Japan tightens personal data protection

Next month many companies throughout Japan, including foreign companies, will have to comply with legislation that sets out new rules for handling personal data.

The Personal Information Protection Law, effective April 1, applies to any company with offices in Japan that holds personal data on 5,000 or more individuals, according to Kazuhito Masui, an attorney at Shiba International Law Offices, a major international law firm based in Tokyo.

Personal data as defined by the law includes a person’s name, address, date of birth, sex, home and/or mobile phone numbers and also a person’s e-mail address if that address is recognizably the person’s name. The 5,000 minimum includes company employees, Masui said in an interview last week.

The law states a set of obligations for companies handling personal data, and Japan’s Ministry of Economy Trade and Industry (METI) has issued a set of guidelines on how to maintain data security, he said.

Companies must designate a manager called a corporate privacy officer (CPO) and other staff to be responsible for meeting the provisions, and the law also sets fines of up to ¥300,000 (US$2,804) or jail sentences up to six months for the manager or data handlers who are found to have not complied, Masui said.

Among the new rules that companies must follow, they must specify for what purpose information is being collected, obtain consent from individuals before using the information for any other purpose than the one originally stated, and take measures to prevent data being leaked and stolen. Companies must also deal with complaints and correct mistaken data, Masui said.

The METI guidelines mirror many basic PC security measures, for example the use of long passwords that are changed frequently. Other guidelines cover data storage and antivirus measures.

In recent years there have been a string of cases in which personal data has been stolen or leaked from some of Japan’s most famous companies. For example, in February 2004 Softbank BB Corp., a major broadband service provider, leaked personal data on more than 4.5 million subscribers, said Kazuo Makino, a professor of law at Kokushikan University.

The law and guidelines represent a significant step forward toward making personal data more secure in Japan, experts said.

“It’s an attempt to make companies more responsible,” Makino said.

While the penalties set for noncompliance to the law are low, the legislation should prove effective in making companies tighten up their security because of the damaging publicity that might arise if they are found guilty, Makino said.

The law also takes steps to protect civil liberties, said Eiji Yamada, an investigator for the Japan Network Security Association, a nonprofit information security consulting organization.

“The fundamental point is that it’s an effort to protect privacy, and that’s part of protecting individual rights,” he said in an interview on Monday.

So far, less than one percent of people who have had their data leaked have filed civil suits over recent years, Yamada said. After April 1, private individuals will find it much easier to file civil suits for compensation, he said.

“At the moment, Japanese don’t generally go to court. Now lawyers are lining up and even offering application forms to join suits on their Web sites. For companies, the damages arising could prove very expensive, and it could be a busy time for lawyers,” he said.

Achieving compliance should be possible within the existing IT budgets for larger companies, although it is having a bigger impact on smaller companies, experts said.

For example, designating a manager for a small company of 10 to 20 people and having that person handle all the new duties might add 20 percent to the manager’s monthly workload, said Masui.