Investigation authorities may request to retain communications records including
origination and destination, date and time, and other history of transmission information (Article 197(3)).
The request is not restricted to a particular charged offense. A public prosecutor, a
public prosecutor’s assistant officer, or a judicial police officer may request retention
when they deem it necessary to execute a seizure.
According to the exclusionary rule or the fruit of the poisonous tree theory, data
cannot be used as evidence in a trial when it is deemed to be illegally collected evidence.
3.4 Data Protection and Electronic Surveillance for Security
and Defense Purposes
The Act on Wiretapping for Criminal Investigations stipulates the procedures
concerning the interception of communications made by investigation authorities.
As for tracing by installing a GPS device to a suspect’s car without notice, the
Supreme Court held that such an investigation must be conducted under legitimate,
statutory procedures and new legislation is necessary.
16
There is no legislation addressing the processing of personal information for
national security or defense purposes. Although Article 23 of the APPI requires
operators to obtain a principal’s consent in advance before providing personal data to
a third party, operators are permitted to provide such information in a case “based on
law and regulations” or “in which there is a need to protect a human life, body or
fortune, and when it is difficult to obtain a principal’s consent”. Therefore, if the
processing satisfies one of these conditions, information can be acquired even
without the consent of the principal.
3.5 Remedies and Sanctions
The PPC has the authority to require reports, make onsite inspections (Article 40),
provide guidance, give advice (Article 41), make recommendations, and issue orders
(Article 42) to the Business Operators. There are punishment provisions for not
complying with an order of the PPC (Article 84), making false statements, or for a
lack of reporting (Article 85). When an employee commits a violative act in relation
to the business of a corporate body, a fine will be imposed on both the employee and
the corporate body (Article 87).
Damages for data leakage are claimed based on tort law as set forth in the Civil
Code. Article 709 stipulates that “a person who has intentionally or negligently
infringed upon any right of others or legally protected interest of others shall be
16 Saiko Saibansho [Sup. Ct.], March 15, 2017, 2333 Hanji 4 (Japan).
264
T. Komukai
origination and destination, date and time, and other history of transmission information (Article 197(3)).
The request is not restricted to a particular charged offense. A public prosecutor, a
public prosecutor’s assistant officer, or a judicial police officer may request retention
when they deem it necessary to execute a seizure.
According to the exclusionary rule or the fruit of the poisonous tree theory, data
cannot be used as evidence in a trial when it is deemed to be illegally collected evidence.
3.4 Data Protection and Electronic Surveillance for Security
and Defense Purposes
The Act on Wiretapping for Criminal Investigations stipulates the procedures
concerning the interception of communications made by investigation authorities.
As for tracing by installing a GPS device to a suspect’s car without notice, the
Supreme Court held that such an investigation must be conducted under legitimate,
statutory procedures and new legislation is necessary.
16
There is no legislation addressing the processing of personal information for
national security or defense purposes. Although Article 23 of the APPI requires
operators to obtain a principal’s consent in advance before providing personal data to
a third party, operators are permitted to provide such information in a case “based on
law and regulations” or “in which there is a need to protect a human life, body or
fortune, and when it is difficult to obtain a principal’s consent”. Therefore, if the
processing satisfies one of these conditions, information can be acquired even
without the consent of the principal.
3.5 Remedies and Sanctions
The PPC has the authority to require reports, make onsite inspections (Article 40),
provide guidance, give advice (Article 41), make recommendations, and issue orders
(Article 42) to the Business Operators. There are punishment provisions for not
complying with an order of the PPC (Article 84), making false statements, or for a
lack of reporting (Article 85). When an employee commits a violative act in relation
to the business of a corporate body, a fine will be imposed on both the employee and
the corporate body (Article 87).
Damages for data leakage are claimed based on tort law as set forth in the Civil
Code. Article 709 stipulates that “a person who has intentionally or negligently
infringed upon any right of others or legally protected interest of others shall be
16 Saiko Saibansho [Sup. Ct.], March 15, 2017, 2333 Hanji 4 (Japan).
264
T. Komukai