Source: https://www.whitecase.com/publications/article/transfer-personal-data-under-japans-amended-personal-information-protection-act
Timestamp: 2019-04-19 04:22:39+00:00

Document:
An extensive amendment to Japan's Act on the Protection of Personal Information (Act No. 57 of 2003, the "Act") was promulgated on September 9, 2015 and will become fully effective on a date that is set by cabinet order and falls before September 9, 2017. The amendment generally increases the burden on data controllers and places new restrictions on exporting personal data from Japan. This article focuses on transferring data between companies and from Japan to foreign countries. References in this article to the Act refer to the amended Act.
As a general rule, a data controller must not provide personal data to a third party without obtaining prior consent from the data subject. Subject to certain exceptions under the Act, a "third party" is a legal entity or natural person other than the data controller, whether abroad or in Japan, and includes affiliated companies of the data controller.
For example, when a retailer transmits consumer data to a manufacturer to aid in a product recall in compliance with the Consumer Product Safety Law (Act No. 31 of 1973) or when a bank reports personal data related to a suspicious transaction to Japan's Financial Services Agency in compliance with the Act on Prevention of Transfer of Criminal Proceeds (Act No. 22 of 2007).
For example, where family member contact information is given to a doctor in an emergency situation.
For example, where a school exchanges personal information of delinquent children with a child support center for the benefit of the children.
For example, where a data controller voluntarily shares employee personal data with the Japanese National Tax Authority.
(e) How the data subject can contact the data controller.
Items (a)-(e) above could be communicated via a public website or publicly viewable bulletin board or by targeted emailing. Opt-out consent is never valid for personal data that contains sensitive information such as race, religion and criminal record. The duty to register with the PIPC was newly imposed by the 2015 amendment to the Act. The PIPC will publicly disclose opt-out clauses that are submitted to it. Opt-out clauses put into use before the amendment takes effect are not exempt from this duty to register.
A data controller may provide personal data to a trustee (itakusaki) without notifying the data subject because a trustee is not considered a third party under the Act. A trustee is an entity that is entrusted with personal data to perform a task for the data controller, that is restricted from using the personal data for its own purposes, and that uses the personal data only within the purposes of use communicated to the data subject. Common examples of a trustee include an email storage company and a package delivery company.
A data controller may provide personal data to a third party where the personal data is provided due to a succession of business such as a merger, company split or business transfer. This merger exception applies only when a succession of business actually happens; it does not apply at the due diligence stage of an M&A transaction. If the potential purchaser requests the target company to provide personal data that it holds before consummation of the M&A transaction, the target company is required to enter into an agreement that ensures that the potential purchaser will comply with the Act. The agreement should restrict how the potential purchaser uses the personal data, set forth matters concerning the handling the personal data, require the potential purchaser to create a response plan in case of a personal data leak, and provide for how to treat the personal data if the contemplated transaction does not close. Often times, a target company can comply with its duty to not provide personal data to third parties by redacting the documents it provides for due diligence review so as to make it impossible to identify individuals from the documents.
(8) The disclosee qualifies as a joint user.
(d) Contact information for the entity in charge of managing the jointly used personal data.
The joint user exception was designed to be used among group companies.
In contrast to EU data protection law, the Act did not originally place restrictions specifically on the transfer of personal data to foreign countries. The 2015 amendment to the Act introduced restrictions on transferring data abroad.
(ii) The specific third-party transferee upholds data protection standards to be determined by the PIPC.
There are no reporting requirements related to transferring personal data abroad.
When a data controller transfers personal data to a third party, the transferor must document (i) the transfer date, (ii) the recipient's name and (iii) other recipient information to be determined by the PIPC. The transferor must maintain these records for a period to be determined by the PIPC.
When a data controller receives personal data from a third party, the recipient must ascertain (i) the transferor's name (and the transferor's representative's name if the transferor is a legal entity), (ii) the transferor's address and (iii) how the transferor came to possess the personal data. In addition, the recipient must document (i) the date of receipt of the personal data, (ii) the fact that the recipient actually ascertained the matters required to be ascertained, and (iii) other information to be determined by the PIPC. The recipient must maintain these records for a period to be determined by the PIPC.
 Guidelines Targeting Economic and Industrial Sectors Pertaining to the Act on the Protection of Personal Information (Health, Labour and Welfare Ministry and the Ministry of Economy, Trade and Industry ("METI") Notice No.2, December 12, 2014) ("METI Guidelines"), Art. 2-2-4 (1).
 METI Guidelines, Art. 2-2-4 (1)(i), 2-2-1 (5)(i).
 METI Guidelines, Art. 2-2-4 (1)(ii), 2-2-1 (5)(ii).
 METI Guidelines, Art. 2-2-4 (1)(iii), 2-2-1 (5)(iii).
 METI Guidelines, Art. 2-2-4 (1)(iv), 2-2-1 (5)(iv).
 METI Guidelines, Art. 2-1-7, 2-1-11.
 Act, Art. 23-2. The 2015 amendment added a definition of sensitive information to Art. 2-3 of the Act.
 METI Guidelines, Art. 2-2-4 (3)(i).

References: Art. 2
 Art. 2
 Art. 2
 Art. 2
 Art. 2
 Art. 2
 Art. 23
 Art. 2
 Art. 2