ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Japan report)

ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Japan report)

Authors: Dominic Paulger, Policy Manager (APAC), Future of Privacy Forum

Asian Business Law Institute and Future of Privacy Forum

September 2022

This report provides a detailed overview of relevant laws and regulations in Japan on

• notice and consent requirements for processing personal data;
• alternative legal bases for processing personal data which permit processing of personal data without consent if the data controller undertakes a risk impact assessment (e.g., legitimate interests); and
• statutory bases for processing personal data without consent and exceptions or derogations from consent requirements in laws and regulations.

Table of Contents

1. INTRODUCTION 

    1.1. Act on Protection of Personal Information (“APPI”)

    1.2. Amendments to the APPI

    1.3. Other relevant laws and regulations

2. ROLE OF THE PERSONAL INFORMATION PROTECTION COMMISSION (“PPC”)

    2.1. Advisory

    2.2. Enforcement

3. SECTORAL GUIDELINES

    3.1. Financial sector 

    3.2. Healthcare sector 

    3.3. Information and Communications sector

4. CONSENT AND PRIVACY SELF-MANAGEMENT IN THE APPI.

5. CONDITIONS FOR CONSENT 

    5.1. Definition and forms of consent

           a. Informed consent
           b. Express and implied consent
           c. Formalities in sector-specific guidelines

    5.2. Withdrawal of consent

    5.3. Bundled consent

6. CONSENT FOR SPECIAL CATEGORIES OR USES OF DATA

    6.1. Children

    6.2. Cookies and online tracking

    6.3. Direct marketing

    6.4. Biometric data

    6.5. Genetic data

    6.6. Financial information

    6.7. Pseudonymized data

7. CONSENT FOR CROSS-BORDER DATA TRANSFERS

8. TRANSPARENCY AND NOTICE 

9. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT SUBJECT TO A RISK IMPACT ASSESSMENT

10. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT IN OTHER CIRCUMSTANCES DEFINED BY LAW

     10.1. Using and disclosing personal information without consent under the APPI

              a. Where permissible by law
              b. Protection of life, body, or fortune
              c. Public health
              d. Cooperation with public bodies

      10.2. Using and disclosing sensitive personal information without consent under the APPI

               a. Healthcare sector
               b. Credit sector

      10.3. Exemptions to the APPI

      10.4. Research purposes (including medical research)