Anonymously processed information means information relating to an individual
that can be produced from processing personal information, precludes the identification of a specific individual by taking proper actions as prescribed, and precludes
the ability to restore the personal information (Article 2(9)). Operators are permitted
to provide anonymously processed information to a third party without obtaining a
principal’s consent in advance as long as they comply with the procedure and
obligations set forth in the APPI (Articles 36–39).
Figure 2 presents the categories and the obligations associated with each.
2.3 Supervisory Authority
In January of 2016, the Personal Information Protection Commission (PPC), an
independent monitoring and supervising body responsible for the overall protection
of personal information, was established.
The PPC is the general supervisory authority under the APPI. Before the PPC’s
authority was established in May 2017, the competent ministers of each industry to
which Business Operators belonged had supervisory authority as regulatory bodies.
Even though the PPC’s authority has been established, it can still delegate reporting,
hearing and on-site inspection authority to the business jurisdictional minister and
the minister must then report the results to the PPC (Article 44).
The PPC has authority to supervise the handling of personal information under
the APPI, information associated with numbers under the My Number Act, anonymously processed information handled by administrative organs, etc. The PPC does
Categories Categories
Personal Information
Information relating to a living individual
Specifying the purpose of use, restrictions on use (Articles
15,16)
Appropriate acquisition (Article 17), notice and publication
of purpose of use (Article 18)
Appropriate handling of complaints (Article 35)
Ensuring the accuracy and freshness of data (Article 19)
Safety control measures (Article 20)
Supervision of employees (Article 21)
Supervision of contractors (Article 22)
Obtaining consent of data subjects for disclosure (Article 23)
Restriction on provision abroad (Article 24)
Keeping a record on a third-party provision (Article 25)
Ensuring the legality of a third-party provision (Article 26)
Releasing procedures for requesting disclosure, correction,
and suspension of use (Article 27)
Disclosure, correction, and suspension of use upon
requests (Articles 28–34)
Obtaining consent of data subjects in advance of acquiring
(Article 17)
(i) a specific individual can be identified, or
(ii) containing an individual identification code
Personal Data
Retained Personal Data
Such data having been
systematically organized to be
easily searchable for particular
personal information
Personal data retained
for more than 6 months
Special Care-Required
Personal Information
Personal information that requires special care
so as not to inflict unfair discrimination
Obligations Obligations
Fig. 2 Categories of personal information and associated obligations [Source: Komukai (2018)]
Data Protection in the Internet: Japanese National Report
257
that can be produced from processing personal information, precludes the identification of a specific individual by taking proper actions as prescribed, and precludes
the ability to restore the personal information (Article 2(9)). Operators are permitted
to provide anonymously processed information to a third party without obtaining a
principal’s consent in advance as long as they comply with the procedure and
obligations set forth in the APPI (Articles 36–39).
Figure 2 presents the categories and the obligations associated with each.
2.3 Supervisory Authority
In January of 2016, the Personal Information Protection Commission (PPC), an
independent monitoring and supervising body responsible for the overall protection
of personal information, was established.
The PPC is the general supervisory authority under the APPI. Before the PPC’s
authority was established in May 2017, the competent ministers of each industry to
which Business Operators belonged had supervisory authority as regulatory bodies.
Even though the PPC’s authority has been established, it can still delegate reporting,
hearing and on-site inspection authority to the business jurisdictional minister and
the minister must then report the results to the PPC (Article 44).
The PPC has authority to supervise the handling of personal information under
the APPI, information associated with numbers under the My Number Act, anonymously processed information handled by administrative organs, etc. The PPC does
Categories Categories
Personal Information
Information relating to a living individual
Specifying the purpose of use, restrictions on use (Articles
15,16)
Appropriate acquisition (Article 17), notice and publication
of purpose of use (Article 18)
Appropriate handling of complaints (Article 35)
Ensuring the accuracy and freshness of data (Article 19)
Safety control measures (Article 20)
Supervision of employees (Article 21)
Supervision of contractors (Article 22)
Obtaining consent of data subjects for disclosure (Article 23)
Restriction on provision abroad (Article 24)
Keeping a record on a third-party provision (Article 25)
Ensuring the legality of a third-party provision (Article 26)
Releasing procedures for requesting disclosure, correction,
and suspension of use (Article 27)
Disclosure, correction, and suspension of use upon
requests (Articles 28–34)
Obtaining consent of data subjects in advance of acquiring
(Article 17)
(i) a specific individual can be identified, or
(ii) containing an individual identification code
Personal Data
Retained Personal Data
Such data having been
systematically organized to be
easily searchable for particular
personal information
Personal data retained
for more than 6 months
Special Care-Required
Personal Information
Personal information that requires special care
so as not to inflict unfair discrimination
Obligations Obligations
Fig. 2 Categories of personal information and associated obligations [Source: Komukai (2018)]
Data Protection in the Internet: Japanese National Report
257