liable to compensate for damages resulting in consequence”. As for mental or
psychological harm, one can make a claim for compensation under Article 710.
Additionally, those who employ others for a certain business shall be liable for
damages inflicted on a third party by their employees with respect to the execution of
said business based on Article 715. Table 2 presents information on a few court
decisions regarding data leakage.
Violations of the handling of confidential information protected by secrecy of
communications by a telecommunications carrier are subject to imprisonment with
work of not more than 2 years or a fine of not more than 1 million yen. If a person
engaging in a telecommunications business violates the provisions of confidential
information protected by secrecy of communications, he or she shall be punished by
imprisonment with work of not more than 3 years or a fine of not more than 2 million
yen (Article 179 of the Telecommunications Business Act).
Under the Act on Regulation of Transmission of Specified Electronic Mail, the
Minister for Internal Affairs and Communications may order senders of advertisements or promotional mail to take appropriate action when it is necessary to prevent
disturbances in the transmission and reception of electronic mail (Article 7). A
violation of such order and the prohibition of transmission under false sender
information are subject to imprisonment with work for a term not exceeding
1 year or a fine not exceeding 1 million yen (Article 34). Additionally, when an
employee is acting within the scope of the business of a corporation, a fine not
exceeding 30 million yen will also be imposed on the corporation (Article 37).
As for the Act on Specified Commercial Transactions, violations of the opt-in
rule, the prohibition of transmissions to persons who refuse to receive e-mails that
advertise mail order sales, and obligations to make a record of opt-in participants are
Table 2 Court decisions on personal data protection in Japan
Data Controller
Cases
Compensation
(yen/plaintiff)
The City of Uji
a
Negligence in data security which caused data theft,
including information from the Basic Resident Registrar
by a part-time worker of a contractor
15,000
Waseda
University
b
Providing a list of 1400 student participants of an event to
the Tokyo Metropolitan Police Department for security
purposes without consent
5000
Yahoo! BB
c
Negligence in data security which caused customer data
theft by a former employee and his acquaintance illegally
accessing a server
6000
Tokyo Beauty
Center (TBC)
d
Negligence in data security for questionnaire and response
data stored without access control on a web server
22,000
a Osaka Koto Saibansho [Osaka High. Ct.], Dec. 25, 2001, 265 Hanrei Chihoujichi 11 (Japan); Saiko
Saibansho [Sup. Ct.], Jul. 11, 2002, 265 Hanrei Chihoujichi 11 (Japan)
b
Saiko Saibansho [Sup. Ct.], Sep. 12, 2003, 1823 Hanji 3 (Japan)
c Osaka Chiho Saibansho [Osaka Dist. Ct.], May 19, 2006, 1948 Hanji 122 (Japan); Osaka Koto
Saibansho [Osaka High. Ct.], Jun. 21, 2007, Unpublished (Japan)
d
Tokyo Koto Saibansho [Tokyo High. Ct.], Aug. 28, 2007, Unpublished (Japan)
Data Protection in the Internet: Japanese National Report
265
psychological harm, one can make a claim for compensation under Article 710.
Additionally, those who employ others for a certain business shall be liable for
damages inflicted on a third party by their employees with respect to the execution of
said business based on Article 715. Table 2 presents information on a few court
decisions regarding data leakage.
Violations of the handling of confidential information protected by secrecy of
communications by a telecommunications carrier are subject to imprisonment with
work of not more than 2 years or a fine of not more than 1 million yen. If a person
engaging in a telecommunications business violates the provisions of confidential
information protected by secrecy of communications, he or she shall be punished by
imprisonment with work of not more than 3 years or a fine of not more than 2 million
yen (Article 179 of the Telecommunications Business Act).
Under the Act on Regulation of Transmission of Specified Electronic Mail, the
Minister for Internal Affairs and Communications may order senders of advertisements or promotional mail to take appropriate action when it is necessary to prevent
disturbances in the transmission and reception of electronic mail (Article 7). A
violation of such order and the prohibition of transmission under false sender
information are subject to imprisonment with work for a term not exceeding
1 year or a fine not exceeding 1 million yen (Article 34). Additionally, when an
employee is acting within the scope of the business of a corporation, a fine not
exceeding 30 million yen will also be imposed on the corporation (Article 37).
As for the Act on Specified Commercial Transactions, violations of the opt-in
rule, the prohibition of transmissions to persons who refuse to receive e-mails that
advertise mail order sales, and obligations to make a record of opt-in participants are
Table 2 Court decisions on personal data protection in Japan
Data Controller
Cases
Compensation
(yen/plaintiff)
The City of Uji
a
Negligence in data security which caused data theft,
including information from the Basic Resident Registrar
by a part-time worker of a contractor
15,000
Waseda
University
b
Providing a list of 1400 student participants of an event to
the Tokyo Metropolitan Police Department for security
purposes without consent
5000
Yahoo! BB
c
Negligence in data security which caused customer data
theft by a former employee and his acquaintance illegally
accessing a server
6000
Tokyo Beauty
Center (TBC)
d
Negligence in data security for questionnaire and response
data stored without access control on a web server
22,000
a Osaka Koto Saibansho [Osaka High. Ct.], Dec. 25, 2001, 265 Hanrei Chihoujichi 11 (Japan); Saiko
Saibansho [Sup. Ct.], Jul. 11, 2002, 265 Hanrei Chihoujichi 11 (Japan)
b
Saiko Saibansho [Sup. Ct.], Sep. 12, 2003, 1823 Hanji 3 (Japan)
c Osaka Chiho Saibansho [Osaka Dist. Ct.], May 19, 2006, 1948 Hanji 122 (Japan); Osaka Koto
Saibansho [Osaka High. Ct.], Jun. 21, 2007, Unpublished (Japan)
d
Tokyo Koto Saibansho [Tokyo High. Ct.], Aug. 28, 2007, Unpublished (Japan)
Data Protection in the Internet: Japanese National Report
265