Japan: Personal Information Protection Commission issued administrative measures against Business Planning Co. for its alleged violations of the Personal Information Protection Act

On 16 May 2025, the Personal Information Protection Commission (PPC) issued administrative measures against Business Planning Co., Ltd., a company engaged in name-list distribution, for violations of the Act on the Protection of Personal Information (Act No. 57 of 2003). The measures followed findings of non-compliance with Article 19 (Prohibition of Improper Use) and Article 29 (Record-Keeping for Third-Party Provision). The action was prompted by a referral from law enforcement authorities, who identified connections between the company’s data transfers and individuals involved in special fraud schemes. Following an on-site inspection conducted on 18 April 2025, the PPC confirmed that the company had provided personal data to entities suspected of unlawful activity between May 2023 and October 2024, and had failed to maintain required records of data provision. The Commission ordered the company to immediately cease unlawful data transfers and to implement compliance measures by 30 May 2025, including recipient verification through corporate registry checks and the establishment of regular internal audits. The company was also instructed to submit monthly reports for one year on the status of third-party data provision. This enforcement action forms part of the government's anti-fraud strategy under the “Comprehensive Measures to Protect Citizens from Fraud 2.0”, adopted on 22 April 2025, which targets illegal name-list trading.