Japan: Introduction of 2020 amendment to the Act on the Protection of Personal Information including data protection rules

On 10 March 2020, the Amendment Act of the Act on the Protection of Personal Information was introduced in the National Diet of Japan. The Amendment contains rules on both domestic data protection and cross-border data transfers. Regarding data protection, the Amendment facilitates the cease of utilisation or deletion of personal data when there is a possibility of violating individual rights or legitimate interests of individuals. Moreover, the Act allows individuals to choose the methods of disclosure of their personal data retained by a third party and to request the disclosure of third-party transfers of their personal data. In addition, the maximum penalty for violations is raised to JPY 100,000,000. Finally, the Personal Information Protection Commission will establish Enforcement Rules for the amended Act on Protection of Personal Information. The enforcement rules will specify rules for data breach notification, data pseudonymization, cross-border data transfers and public disclosure.