Balancing big data and privacy?

What the Law Says

Japan’s primary law governing the intersection of big data and privacy is the Act on the Protection of Personal Information (APPI). It sets rules for handling personal information while permitting certain data uses—especially anonymized data—to support innovation.

The APPI applies to 'personal information handlers'—businesses and organizations that use personal information for business purposes. It requires consent for collection and use, limits retention periods, and mandates security measures.

Crucially, the APPI distinguishes between 'personal information' and 'anonymously processed information'. The latter—data stripped of identifiers so re-identification is practically impossible—is exempt from most APPI obligations, enabling safe big data analytics.

Organizations must also appoint a 'Personal Information Protection Officer' if they handle large volumes of sensitive data, and report data breaches without delay when risk to rights is likely.

Statutory Text

‘Anonymously processed information’ means information that has been processed so that a specific individual cannot be identified and it is not possible to restore the information to its original state.

— Act on the Protection of Personal Information, s. 2(8) — Definition of Anonymously Processed Information

Statutory Text

A personal information handler shall not provide personal data to a third party without obtaining the prior consent of the individual concerned, unless otherwise provided for by laws and regulations.

— Act on the Protection of Personal Information, s. 23(1) — Third-Party Provision

Statutory Text

Where a personal information handler has caused damage to an individual due to intentional or negligent breach of duty… the handler shall be liable for compensation.

— Act on the Protection of Personal Information, s. 84 — Liability for Damage

What to Do

Sources