatory globalization” when ajournalism33. The title of the journal changed

single state is able to externalize its laws andtwice until the current one was adopted,

regulations outside its borders through market

accompanied by organizational reforms and amechanisms, resulting in the“globalization ofbroadening of the scope of interdisciplinary

standards”, whose process is distinguishable

research relating to information across thefrom international treaties among states34. Still,humanities, social sciences, natural sciences andin consideration of cases taken up in the previous

technology studies at the University of Tokyo.

sections in this article, the global reach andIn honoring the founding frontier spirit of thispractical spillover effects of the EU data

journal, this article has striven to identify

protection laws are remarkable35.

through a review of some recent cases a crude

another series of EU legislative proposals

but discernable strand of growing phenomena in

relating to data and information are yet to come,global data governance, which might be broadly

such emerging new phenomena of global law

conceived as the rise of“global information law”.

are worthy of attention and further investigation.

Given that

It has investigated the global reach and effects

5.2

The global reach of public-sector access rights in Japan

With respect to Japanese law on information

partlybecauseof

severecriticisms

fromprivacy and access rights, and principles ofoverseas against conventional styles of Japanesetransparency and accountability in the public

government administration for being overly

sector, there has been a robust commitment in

opaque and informal. These principles wereJapanese administrative law for several decades,

embodied

into

the

enactment

The Rise of“Global Information Law”: Centennial Perspectives on the Conceptualization of Japanese Information Law

of

the

55

Administrative Procedure Act in 1993, followedmaterial to make it accessible as much and as

by the enactment of a Japanese equivalent ofexpediently as possible. The system operates

the US Freedom of Information Act (FOIA),

through several means including allocation of ainformation access statutes36.

burden of proof, fee-setting, and open reason-

As evidence of the effectiveness of remedy inthe public sector, it might be useful to share thegiving on the Internet.
Japan’
scomplexmulti-track

remedymulti-trackmechanism suffers from its own downside ofincentivized mechanism, the Review Board

being invisible and underused, both fromframework as an ADR-type for remedy, inoverseas and within the country. Nevertheless,addition to judicial remedy, covering a wide

combined information access rights, provided byrange of appeals under the FOIA and information

the Japanese FOIA and public-sector information

privacy statutes in the public sector, not evenprivacy statutes, enable any FOIA disclosure

exempting“designated state secret”materials37.

requester or any data subject to seek remedy

A disposition by the Review Board is notbeyond national borders, without high litigation

experience

of

the

JapaneseThe

costs. This kind of global reach of the Japanese

Review Board system is rather designed to

information access and privacy laws may be

incentivize those who possess a contested

laudable38.

binding and only advisory in nature.

5.3

Global information law: The next evolutionary step for Japanese information law?

This system design for access and informationof Japan, including privacy40. The basis of thisprivacy in the public sector is one manifestation

concept is the social perception of the word,ofof“information” in Japan which is intricately“information law”
, which lays down basic

woven with ideas, thoughts, and meanings in a

principles

for

different way from“data”or“knowledge”, asenforcement and remedy to provide morementioned in section 2 of this article. As thecomprehensive and effective solutions to far

nature of information is in dynamic flow, rather

reaching and diverse information-related legal

than static stocks, information law would haveissues which crosscut traditional fields of law39.

to embrace changes if it is to serve in globalized

Therefore, a concept of information law hassocieties.

theunderlying
andconceptualization

designmechanisms

been built upon to cover a broad set of values

In a descriptive sense, there is no statutefor civil rights and liberties, and any newly

titled “Joho-ho” (information law) in Japan.

emerged form of democratic values as laid out“Information law” is often defined concisely

generously in the post-World War II Constitution

and broadly as a field of“laws relating to the56

東京大学大学院情報学環紀要

情報学研究

№100

production, distribution and consumption of

imbalance problems we are witnessing amid the41
information”. In its essence, information law

COVID-19 crisis – in particular, shifting thedeveloped in Japan is the art of illuminating

undue burden away from those who are mostwhat we value today and tomorrow andvulnerable in this globalized society – depends

designing legal instruments to embody it.

on how we can infuse normative content into

Whether or not such recent endeavors for a
global law can meet the challenges presented by

the law attractive enough to all stakeholders,
wherever they may be.

the unprecedented scale of systemic power

Notes
1

This article is partly based on the author’s previous works including online presentations at the“Free Speech in the 21stCentury”global conference, organized by Alma Mater Europaea international university and the International Associationof Constitutional Law (IACL) on July 3, 2020, and the“Centennial Strategic Research Initiatives: A Kickoff Workshop”at the
University of Tokyo on December 28, 2020. English translation of Japanese text in this article is provided by the author,
unless otherwise specified. Website information cited in the article was last visited on March 8, 2021. This work was partly
supported by JSPS KAKENHI Grant Number 17K03501. The author wishes to express gratitude to Professor Emeritus
Junichi Hamada for thoughtful comments, Mr. David Buist for carefully proofreading the draft, and all participants of theconferences above and of classes at the University of Tokyo for stimulating discussions.

2See Yujiro Chiba, Hakkan ni Saishite [Forewords], and Gendai no Shinbun-jiyu [Freedom of the Press in Modern Society],
1 The Bulletin of the Institute of Journalism, Tokyo University 1-2, 16-30 (1952) [in Japanese]. The Institute of Journalism[Shinbun Kenkyujo in Japanese] was established at the University of Tokyo in 1949, and the preceding research organization
was established in 1929 at the Imperial University of Tokyo, to conduct social science study with a special emphasis on a
typical form of mass communications at that time, i.e., newspaper [shibun in Japanese]; see also Hideo Ono, Iwayuru Sekaisaiko
no Shuukanshi Aviso no Kenkyu [Study of Aviso, the so-called Oldest Weekly Newspaper in the World], The Bulletin of theInstitute of Journalism, supra, at 3-16 [in Japanese].

3For example, according to a legislative proposal of the“Data Governance Act”published in November 2020, definition of“data”in Article 2(1) stipulates that“any digital representation of acts, facts or information and any compilation of suchacts, facts or information, including in the form of sound, visual or audiovisual recording”. European Commission, Proposal
for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on European data governance (Data
Governance Act) (Nov. 25, 2020), COM(2020) 767 final, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:520
20PC0767&from=EN.

	

Article 4 of the General Data Protection Regulation (GDPR) defines‘personal data’to mean that:“any information relating
to an identified or identifiable natural person ‘data(
subject’); an identifiable natural person is one who can be identified,directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an
online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social
identity of that natural person”. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data and on the free movement of such data, andrepealing Directive 95/46/EC (General Data Protection Regulation), Official Journal of the European Union, L 119, Vol. 59 (May4, 2016), https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL&from=EN.

4

European Commission, WHITE PAPER On Artificial Intelligence - A European approach to excellence and trust (Feb. 19,
2020), COM(2020) 65 final, pp. 8, 16, https://ec.europa.eu/info/sites/info/files/commission-white-paper-artificial-intelligence-

The Rise of“Global Information Law”: Centennial Perspectives on the Conceptualization of Japanese Information Law

57

feb2020_en.pdf. It says that a definition of AI needs to have sufficient flexibility, and provides multiple versions provided
by the European Commission. For example, as an initial simpler version of definitions,“Artificial intelligence (AI) refers tosystems that display intelligent behavior by analysing their environment and taking actions--with some degree of autonomy--to achieve specific goals. AI-based systems can be purely software-based, acting in the virtual world (e.g. voice assistants,
image analysis software, search engines, speech and face recognition systems) or AI can be embedded in hardware
devices (e.g. advanced robots, autonomous cars, drones or Internet of Things applications)”. See European Commission,
COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE EUROPEAN COUNCIL, THE
COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE AND THE COMMITTEE OF THE REGIONS,
Artificial Intelligence for Europe (Apr. 25, 2018), COM(2018) 237 final, p. 1, https://ec.europa.eu/transparency/regdoc/
rep/1/2018/EN/COM-2018-237-F1-EN-MAIN-PART-1.PDF.
5

Toru Nishigaki, Joho [Information], in JOHO-GAKU JITEN [ENCYCLOPEDIA OF MEDIA AND INFORMATION STUDIES]
436 (Takashi Kitagawa et al. eds., 2002).

6

Shunya Yoshimi (David C. Buist trans.), Information, Theory, Culture & Society, Vol. 23, No. 2-3, March-May 2006, at 271-277.

7

Id. at 271-272.

8

See, e.g., Itsuko Yamaguchi, Beyond De Facto Freedom: Digital Transformation of Free Speech Theory in Japan, 38 Stan.
J. Int'l L. 109 (2002); Itsuko Yamaguchi, Kokka Anzenhosho niokeru Algorithm niyoru Kanshi: Kenpo jo no Genron no
Jiyu, Privacy to Platform Jigyosha no Yakuwari [Free Speech, National Security, and Privacy under Stress of Algorithmic
Surveillance: A Comparative Study of Japan and the United States], 3 Kenpo Kenkyu 47-54 (2018) [in Japanese]; Itsuko
Yamaguchi (Translated by David C. Buist), Cyberlaw, Theory, Culture & Society, supra note 6, at 529-531.

9

See, e.g., Glenn Greenwald, NSA Collecting Phone Records of Millions of Verizon Customers Daily, The Guardian, (June 6, 2013),
https://www.theguardian.com/world/2013/jun/06/nsa-phone-records-verizon-court-order; Barton Gellman & Laura Poitras,
U.S., British intelligence mining data from nine U.S. Internet companies in broad secret program, The Washington Post
(June 7, 2013), https://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companiesin-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story.html?utm_term=.8aabfe16aa1c; see also
THE PRESIDENT’S REVIEW GROUP ON INTELLIGENCE AND COMMUNICATIONS TECHNOLOGIES, LIBERTYAND SECURITY IN A CHANGING WORLD: REPORT AND RECOMMENDATIONS (Dec. 2013), https://obamawhitehouse.
archives.gov/blog/2013/12/18/liberty-and-security-changing-world.

10

Klayman v. Obama, 957 F.Supp.2d 1 (D.D.C. 2013); ACLU v. Clapper, 959 F.Supp.2d 724 (S.D.N.Y. 2013).

11

	Klayman, 957 F.Supp.2d at 8 n.6. Concerning issues of the government surveillance and standing of individual users andtheir service providers, see, e.g., Clapper v. Amnesty Int'l USA, 568 U.S. 398, 410-414, 422 (2013); Chapter Two Standing,
Surveillance, and Technology Companies, 131 Harv. L. Rev. 1742 (2018); Alan Z. Rozenshtein, Surveillance Intermediaries, 70
Stan. L. Rev. 99, 132, 156-157(2018).

12

	Klayman v. Nat'l Sec. Agency, 280 F. Supp. 3d 39, 55–58 (D.D.C. 2017), aff'd sub nom. Klayman v. Obama, 759 F. App'x 1 (D.C.
Cir. 2019).

13	See, e.g., Office of the Director of National Intelligence, Statistical Transparency Report: Regarding the Use of National
Security Authorities, Calendar Year 2019 (Apr. 2020),
https://www.odni.gov/files/CLPT/documents/2020_ASTR_for_CY2019_FINAL.pdf.

14

	The CJEU, Case C‑362/14, Maximillian Schrems v Data Protection Commissioner (Schrems I), at paras. 26-30 (Oct. 6, 2015),
ECLI:EU:C:2015:650, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362.

15

Id. at paras. 74-75, 94-98.

16

	The CJEU, Case C-311/18, Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (Schrems II) (July16, 2020), ECLI:EU:C:2020:559, http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doc
lang=en&mode=lst&dir=&occ=first&part=1&cid=8483023. See also Hendrik Mildebrath, European Parliamentary ResearchService, At A Glance: The CJEU Judgment in the Schrems II case (Sept. 2020), https://www.europarl.europa.eu/RegData/
etudes/ATAG/2020/652073/EPRS_ATA(2020)652073_EN.pdf. Regarding the SCC, see Article 26 of Directive 95/46/EC, andArticle 46 of the GDPR.

58

東京大学大学院情報学環紀要

情報学研究

№100

17

The CJEU, Schrems II, at paras 180-181. See also Recent Cases, 134 Harv. L. Rev. 1567, 1570-1572 (2021).

18

Regulation (EU) 2016/679 [GDPR], supra note 3.

19	The CJEU, Schrems II, at paras. 134-149; see also European Data Protection Board (EDPB), Frequently Asked Questions on
the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook
Ireland Ltd and Maximillian Schrems (July 24, 2020), https://edpb.europa.eu/sites/edpb/files/files/file1/20200724_edpb_
faqoncjeuc31118.pdf. See DANIEL J. SOLOVE & PAUL M. SCHWARTS, INFORMATION PRIVACY LAW 1291-1295 (7thed. 2021).

20

SOLOVE & SCHWARTS, supra note 19, at 1292-1294.

21	See, e.g., THE RIGHT TO BE FORGOTTEN: A COMPARATIVE STUDY OF THE EMERGENT RIGHT'S EVOLUTION
AND APPLICATION IN EUROPE, THE AMERICAS, AND ASIA (IUS COMPARATUM - GLOBAL STUDIES INCOMPARATIVE LAW, vol. 40) (Franz Werro ed., 2020).

22

	The CJEU, Case C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) andMario Costeja González (Google Spain), (May 13, 2014), ECLI:EU:C:2014:317, http://eur-lex.europa.eu/legal-content/EN/
TXT/?uri=CELEX:62012CJ0131.

23

	The CJEU, Google Spain, at paras. 55-56. See, Dan Jerker B. Svantesson, Article 3. Territorial scope, THE EU GENERALDATA PROTECTION REGULATION (GDPR): A COMMENTARY 79-81 (Christopher Kuner et al. eds., 2020).

24

Svantesson, supra note 23, at 81-96.

25

	EDPB, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3),Ver. 2.1 (12 Nov. 2019), https://edpb.europa.eu/sites/
edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf; Svantesson, supra note 23,
at 88.

26

	Commission Implementing Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European
Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of
Personal Information (Text with EEA relevance), Official Journal of the European Union, L 76, Vol. 59 (Mar. 19, 2019), at 1–58,
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019D0419&from=EN; European Commission, EU
Japan Adequacy Decision, Fact Sheet (Jan. 2019), https://ec.europa.eu/info/sites/info/files/research_and_innovation/law_
and_regulations/documents/adequacy-japan-factsheet_en_2019_1.pdf. See also Masao Horibe & George Shishido, Daiikki
Kojinjohohogo-iinkai wo Furikaeru, 1534 Jurist, at ii-v, 52-63 (2019) [in Japanese]; Shizuo Fujiwara et al., Special Feature, 2020
Kojinjohohogoho Kaisei, 1551 Jurist 13-53 (2020).

27	European Commission, Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on aSingle Market For Digital Services (Digital Services Act) and amending Directive 2000/31/EC (Dec. 15, 2020), COM(2020) 825
final, https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=72148; European Commission, Proposal for a REGULATION
OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on contestable and fair markets in the digital sector (DigitalMarkets Act)(Dec. 15, 2020), COM(2020) 842 final, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020
PC0842&from=en. See also European Commission, COMMUNICATION FROM THE COMMISSION TO THE EUROPEANPARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE AND THE COMMITTEE
OF THE REGIONS, On the European democracy action plan (Dec. 3, 2020), COM(2020) 790 final,	

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020DC0790&from=EN. See, e.g., Ryoji Mori et al.,Special Feature, Platform-kisei no Genzaichi, 1545 Jurist 13-44 (2020) [in Japanese]; George Shishido et al., Special Feature,
Internet-jo no Hibochusho-mondai, 1554 Jurist 13-52 (2021) [in Japanese].

28	See, e.g., State v. Loomis, 881 N.W.2d 749, 761 (Wis. 2016); Houston Fed'n of Teachers, Local 2415 v. Houston Indep. Sch. Dist.,
251 F. Supp. 3d 1168, 1171, 1175-1180 (S.D. Tex. 2017).

29

	See, e.g., FRANK PASQUALE, THE BLACK BOX SOCIETY: THE SECRET ALGORITHMS THAT CONTROL MONEY
AND INFORMATION 3-18, 216-218 (2015); Deven R. Desai & Joshua A. Kroll, Trust but Verify: A Guide to Algorithms andthe Law, 31 Harv. J.L. & Tech. 1 (2017); Hannah Bloch-Wehba, Access to Algorithms, 88 Fordham L. Rev. 1265, 1279-1295 (2020);
Robert Brauneis & Ellen P. Goodman, Algorithmic Transparency for the Smart City, 20 Yale J. L. & Tech. 103, 122-131, 153-159(2018); Cary Coglianese & David Lehr, Transparency and Algorithmic Governance, 71 Admin. L. Rev. 1 (2019).

The Rise of“Global Information Law”: Centennial Perspectives on the Conceptualization of Japanese Information Law

59

30

	Rechtbank Den Haag, SyRI legislation in breach of European Convention on Human Rights, Feb. 5, 2020,
ECLI:NL:RBDHA:2020:1878, C-09-550982-HA ZA 18-388 (English), https://www.escr-net.org/sites/default/files/caselaw/ecli_nl_
rbdha_2020_1878.pdf.

31	European Commission, COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE
COUNCIL Data protection as a pillar of citizens’empowerment and the EU’s approach to the digital transition - two years ofapplication of the General Data Protection Regulation (June 24, 2020) ,COM(2020) 264 final,
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020DC0264&from=EN.

32

See the proposed Data Governance Act, supra note 3.

33

Chiba, supra note 2, at 1-2.

34

Anu Bradford, The Brussels Effect, 107 Nw. U. L. Rev. 1, 3-4 (2012).

35

	See, e.g., ELAINE FAHEY, THE GLOBAL REACH OF EU LAW (2017); MARISE CREMONA & JOANNE SCOTT, EU
LAW BEYOND EU BORDERS: THE EXTRATERRITORIAL REACH OF EU LAW (2019).

36

	HIROSHI SHIONO, GYOSEIHO I [ADMINISTRATIVE LAW, Vol. 1] 76-95, 292-403 (6th ed. 2015) [in Japanese]. See also
Koichi Akasaka, Koukenryoku no Toumeisei to Riyukaiji, 27 Quarterly Jurist 139-150 (2018) [in Japanese]; about open reasongiving by the administrative remedy system in general, see, e.g., Yoichi Ohashi, Gyoseifufukushinsakai-toushin no Hougakukenkyu no Hitsuyousei to Igi, 32 Quarterly Jurist 90-98 (2020) [in Japanese].

37

	KATSUYA UGA, KOJINJOHOHOGOHO NO CHIKUJOKAISETSU [COMMENTARY ON PERSONAL INFORMATIONPROTECTION LAWS] 26, 466-476, 578-585, 662-665 (6th ed. 2018) [in Japanese]; UGA, NEW COMMENTARY, infra note 38.

38	See KATSUYA UGA, SHIN JOHOKOKAIHO NO CHIKUJOKAISETSU [NEW COMMENTARY ON INFORMATIONDISCLOSURE LAWS] 36-37, 56-58, 66-128, 196-205, 270, 295-296 (8th ed. 2018) [in Japanese]. See also Itsuko Yamaguchi,
Protecting Privacy against Emerging“Smart”Big Data Surveillance: What can be Learned From Japanese Law?, 1 PERCORSICOSTITUZIONALI, at 193, 199-204 (2014).

39

	See, e.g., JUNICHI HAMADA, JOHO-HO [INFORMATION LAW] (1993) [in Japanese]; KATSUYA UGA & YASUOHASEBE, JOHO-HO [INFORMATION LAW] (2012) [in Japanese]; MASAHIRO SOGABE ET AL., JOHO-HO GAISETSU[INFORMATION LAW: AN INTRODUCTION] (2d ed. 2019) [in Japanese]; TARO KOMUKAI, JOHO-HO NYUMON[INTRODUCTION TO INFORMATION LAW] (5th ed. 2020) [in Japanese]; George Shishido et al., Special Feature 1, Joho-ho
toiu Frontier, 479 Hougaku Kyoshitsu 4-42 (2020) [in Japanese]; YASUO HASEBE ET AL., MEDIA HANREI HYAKUSEN [100
SELECTED CASES IN MEDIA LAW] (2d ed. 2018) [in Japanese]; SHIGENORI MATSUI ET AL., INTERNET HO [INTERNET
LAW] (2015) [in Japanese]; NOBUHIRO NAKAYAMA, CHOSAKUKEN-HO [COPYRIGHT LAW] 11-42 (3rd ed. 2020). See also
ITSUKO YAMAGUCHI, JOHO-HO NO KOZO: JOHO NO JIYU, KISEI, HOGO [THE ARCHITECTURE OF INFORMATION
LAW: FREEDOM, REGULATION, AND PROTECTION OF INFORMATION] (2010) [in Japanese].

40	The current Japanese Constitution (Nihonkoku Kenpo) was promulgated in 1946. For the English translation, see National
Diet Library, The Constitution of Japan, based on the English Edition by Government Printing Bureau, https://www.ndl.
go.jp/constitution/e/etc/c01.html. For a brief overview of development of privacy and data protection laws in Japan, see,e.g., Itsuko Yamaguchi, A Japanese Equivalent of the“Right to Be Forgotten”: Unveiling Judicial Proactiveness to Curb
Algorithmic Determinism, in THE RIGHT TO BE FORGOTTEN, supra note 21, at 291-310, https://link.springer.com/chapt
er/10.1007/978-3-030-33512-0_15.

41	For an influential definitions of“information law”and a concept of“right to information”in Japan, see Junich Hamada, Joho-ho[Information Law], in JOHO-GAKU JITEN, supra note 5 [in Japanese], at 473; Junichi Hamada, Joho-media-housei [Information
Media Law], 60 Koho Kenkyu 25, 39-42 (1998)[in Japanese]; Junich Hamada, Joho-tsushin Seisaku no Aratana Dankai ni Mukete[Toward a New Stage of Information and Communications Policy Research], 1 Journal of Information and Communications
Policy 3-8 (2017) [in Japanese], https://www.jstage.jst.go.jp/article/jicp/1/1/1_3/_pdf/-char/en.

60

東京大学大学院情報学環紀要

情報学研究

№100

Itsuko Yamaguchi［専門］Information Law and Policy［主たる著書・論文］
Itsuko Yamaguchi, A Japanese Equivalent of the“Right to Be Forgotten”: Unveiling Judicial Proactiveness to
Curb Algorithmic Determinism, in THE RIGHT TO BE FORGOTTEN: A COMPARATIVE STUDY OF THE
EMERGENT RIGHT'S EVOLUTION AND APPLICATION IN EUROPE, THE AMERICAS, AND ASIA (IUS
COMPARATUM - GLOBAL STUDIES IN COMPARATIVE LAW, vol. 40) 291-310 (Franz Werro ed., 2020)
Itsuko Yamaguchi, Hyogen no Jiyu to Chosakuken: AI Jidai no“User Rights”Gainen to sono Check Kino
[Freedom of Expression and Copyright: A Concept of“User Rights”and its Checking Function in the Age ofArtificial Intelligence], 25 Quarterly Jurist 61-67 (2018) [in Japanese]
ITSUKO YAMAGUCHI, JOHO-HO NO KOZO: JOHO NO JIYU, KISEI, HOGO [THE ARCHITECTURE OF
INFORMATION LAW: FREEDOM, REGULATION, AND PROTECTION OF INFORMATION] (University ofTokyo Press, 2010) [in Japanese]［所属］
Professor of Information Law and Policy
Interfaculty Initiative in Information Studies
Graduate School of Interdisciplinary Information Studies
The University of Tokyo［所属学会］
Japan Public Law Association
Japanese American Society for Legal Studies
Japan Society for Studies in Journalism and Mass Communication
The Society of Socio-Informatics

The Rise of“Global Information Law”: Centennial Perspectives on the Conceptualization of Japanese Information Law

61

The Rise of“Global Information Law”:
Centennial Perspectives on the Conceptualizationof Japanese Information Law
Itsuko Yamaguchi*

How can we know, assess, and verify the unprecedented benefits and risks brought by innovative
cyber-physical hybrid technologies, and make laws to meet new challenges in balancing tradeoffs
especially relating to civil rights and liberties such as free speech, privacy, data protection, national
security, and secret surveillance? What lessons, if any, can be drawn from the Japanese experiencefrom a comparative law perspective?
To celebrate the 100th issue of the Journal of Information Studies, whose first issue was publishedin 1952, this article honors a founding frontier spirit of this journal in responding to new challenges
emerging with the latest technologies of the time.
This article aims to clarify a strand of intriguing recent phenomena in global data governance,
which might be broadly conceived as the rise of“global information law”. It investigates the global
reach of domestic and regional laws that govern transborder flows of data and information. It
proceeds with the following four steps.
First, this article starts with terminology of key terms, in particular,“information”, which has aconnotation of a dynamic“flow”or circulation and underlies the conceptualization of“informationlaw”in Japan in response to the so-called“informatization”of society roughly since the 1960s.
Second, it reviews some cases on power struggles relating to transborder data flows, privacy, dataprotection, national security, and online intermediaries and platforms from comparative perspectives
on laws of the United States, of the European Union, and of Japan. These cases highlight theincreasing role of online intermediaries and platforms in US government secret surveillance, andconcomitant EU judicial and legislative moves to extend the global reach of laws relating to privacy
and data protection beyond borders.
* Professor of Information Law and Policy, Interfaculty Initiative in Information Studies, Graduate School of Interdisciplinary
Information Studies, The University of Tokyo
Key Words：Information, Law, Privacy, National Security, Online Platform, Algorithm, Transparency

62

東京大学大学院情報学環紀要

情報学研究

№100

Third, this article points out another line of recent legislative proposals pertaining to such global
reach of the EU laws, which lean toward a more expanding scope of platform regulations. It also
takes up“black box”issues of algorithmic decision-making systems in the public sector.
Fourth and lastly, it concludes by discussing the potential global reach of Japanese information law
as a way of illuminating what we value beyond borders today and tomorrow - a matter requiring
further investigation in today’s globally connected societies.

The Rise of“Global Information Law”: Centennial Perspectives on the Conceptualization of Japanese Information Law

63