Data Dojo

Takahiro Nonaka spoke to the Asia Business Law Journal about the rapid evolution of data protection laws, prompting Japan to amend its Act on the Protection of Personal Information (APPI), enhancing individual rights and strengthening the obligations of business operators when processing personal data.

“This new definition [of “personally referable information”] intends to cover data that are not personal information, either on its own or when collated with other information that a business holds, but are likely to become personal information when combined with other data maintained by a data transferee,” Takahiro said.

He explained that if the transferor knows that the transferee has personal information that could be used to identify an associated individual, or knows about the transferee’s intended use of such personally referable information, and transfers both personally referable information and data that may be associated with personal information, this would likely be deemed a situation where the transferor could use the personal related information as personal information.

“In such cases, the transferee, or the transferor on behalf of the transferee, must obtain opt-in consent from the individual,” Takahiro added. “If the transferor is obtaining consent on behalf of the transferee, the APPI amendments require the transferor to identify the transferee when obtaining such consent.”

Read the full article.