Framework of the Personal Information Protection Act — Regulated Parties and the Definition of Protected Data
頻出~35 min5 terms13 past questions
Goals of this unit
Explain how the positions of a Personal Information Handling Business Operator and the Personal Information Protection Commission differ.
Decide whether a piece of information counts as personal information by whether it can identify the person, including cases where it can be easily cross-checked with other information or contains a Personal Identification Code.
Tell how the rules for Special Care-Required Personal Information and Anonymously Processed Information differ from those for ordinary personal information.
A party that uses a personal information database for its business and bears the duties of the Act
The side with duties
Specifying the purpose of use and notifying or publishing it, security control measures, limits on third-party provision, responding to disclosure requests
A Personal Information Handling Business Operator (個人情報取扱事業者) is a party that uses a personal information database (個人情報データベース等), a collection of personal information organized for searching, in its business, and it bears the duties of the Act on the Protection of Personal Information directly.
Acquire: set the purpose, then notify or publish
Store: security control measures
Provide: consent as a rule
Respond: disclose or correct on request
When a person asks to see or correct their own information, respond to the request.
4 / 4
When acquiring data, the operator must specify the purpose of use and notify the person or publish it, and while storing it, take security control measures to prevent leaks, including supervising employees and contractors. When the person asks, it must disclose or correct the information it holds about them. As an exception, the duties do not apply when certain parties handle data for certain purposes, such as a news organization handling it for reporting.
AnalogyIt is like a building manager holding spare keys: they use them only for the purpose they were entrusted for, keep them safe, and as a rule never hand them to anyone without the owner's say.
How to rememberThe 2015 amendment, in force from 2017, brought businesses that handle only a small number of people's data into scope as well.
Exam points
ExamUnder the current Act, national government bodies and the like are still excluded from Personal Information Handling Business Operators (個人情報取扱事業者). Before the 2021 amendment, public bodies including incorporated administrative agencies were all excluded and governed by separate laws or local ordinances, but the amendment unified the rules and moved some of those bodies under the same rules as the private sector.
ExamThird-party provision (第三者提供) generally requires the person's consent. Consent is not needed in cases such as when the law requires it, when it is needed to protect someone's life, body or property and consent is hard to obtain, or when handling is outsourced within the scope needed to achieve the purpose of use.
ExamThe purpose of use can be changed only within a range reasonably seen as related to the original purpose, and the new purpose must then be notified to the person or published. Using the data beyond that range requires the person's consent in advance.
The Personal Information Protection Commission (個人情報保護委員会) is a highly independent national body that oversees how businesses handle personal information under the Act on the Protection of Personal Information.
It can require businesses to report or carry out on-site inspections, give guidance and advice as needed, and use recommendations and orders to make violators correct course. It also issues guidelines showing how the law is applied in practice and monitors and supervises the handling of My Number, the national ID number.
AnalogyIt is like a referee in a sports match: it does not play, but watches whether players follow the rules and warns or corrects them when they foul.
How to rememberIt was set up in January 2016 as an external agency of the Cabinet Office.
Exam points
Mix-upThe Personal Information Protection Commission (個人情報保護委員会) is a national body that oversees businesses under the law. The PrivacyMark (プライバシーマーク) is a scheme in which a private organization reviews a business's personal information management system and grants the mark, so it works differently.
A Personal Identification Code (個人識別符号) is a code that the law designates as able to identify a specific person on its own, without being combined with a name or similar, and any information containing one is personal information.
Category
Examples
Physical features turned into data for matching
Face recognition feature data, fingerprint or iris data, DNA sequences
Numbers assigned to individuals by public systems and individually named in the law
Passport numbers, driver's license numbers, My Number, basic pension numbers
Not Personal Identification Codes
Mobile phone numbers, email addresses, private membership numbers (these become personal information when linked to a name or similar)
Examples include face or fingerprint features turned into data for matching, and numbers such as passport numbers and My Number that public systems assign to individuals and the law names one by one. Personal information is information about a living individual, and it covers not only information that reveals who the person is through a name or similar but also information that contains a Personal Identification Code.
How to rememberIt was created by the 2015 amendment, in force from 2017, and clarified the range of information whose status as personal information had been unclear.
Exam points
ExamInformation that can be easily cross-checked (容易に照合) with other information to reveal the person counts as personal information. Information with no clue for cross-checking, whose owner cannot be known, does not.
ExamNot only written records but also images or sound that show who a person is are personal information. Even information that is already public is personal information if it identifies a specific person.
Mix-upMobile phone numbers and email addresses are not designated as Personal Identification Codes (個人識別符号). However, once linked to a name or similar so that the person can be identified, they become personal information.
Special Care-Required Personal Information (要配慮個人情報) is personal information that the law says must be handled with particular care so that it does not lead to unfair discrimination or prejudice against the person.
It includes, for example, race, creed, social status, medical history, criminal record and the fact of having been a crime victim. Acquiring it generally requires the person's consent, and it cannot be provided to third parties through opt-out (オプトアウト), the scheme that allows provision unless the person objects.
AnalogyIt is like a conversation in a doctor's office: if it gets out, the person may face discrimination or prejudice. You ask before you hear it, and you do not pass it on without permission.
How to rememberThe Japanese name "要配慮" reads as "配慮を要する", meaning "requiring consideration".
Exam points
ExamWhat counts as Special Care-Required Personal Information (要配慮個人情報) is the set of items the law lists as possible grounds for discrimination or prejudice, with creed and medical history as typical examples.
Mix-upA Personal Identification Code (個人識別符号) is a code the law designates as able to identify a person on its own, while Special Care-Required Personal Information is personal information containing items the law lists as possible grounds for discrimination or prejudice. Fingerprint data falls under the former and medical history under the latter.
Anonymously Processed Information (匿名加工情報) is personal information processed so that no specific person can be identified and the original personal information cannot be restored.
Personal information
Remove or replace names and similar
Remove identification codes and more
Anonymously processed information
The data now shows no one and cannot be restored, and it can be provided without consent if the rules are followed.
4 / 4
When creating it, the business must follow the legal standards and take steps such as deleting or replacing names and similar descriptions and removing Personal Identification Codes. As long as it follows the rules, such as publishing which items of information are included when creating or providing it, the data can go to third parties without the person's consent and be used for statistics and analysis. Neither the creator nor the recipient may carry out re-identification (識別行為), trying to work out who the original person is.
AnalogyIt is like cutting the name box off a questionnaire and rewriting the answers so no one can recognize the handwriting before passing it to the person tallying the results.
How to rememberAs the name combining "anonymous" and "processed" suggests, removing names is not enough: only data processed to the full standard gets this treatment.
Exam points
ExamAnonymously Processed Information (匿名加工情報) has been processed so that no specific person can be identified and the original personal information cannot be restored. If the rules for creating and providing it are followed, it can be provided to third parties without the person's consent.
A Personal Information Handling Business Operator uses a personal information database in its business and bears the legal duties regardless of its size or whether it seeks profit.
The Personal Information Protection Commission is the national oversight body that can require businesses to report and carries out on-site inspections, guidance, recommendations and orders.
Personal information is information about a living individual that identifies a specific person, and it also covers information that can be identified by easily cross-checking it with other information and information containing a Personal Identification Code.
Acquiring Special Care-Required Personal Information generally requires the person's consent, and it cannot be provided to third parties by opt-out.
Anonymously Processed Information can be provided without the person's consent if the rules are followed, but re-identifying the original person is prohibited.