Asset management firms—both in Japan and abroad—may need to take quick action to comply with the amended Act.
On September 9, 2015, the amendments to the Act on the Protection of Personal Information (PIPA) were promulgated, and they became effective on May 30, 2017. This LawFlash summarizes the parts of these amendments that are most relevant to registered financial instruments business operators (FIBOs) in Japan, their head offices, and affiliates in other jurisdictions.
The PIPA applies to so-called “business operators handling personal information” (BOHPIs), which, under the PIPA prior to the amendments (Former PIPA), excluded businesses whose databases contained only a limited amount of personal information on any single day during the preceding six-month period (that is, an amount based on which it would not be possible to identify more than five thousand individuals).
This “small business operator exclusion” is no longer available under the PIPA following the effective date of the amendments (Amended PIPA). This means that businesses that maintain personal information databases for business use are subject to the Amended PIPA regardless of how many individuals are identifiable based on the information contained in these databases.
The Former PIPA was applicable only to conduct that occurred in Japan. However, under Article 75 of the Amended PIPA, major parts of the Amended PIPA will apply to conduct that occurs outside Japan where a business has acquired personal information in connection with supplying a good or service to a person in Japan and then utilizes such personal information in a foreign country. For example, if a business sells products or supplies services to a person in Japan directly or through a Japanese office or branch, the Amended PIPA applies to the handling of that person’s personal information or anonymously processed information even if it occurs at the foreign headquarters of the business located outside Japan.
Under the Amended PIPA, if a BOHPI provides personal data to third parties outside Japan, it must—in addition to the other third-party rules that originally exist—obtain advance consent from the subject(s) of the personal information confirming that the subject(s) consent to such personal information being provided to a third party in a foreign country.
However, certain exceptions to this consent requirement apply when
Unfortunately, however, because the Personal Information Protection Commission has not so far designated any countries that are recognized as having such equivalent standards, the first exception above is not currently available in practice.
When the BOHPI provides personal data to a third party, the BOHPI must keep a record pursuant to the rules of the Personal Information Protection Commission on the date of the personal data provision, the name of the third party, and other matters prescribed by the rules (subject to certain exceptions). These records must be maintained for the period prescribed by the Ordinance for Enforcement of the Amended PIPA, which is generally three years.
Article 26, Paragraph 1 of the Amended PIPA contains a new requirement (subject to certain exceptions) that a BOHPI receiving personal data from a third party must confirm the name and address of the third party and, if the third party is a corporation, the name of the third party’s representative, as well as the circumstances under which the personal data was acquired by that third party (subject to certain exceptions). The BOHPI must then create and maintain records of matters related to such confirmation and other matters prescribed by the rules of the Personal Information Protection Commission (subject to certain exceptions). These records must be maintained for the period prescribed by the Ordinance for Enforcement of the Amended PIPA, which is generally three years.
The Amended PIPA provides for criminal and civil penalties for disclosure or misuse of personal information covered by its provisions. Where a BOHPI (if a BOHPI is a corporation, officers, representatives, or administrator of the BOHPI) or an employee or a person who used to be in such status transfers such information to a third party for payment or other personal benefit to the individual or another, that individual will be subject to imprisonment with labor (penal servitude) for a period of one year or less and a fine not exceeding ¥500,000.
In addition, a BOHPI that violates an order issued by the Personal Information Protection Commission under the Amended PIPA may be sentenced to penal servitude of not more than six months or a fine not exceeding ¥300,000.
Larger FIBOs have for some time been taking steps to address their obligations under the Amended PIPA and ensure compliance with its provisions—both in Japan and abroad. In particular, obtaining customer consent to share information covered by PIPA with foreign parent organizations and affiliates has been a major challenge given the delicate relationships local FIBOs have with major Japanese investors, as well as the difficulty of seeking post-facto consent to sharing.
Compounding the problem is the relatively low recognition of the new obligations under the Amended PIPA among the typically small offices of many foreign-capitalized FIBOs in Japan. Many client relationship management (CRM) databases are networked and freely accessible by head offices and affiliates outside Japan in circumstances where evidence of specific client consent to such sharing may be difficult to demonstrate. Under the Amended PIPA, it may be possible to make arrangements whereby affiliates could meet the standards for sharing prescribed by the rules of the Personal Information Protection Commission, but in many instances these arrangements may not yet have been implemented. Compliance officers in Japan and abroad should carefully review whether their current systems meet the new requirements and, if necessary, take action to limit access to data covered by PIPA until relevant consents are secured or compliance sharing procedures implemented.
Asset management firms outside Japan that are only now becoming aware of the Amended PIPA and that have or seek Japanese investors should do the following as soon as possible:
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following Morgan Lewis lawyers:
 Article 2, Paragraph 3, Item 5 of the Former PIPA and Article 2 of the Order for Enforcement of the Former PIPA.
 Information relating to an individual that can be produced from processing personal information so as never to be able to identify a specific individual by taking certain action (Article 2, Paragraph 9 of the Amended PIPA).
 Article 24 of the Amended PIPA.
 Article 25, Paragraph 1 of the Amended PIPA. This provision was made to protect personal data from a person who sells personal data. So, several exceptions are provided in order not to prevent normal business practice.
 Article 25, Paragraph 2 of the Amended PIPA and Article 14 of the Ordinance for Enforcement of the Amended PIPA.
 According to the guideline, it is recommended to confirm and record the compliance status of how the person who provides personal data acquired such personal data from the individual.
 Article 26, Paragraphs 2 and 3 of the Amended PIPA.
 Article 26, Paragraph 4 of the Amended PIPA and Article 18 of the Ordinance for Enforcement of the Amended PIPA.
 Article 83 of the Amended PIPA.
 Article 84 of the Amended PIPA