Japan: Implemented increased data protection penalties in 2020 amendment to the Act on the Protection of Personal Information

On 12 December 2020, the increased penalties of the amendment to the Act on the Protection of Personal Information were implemented. The Amendment contains rules on both domestic data protection and cross-border data transfers. Regarding data protection, the Amendment facilitates the cease of utilisation or deletion of personal data when there is a possibility of violating individual rights or legitimate interests of individuals. Moreover, the Act allows individuals to choose the methods of disclosure of their personal data retained by a third party and to request the disclosure of third-party transfers of their personal data. In addition, the maximum penalty for violations is raised to JPY 100,000,000. Finally, the Personal Information Protection Commission will establish Enforcement Rules for the amended Act on Protection of Personal Information. The enforcement rules will specify rules for data breach notification, data pseudonymization, cross-border data transfers and public disclosure.