Alert: Sunrise Coming in May for New Privacy Law, Enforcer in Japan


Companies doing business in Japan will soon have to face a new privacy cop on the beat.

In 2015, Japan amended its Personal Information Protection Act, which established the Personal Information Protection Commission (PPC)—an independent authority charged with overseeing data protection compliance—and implemented other changes, including new rules for cross boarder transfers of personal data as well as processing and handling anonymously processed information. 

During a recent event at Hogan Lovells LLP in Washington, Director of the PPC Secretariat Yoshikazu Okamoto said that the law will take full effect in May.  

Okamoto warned that there will be no grace period or ramp up period, and noted that enforcement will kick in immediately. Okamoto said that the public has had enough time to prepare for the amendments. 

There are guidelines for companies on the obligations of the new law, but they are at present only available in Japanese, he said. But an official English translation will soon be posted on the PPC website.

Woodrow Hartzog, Starnes Professor of Law at the Cumberland School of Law at Samford University, told Bloomberg BNA that the amended act “makes some very important changes, but like with most new pieces of privacy legislation, many important terms will need to be more fully defined and interpreted.”

Hartzog said that “under the old law, the privacy rules were largely conceived of as obligations on businesses.” Companies will probably see a rise in individuals requesting access to personal data and seeking to delete or correct that information, he said.

To keep up with the constantly evolving world of privacy and security sign up for the Bloomberg BNA Privacy and Security Update.