subject to a fine not exceeding 1 million yen (Article 72(1)(4)). Violations of
senders’ information labeling or fraudulent advertising is subject to imprisonment
with work for a term not exceeding 1 year or a fine not exceeding 2 million yen
(Article 72(2)). The above-referenced violations are also subject to an order for the
suspension of business by competent ministers (Article 15).
4 International Dimension of Data Protection
4.1 Territorial Scope of Rules on Data Protection
In principle, the APPI and other rules apply to personal information handled inside
the jurisdiction of Japan.
4.2 Applicability of Data Protection Rules to Foreign Entities
The provisions of the APPI that set forth the obligations of a business operator
handling personal information shall also apply to operators who acquire the personal
information of a person in Japan in relation to supplying that person goods or
services and handle the personal information in a foreign country (Article 75 of
the APPI
17 ).
4.3 Specific Conditions Applicable to the Transfer of Personal
Data to a Foreign Jurisdiction
A personal information handling business operator shall, in the case of providing
personal data to a third party in a foreign country, in advance, obtain a principal’s
consent to the effect that he or she approves of the provision of the information to a
third party in a foreign country with the exception of the following: (1) to a third
party establishing a system conforming to the standards prescribed by the rules of the
17 Article 75 states: “The provisions of Article 15, Article 16, Article 18 (excluding paragraph (2)),
Article 19 through Article 25, Article 27 thorough Article 36, Article 41, Article 42, paragraph (1),
Article 43 and the following Article shall also apply in those cases where a personal information
handling business operator who in relation to supplying a good or service to a person in Japan has
acquired personal information relating to the person as a principal who handles in a foreign country
the personal information or anonymously processed information produced by using the said
personal information.” Source: The PPC, Amended Act on the Protection of Personal Information
(Tentative Translation), https://www.ppc.go.jp/files/pdf/280222_amendedlaw.pdf. Accessed
6 Nov 2018.
266
T. Komukai
senders’ information labeling or fraudulent advertising is subject to imprisonment
with work for a term not exceeding 1 year or a fine not exceeding 2 million yen
(Article 72(2)). The above-referenced violations are also subject to an order for the
suspension of business by competent ministers (Article 15).
4 International Dimension of Data Protection
4.1 Territorial Scope of Rules on Data Protection
In principle, the APPI and other rules apply to personal information handled inside
the jurisdiction of Japan.
4.2 Applicability of Data Protection Rules to Foreign Entities
The provisions of the APPI that set forth the obligations of a business operator
handling personal information shall also apply to operators who acquire the personal
information of a person in Japan in relation to supplying that person goods or
services and handle the personal information in a foreign country (Article 75 of
the APPI
17 ).
4.3 Specific Conditions Applicable to the Transfer of Personal
Data to a Foreign Jurisdiction
A personal information handling business operator shall, in the case of providing
personal data to a third party in a foreign country, in advance, obtain a principal’s
consent to the effect that he or she approves of the provision of the information to a
third party in a foreign country with the exception of the following: (1) to a third
party establishing a system conforming to the standards prescribed by the rules of the
17 Article 75 states: “The provisions of Article 15, Article 16, Article 18 (excluding paragraph (2)),
Article 19 through Article 25, Article 27 thorough Article 36, Article 41, Article 42, paragraph (1),
Article 43 and the following Article shall also apply in those cases where a personal information
handling business operator who in relation to supplying a good or service to a person in Japan has
acquired personal information relating to the person as a principal who handles in a foreign country
the personal information or anonymously processed information produced by using the said
personal information.” Source: The PPC, Amended Act on the Protection of Personal Information
(Tentative Translation), https://www.ppc.go.jp/files/pdf/280222_amendedlaw.pdf. Accessed
6 Nov 2018.
266
T. Komukai