Introduction

The Act on the Protection of Personal Information (Act No. 57 of 30 May 2003 – the “APPI”) is the main law regulating data privacy in Japan. It applies to all business operators (natural persons or legal entities) located in Japan that handle personal information, with the purpose to strike a balance between the protection of the rights and interests of individuals and the use of personal information.

Originally enacted in 2003, the APPI has been subject to several amendments pursuant to the so-called ‘triennal review’ provisions added in 2015, which provide a reform procedure every 3 year to adapt the APPI to the significant progress in information and communication technology.

Accordingly, the Personal Information Protection Commission (“PPC”) is preparing for the next amendment to the APPI expected to be finalized in 2025. Following the release of the interim report on 27 June 2024 and a public consultation phase, the PPC has released on 5 March 2025 the “Proposal for an approach to the system issues surrounding the Personal Information Protection Act” (the “Proposal Draft”) which may have a substantial impact on businesses handling personal data.

Being noted that, as the Proposal Draft only reflects regulatory intentions, it is not legally binding at this stage. The timeline for the finalization and enforcement of the amendments to the APPI has not yet been officially confirmed.

Key issues and proposals

The Proposal Draft aims to address three key main issues as identified in the interim report, 1) tailoring consent requirements based on the nature of the individual or the intended use of data, 2) mitigating risks associated with biometric data collection, and 3) ensuring effective compliance with the APPI; all without hindering innovation or progress.

1. Tailoring consent requirements to individuals or data use

The PPC proposes a more flexible framework for obtaining consent, this requirement being either tightened or relaxed depending on the context of data collection and characteristics of data subjects.

As the APPI does not currently contain any provision in relation to the processing of information of children, guidelines regarding the APPI generally provide that, in circumstances where consent is required for the processing of personal data of minors aged 12 to 15, such as in cases involving the use of personal data for purposes beyond those originally specified, the collection of sensitive personal information, or the provision of such data to third parties, consent should be obtained from a legal representative or other duly authorized guardian. However, such guidance remains merely advisory in nature and may not, in and of itself, constitute a sufficient or comprehensive legal basis for compliance.

Therefore, the PPC discusses introducing specific rules for such children under age of 16. It is proposed that, where consent is required, it would need to be obtained from the legal guardian. It is also considered granting minors (or their guardians) the right to request suspension of data use, even if no unlawful processing has occurred. Businesses would further be required to act in the best interest of the child when handling such data, and guardians must do the same when granting consent. In light of the vulnerability of children and past incidents involving serious breaches of children’s personal information, consideration is also being given to strengthening the obligations of businesses to implement appropriate security control measures.

At the same time, the PPC suggests to allow personal data to be processed or shared with third parties without individual consent (and therefore, no longer require it) when (i) data is used solely for statistical purposes or general-purpose analysis (i.e., for AI training), (ii) data is shared for the fulfillment of a contract or in situations where such use clearly aligns with the individual’s intent (for example, hotel booking intermediaries or international fund transfers) and (iii) data is used for public health or medical and scientific research. Overall, the idea is to relax consent requirements when it is used for research purposes and/or is very unlikely to infringe individual rights. In any case, such exemptions would be subject to strict safeguards, such as prior disclosure of processing purposes, contractual limitations, and prohibiting further use or onward transfer.

In extension, the Proposal Draft considers exempting businesses from immediate reporting of personal data breaches in low-risk cases (especially when only one individual is affected or when internal identifiers are leaked), particularly if the business has obtained certification from a third party attesting to adequate security safeguards.

2. Mitigating risks associated with biometric data collection

With the development of AI-powered cameras and facial recognition technologies, the Proposal Draft highlights the need to reinforce the legal framework applicable to facial feature data as it holds high privacy sensitivity due to its permanence and ease of collection without the individual’s knowledge. It is envisioned that the term “facial feature data” would be defined as information extracted from the structure of the face, skin tone, and the position and shape of facial components such as the eyes, nose, and mouth, which enables the identification of an individual through devices or software designed for that purpose. It should be noted that ordinary facial photographs would not fall under the definition of “facial feature data.”

With that in mind, key proposals include:

• requiring businesses to disclose detailed information on the use of facial feature data such as purpose of use, data collection methods, and how individuals can request suspension of processing;
• prohibiting the third-party transfer of facial feature data under the opt-out model as provided for by the APPI; and
• allowing individuals to request suspension of use, even if the data was lawfully obtained.

3. Ensuring effective compliance with the APPI

The third issue identified through the review process of the APPI is the need for a better response to system or large-scale violations, both before and after such violations occur.

In the light of this, the PPC aims to first ensure the effectiveness of recommendations and orders, suggesting that emergency orders may be issued before a violation results in actual harm if there is a clear risk of significant infringement. The PPC also suggested to provide legal basis for, when a business fails to comply with an order, the PPC may be authorized to request cooperation from third parties, such as hosting providers or search engines to suspend access to services that facilitate continued non-compliant data processing.

In addition, it is considered to create a ‘surcharge system’, a new administrative fine system targeting serious or large-scale violations such as unlawful data transfers for economic gain or major data breaches. Under the APPI, administrative supervisory authorities over personal information handling business operators that have committed violations of the law include the authority to issue guidance and advice, recommendation, and orders. However, if a violating business operator discontinues the unlawful conduct after receiving a recommendation or order, no penalties will be imposed. Consequently, the operator may retain the economic benefits gained from the violation without facing any punitive consequences.

Therefore, the PPC suggested that the fine amount should be equal to the financial benefit obtained from the use of personal data in violation of the APPI, by multiplying for instance the sales by a certain rate, keeping in mind that this should not cause excessive loss either. To be noted that the PPC maintained this proposal although strong opposition has been expressed at hearings by stake holders at the relevant organizations following the publication of the interim report.

Another key proposition comes from the realisation that it is, in practice, complicated (not to say impossible) for victims of violation of the APPI to obtain rightful compensation, for reasons relating to proof or the amount of damages per victim. To address this issue, the PPC considers the introduction of an injunction mechanism allowing certified consumer organizations to request the cessation of unlawful processing practices. A collective damage recovery system is also under review, to enable compensation for data subjects in cases of mass data leaks.

Impact on businesses

Based on the content of the Proposal Draft, businesses who process such personal data are advised to review their internal systems to assess whether they may benefit from the relaxation of consent requirements and reporting obligations, and to prepare to amend the rules related to the processing of biometric data and children’ personal information, that are very likely to be enhanced. More specifically, it is necessary to examine whether the services collecting personal information are directed at individuals under the age of 16, to ensure that users are properly notified of the purposes of use, to review the methods by which consent is obtained, and to assess the design of personal information input interfaces and terms of use.

As additional requirements may be placed on businesses depending on future discussions or public comments to the Proposal Draft, it is recommended to closely monitor what kind of impact these changes will have, even prior to formal amendment of the law, and to consider establish an internal system to ensure alignment with the possible new rules.

村上 愛実 | Shahzel Asghar