(2) personal data (where data has been systematically organized to facilitate a search
for particular personal information); and (3) retained personal data (personal data
retained for more than 6 months).
The most comprehensive category of these is the “personal information” group,
which defines personal information as information relating to a living individual
containing (i) a name, date of birth, other descriptions, etc., whereby a specific
individual can be identified (including that which can be readily collated with other
information, thereby identifying a specific individual); or (ii) an individual identification code.
4
When handling personal information in general, Business Operators must specify
the purpose of the use (Article 15), confine the use to said purpose (Article 16),
adhere to the appropriate method of gathering the personal information (Article 17),
and provide notice or publication of the purpose of use (Article 18).
Regarding personal data, it is also necessary to ensure accurate and updated data
(Article 19), the presence of safety control measures (Article 20), supervision of
employees (Article 21), supervision of contractors (Article 22), and consent of the
data principal in providing data to a third party.
When handling retained personal data, Business Operators shall make public their
name or appellation, the purpose of use, the procedures for disclosure, etc. (Article
24), and they are obliged to respond to requests from the data principal regarding
disclosure, correction, or suspension of use (Articles 25–27).
The 2015 amendment established two new categories: special care-required
personal information and anonymously processed information.
Special care-required personal information means personal information that
includes a principal’s race, creed, social status, medical history, criminal record,
fact of having suffered damage by a crime, or other description that is prescribed by
cabinet order as information that requires special care so as not to inflict unfair
discrimination, prejudice, or other disadvantages on the principal (Article 2(3)).
Special care-required personal information shall not be acquired without obtaining
the principal’s consent in advance (Article 17).
4 Article 2(1) states the following: “‘Personal information’ in this Act means information relating to
a living individual that falls under any of the following items:
(i) information containing a name, date of birth, other description, etc. (meaning any and all
matters – excluding an individual identification code – stated, recorded, or otherwise expressed
using voice, movement, or other methods in a document, drawing, or electromagnetic record
(meaning a record kept in an electronic, magnetic, or other form that cannot be recognized
through the human senses; the same shall apply in the succeeding paragraph (ii) and in Article
18, Paragraph 2 (hereinafter “same”)) whereby a specific individual can be identified (including that which can be readily collated with other information and thereby identify a specific
individual); or
(ii) information containing an individual identification code.”
Source: The PPC, Amended Act on the Protection of Personal Information (Tentative Translation), https://www.ppc.go.jp/files/pdf/280222_amendedlaw.pdf. Accessed 6 Nov 2018.
256
T. Komukai
for particular personal information); and (3) retained personal data (personal data
retained for more than 6 months).
The most comprehensive category of these is the “personal information” group,
which defines personal information as information relating to a living individual
containing (i) a name, date of birth, other descriptions, etc., whereby a specific
individual can be identified (including that which can be readily collated with other
information, thereby identifying a specific individual); or (ii) an individual identification code.
4
When handling personal information in general, Business Operators must specify
the purpose of the use (Article 15), confine the use to said purpose (Article 16),
adhere to the appropriate method of gathering the personal information (Article 17),
and provide notice or publication of the purpose of use (Article 18).
Regarding personal data, it is also necessary to ensure accurate and updated data
(Article 19), the presence of safety control measures (Article 20), supervision of
employees (Article 21), supervision of contractors (Article 22), and consent of the
data principal in providing data to a third party.
When handling retained personal data, Business Operators shall make public their
name or appellation, the purpose of use, the procedures for disclosure, etc. (Article
24), and they are obliged to respond to requests from the data principal regarding
disclosure, correction, or suspension of use (Articles 25–27).
The 2015 amendment established two new categories: special care-required
personal information and anonymously processed information.
Special care-required personal information means personal information that
includes a principal’s race, creed, social status, medical history, criminal record,
fact of having suffered damage by a crime, or other description that is prescribed by
cabinet order as information that requires special care so as not to inflict unfair
discrimination, prejudice, or other disadvantages on the principal (Article 2(3)).
Special care-required personal information shall not be acquired without obtaining
the principal’s consent in advance (Article 17).
4 Article 2(1) states the following: “‘Personal information’ in this Act means information relating to
a living individual that falls under any of the following items:
(i) information containing a name, date of birth, other description, etc. (meaning any and all
matters – excluding an individual identification code – stated, recorded, or otherwise expressed
using voice, movement, or other methods in a document, drawing, or electromagnetic record
(meaning a record kept in an electronic, magnetic, or other form that cannot be recognized
through the human senses; the same shall apply in the succeeding paragraph (ii) and in Article
18, Paragraph 2 (hereinafter “same”)) whereby a specific individual can be identified (including that which can be readily collated with other information and thereby identify a specific
individual); or
(ii) information containing an individual identification code.”
Source: The PPC, Amended Act on the Protection of Personal Information (Tentative Translation), https://www.ppc.go.jp/files/pdf/280222_amendedlaw.pdf. Accessed 6 Nov 2018.
256
T. Komukai