International and Adjacent Personal Data Laws — My Number Act and GDPR
頻出~28 min4 terms5 past questions
Goals of this unit
Explain what the My Number Act (マイナンバー法) protects (Individual Numbers and specific personal information) and that the law limits where the number may be used.
Explain that the GDPR is an EU regulation and can also apply to businesses outside the EU.
Tell apart how the right to be forgotten (忘れられる権利) and the right to erasure (消去権) are positioned.
The My Number Act (マイナンバー法) is the law that sets where the 12-digit Individual Number (個人番号, known as My Number) given to each resident may be used and how it must be kept safe.
Receive the number
Verify identity
Use it for legally set tasks
Dispose of it when no longer needed
Once a task no longer needs the number, it is destroyed or deleted rather than kept.
4 / 4
Its formal name is the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, and personal information containing an Individual Number is called specific personal information (特定個人情報). The number may be used only for tasks the law lists, such as social security, tax, and disaster response procedures, and as a rule it cannot be used for anything else even with the person's consent. A business that receives someone's number must also verify that person's identity.
AnalogyThink of it as a spare key made only for government paperwork. It fits only the designated doors (procedures set by law), and you are not allowed to use it to open any other door.
How to remember"My" + "Number": the law about a number that belongs to me alone. The phrase "use of numbers" in the formal name shows that the law centers on how the number is used.
Exam points
ExamA company may use its employees' Individual Numbers (個人番号) only within tasks set by law, such as tax and social insurance filings.
Mix-upThe My Number Act (マイナンバー法) governs the use and protection of Individual Numbers. The law that sets up the national framework for promoting cybersecurity measures is the Basic Act on Cybersecurity (サイバーセキュリティ基本法).
The GDPR (General Data Protection Regulation, 一般データ保護規則) is the EU regulation for protecting personal data.
Main points of the GDPR (examples)
Scope: may cover businesses outside the EU
Individuals' rights: e.g. right to erasure
Limits on transfers outside the EU
Heavy fines for violations
Adopted in 2016, it has applied directly in every EU member state since 2018. Whether it applies is not decided by where a business is headquartered alone, so a Japanese company that offers goods or services to people in the EU can fall under it. It sets out a wide range of individuals' rights and, as a rule, also restricts moving personal data outside the EU.
AnalogyIt works like the rules of a venue called the EU. Whatever country a stallholder comes from, anyone doing business with customers inside that venue has to follow its rules.
How to rememberG = General, DP = Data Protection, R = Regulation. "General" signals that it is not limited to one industry but reaches any business handling personal data.
Exam points
ExamThe GDPR can apply not only to businesses based in the EU but also to businesses outside it that offer goods or services to people in the EU.
Mix-upThe GDPR is an EU regulation and a separate law from Japan's Act on the Protection of Personal Information (個人情報保護法). Depending on the data and the people involved, a Japanese company may have to comply with both.
The right to be forgotten (忘れられる権利) is the popular name for the idea that you can have your own past information that lingers on the internet removed, or kept out of search results.
It drew attention because old events keep turning up in searches forever, to the disadvantage of the people involved. In the EU, the Court of Justice ruled in 2014 that people can ask search engine operators to remove search results. Because such requests are weighed against press freedom and the public interest, however, asking does not always mean the information will be removed.
AnalogyIt is like asking for an old notice that has hung on the neighborhood bulletin board for years to come down because it has served its purpose. If it is a notice everyone ought to know about, though, it may stay up.
How to remember"Forgotten" is passive. It is not about you forgetting something, but about the right to have the world (and its search results) forget you.
Exam points
Mix-upThe right to be forgotten (忘れられる権利) is a popular name for an idea, and in the GDPR it appears in parentheses in the heading of the article on the right to erasure (消去権). The name the article actually gives the right is the right to erasure.
The right to erasure (消去権) is a right in the GDPR that lets individuals require a business to delete their personal data.
It is set out in Article 17 of the GDPR, and a business (the controller) must delete the data without undue delay when the conditions are met. Those conditions include, for example, the data no longer being needed for the purpose it was collected for, or the person withdrawing consent. A deletion request can still be refused in some cases, such as data the law requires to be kept.
AnalogyIt is like formally asking a shop you have quit as a member to dispose of your record in its member list. Unless the shop has a valid reason, it must agree to the request.
How to rememberErase shares its root with eraser, so picture it as the right to make a business rub your data out with an eraser.
Exam points
Mix-upThe right to erasure (消去権) is the right to have the data itself deleted. The right to have inaccurate data corrected (the right to rectification) is set out in a separate article of the GDPR.
Right to be forgotten vs. Right to erasure
Aspect
Right to be forgotten
Right to erasure
Key differencePosition
Popular name for an idea
Name of a right in the GDPR text
Basis and how it spread
Became widely known through a 2014 EU Court of Justice ruling allowing search results to be removed
Article 17 of the GDPR, applied from 2018
Main target
Search engine operators and those who post information online
Businesses holding the personal data (controllers)
Key points
The My Number Act protects specific personal information, which includes Individual Numbers, and the law sets out which tasks may use the number.
The GDPR is the EU's regulation for protecting personal data, and it can apply even when a business is headquartered outside the EU.
The GDPR gives individuals the right to erasure, so a business must delete personal data without undue delay when the conditions are met.
Because of the balance with press freedom and exceptions such as legal retention duties, a deletion request is not always granted.