Intellectual Property Law

Japan?s Privacy Law

By Martha L. Arias

Corporate use of the Internet prompted governments? revision of privacy laws.  Nowadays, personal and sensitive information is stored in and handled through computers and intranet.    Thus, privacy law is added to the group of laws a corporation must comply with; and when those corporations network internationally, knowledge of foreign privacy laws becomes an imperative. This article offers information about Japan?s 2005 law on privacy and protection of personal information.     

Japan?s Personal Information Protection Act (IPA), Law No. 57 of 2003, entered into force on April, 2005.  Article 1 states that IPA?s goal is to protect individuals? rights and interests given the increase in the use of personal information in the information and communication society.  IPA is mainly directed to the private sector; therefore, additional regulations by respective government ministries complement IPA depending on the business industry. This means, a telecommunications company in Japan must follow IPA?s guidelines and those privacy rules directly applied to this industry. 

IPA defines important terms such as (1) personal data.  This is defined as personal information stored in a personal information database (Article 2); (2) Personal information is that information about a person that can identify him/her by name, date of birth, and other personal descriptions that allow identification such as information in public journals, phone books, among others; (3) Entity Handling Personal Information is that entity that uses a ?personal information database? as part of its operations.  IPA rules apply to these entities with the exception of national institutions, local public institutions, independent administrative agencies, and any entity the government designates as having minimal risk when handling personal information. Entities having minimal risk and exempted from IPA?s rules are those handling less than 5,000 individuals? records during a six-month period.  Therefore, a start-up business handling personal information might initially be exempted from IPA?s rules; (4) Personal Information Database is any systematic collection of information, including personal information, through electronic computation equipment or any other systematic method that facilitates the search of personal information.  Indeed, any systematic collection of personal information, not only electronic, constitutes a personal information database. 

IPA chapter 4 establishes the duties of the entities handling personal information.  For instance, some of the duties are (1) specify the purpose of use.  The purpose of use of personal information must be specified as much as possible and not changed beyond its scope; (2) restrictions on the purpose of use. These restrictions include requesting consent from owner of personal information and requesting the prior consent in the case of mergers; (3) proper acquisition.  This duty requires that personal information must not be acquired by fraudulent or dishonest means; (4) notice of the purpose of use.  This duty requires personal or public notification, depending on the company, of the purpose of use of personal information; (5) maintenance of accurate data.  Personal data must be maintained accurate and up to date within the scope necessary to achieve its purpose; (6) security control measures. Companies handling personal data must secure it as to avoid loss, damage, or leakage; (7) supervision of employees. Entities handling personal data must exercised necessary and appropriate supervision over employees to assure security of personal data.  Please, see law for additional duties under IPA.

IPA establishes penalties for violation of IPA?s rules.  Some of the penalties include imprisonment for no more than six months and/or fines of up to $300,000 Yen; and fines of up to $300,000 for failure to provide reports under this law.

Full post as published by IBLS Internet Law Blog on July 15, 2009 (boomark / email).