Third, while the APPI requires Business Operators to identify and publish the
purpose of use, it does not stipulate the principal’s consent or justification, such as
legitimate interest in general. However, in the case of handling special care-required
personal information, providing personal data to a third party, or changing the
purpose of use, Business Operators need to obtain pre-existing principal’s consent
and they are not allowed to justify it with legitimate interest.
Fourth, protection of the secrecy of communications has a wide range of application and strict restriction in comparison with other countries. The broad base of
information, which includes not only content of communications but also metadata
such as traffic and location data processed by a wide range of businesses on the
internet, is subject to restriction of use.
5.2 Data Protection in the Internet
Emerging computing technologies using the internet have brought various concerns
associated with data protection. Development of big data, IoT and AI technologies
make it more difficult to assure control by principals or data subjects. Regulations
such as data portability, right to erasure, right to be forgotten, as well as profiling
regulation in the EU’s General Data Protection Regulation (GDPR) were proposed
in response to the situation brought by new technologies.
When thinking about introducing such regulations into Japan, it is important to
consider the difference in approach between the EU and Japan in reflecting the will
of data subjects. While regulation in the EU is straightforward in strengthening
control by data subjects on all kinds of data, the Japanese system varies depending
on the data’s nature. For example, while regulations in Japan do not require a
principal’s consent to collect and use personal information in general, they do
require explicit consent in advance for some situations such as providing to third
parties or using secret communications including metadata.
Needless to say, the Japanese legal system for data protection also faces difficulties
in reflecting the will of data subjects under the situation caused by emerging new
technologies, and it is important to catch up and reduce the risk of such change,
balancing the Japan-specific background of regulation and international harmonization.
References
Joint Statement by Haruhi Kumazawa, Commissioner of the Personal Information Protection
Commission of Japan and Věra Jourová, Commissioner for Justice, Consumers and Gender
Equality of the European Commission, Tokyo, 17 July 2018. https://www.ppc.go.jp/files/pdf/
300717_pressstatement2.pdf. Accessed 6 Nov 2018
Komukai T (2018) Introduction to informational law: law on digital network, 4th edn. NTT
Publishing, Tokyo
268
T. Komukai
purpose of use, it does not stipulate the principal’s consent or justification, such as
legitimate interest in general. However, in the case of handling special care-required
personal information, providing personal data to a third party, or changing the
purpose of use, Business Operators need to obtain pre-existing principal’s consent
and they are not allowed to justify it with legitimate interest.
Fourth, protection of the secrecy of communications has a wide range of application and strict restriction in comparison with other countries. The broad base of
information, which includes not only content of communications but also metadata
such as traffic and location data processed by a wide range of businesses on the
internet, is subject to restriction of use.
5.2 Data Protection in the Internet
Emerging computing technologies using the internet have brought various concerns
associated with data protection. Development of big data, IoT and AI technologies
make it more difficult to assure control by principals or data subjects. Regulations
such as data portability, right to erasure, right to be forgotten, as well as profiling
regulation in the EU’s General Data Protection Regulation (GDPR) were proposed
in response to the situation brought by new technologies.
When thinking about introducing such regulations into Japan, it is important to
consider the difference in approach between the EU and Japan in reflecting the will
of data subjects. While regulation in the EU is straightforward in strengthening
control by data subjects on all kinds of data, the Japanese system varies depending
on the data’s nature. For example, while regulations in Japan do not require a
principal’s consent to collect and use personal information in general, they do
require explicit consent in advance for some situations such as providing to third
parties or using secret communications including metadata.
Needless to say, the Japanese legal system for data protection also faces difficulties
in reflecting the will of data subjects under the situation caused by emerging new
technologies, and it is important to catch up and reduce the risk of such change,
balancing the Japan-specific background of regulation and international harmonization.
References
Joint Statement by Haruhi Kumazawa, Commissioner of the Personal Information Protection
Commission of Japan and Věra Jourová, Commissioner for Justice, Consumers and Gender
Equality of the European Commission, Tokyo, 17 July 2018. https://www.ppc.go.jp/files/pdf/
300717_pressstatement2.pdf. Accessed 6 Nov 2018
Komukai T (2018) Introduction to informational law: law on digital network, 4th edn. NTT
Publishing, Tokyo
268
T. Komukai