Japan: Implemented remaining data protection provisions of 2020 amendment to the Act on the Protection of Personal Information

On 1 April 2022, the remaining provisions of the amended Act on the Protection of Personal Information become fully effective. On 24 March 2021, the Japanese government issued the effective date for specific provisions in the amended Act on the Protection of Personal Information. The increased penalties came into effect on 12 December 2020 while the rest of the provisions are implemented on 1 April 2022. The Amendment contains rules on both domestic data protection and cross-border data transfers. Regarding data protection, the Amendment facilitates the cease of utilisation or deletion of personal data when there is a possibility of violating individual rights or legitimate interests of individuals. Moreover, the Act allows individuals to choose the methods of disclosure of their personal data retained by a third party and to request the disclosure of third-party transfers of their personal data. In addition, the maximum penalty for violations is raised to JPY 100,000,000. Finally, the Personal Information Protection Commission will establish Enforcement Rules for the amended Act on Protection of Personal Information. The enforcement rules will specify rules for data breach notification, data pseudonymization, cross-border data transfers and public disclosure.