adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

2020 amendments to the APPI change the data security obligations of businesses



On June 5, Japan enacted a new set of amendments to its data-privacy law, the Act on the Protection of Personal Information (APPI). These Diet-approved updates are part of the APPI's "every three years" review policy, but the changes go far beyond minor tweaks to existing Japanese privacy law.

Taken as a whole, the 2020 amendments mark a further expansion of the APPI's scope, following in the footsteps of previous expansions. They increase the obligations of companies to be transparent and secure with the personal data of Japanese residents or risk incurring criminal penalties.     

The major part of the APPI amendments isn't expected to officially come into effect until spring 2022, although the timeline is subject to change. But if your company does business in Japan, now is the time to educate yourself and make sure your business is compliant.

## Why Japan's Data-Privacy Law Needed an Overhaul

In recent years, Japan has suffered a string of highly damaging data breaches, prompting the Japanese government to change its "hands-off" attitude toward data privacy and cybersecurity. Understanding those stories is crucial to understanding how the new amendments will be interpreted and enforced.

### A culture of poor cybersecurity

According to [_The Economist_](https://www.economist.com/business/2020/07/18/japan-incs-it-needs-a-security-patch), Japan "lags behind other advanced economies" when it comes to cybersecurity. Many Japanese SMBs have minimal security, and many more use vulnerable legacy technology. (_The Economist_ illustrates this point with this shocking statistic: "Nearly 14m people were still using Windows 7 when Microsoft stopped providing security patches in January [2020].")

### Data breaches prompt outrage and change  

The APPI was originally passed in 2003 and has been updated several times to require greater protection of personal data. In order to adapt to factors such as the rapid evolution of technology and global standards for protection of personal data, the 2015 Amendments required that new amendments be considered every three years. 

While the law was due for amendments in 2020, the contents of those amendments were influenced by a string of high-profile breaches. For instance, in 2019, Japan's Uniqlo retail chain revealed a breach that compromised the data of over 460,000 customers. Stories like this prompted a national outcry and calls to strengthen the APPI's enforcement capabilities. 

At the same time, another case was winding its way through the courts, which would help shape the direction of APPI amendments. Benesse, an education tech company, had a data leak, in which an employee for a subsidiary stole and sold the personal data of an estimated 29 million customers, reports the Japan Times. [Benesse](https://www.nikkei.com/article/DGXMZO39457050X21C18A2CC1000/) stated that the leak involved over 35 million records. 

After a lengthy legal battle, the courts found that the subsidiary should have known its protections against data exports were not up to date, and Benesse should have provided more appropriate supervision. According to [Data Guidance](https://www.dataguidance.com/notes/japan-data-protection-overview), both parties were found liable "for damages of JPY 3,300 (approx. €27) plus 5% late charges per annum per affected individual." Although Benesse was prosecuted under the old version of APPI before the 2015 Amendments (effected in 2017). Although you can't draw a direct line between this case and the 2020 amendments, it is clear that amendments mean action.   

The take-home message of all this context is that businesses can't afford to think of the APPI amendments as needless red tape or a continuation of the status quo. Rather, they're an opportunity to correct serious shortcomings in Japan's cybersecurity culture that could put your company's sensitive and proprietary data at risk.

## What's Changing in the APPI Amendments

The 2020 amendments to the APPI make two broad changes: giving individuals more rights over their personal data and increasing the reporting obligations of companies.

Here's a quick rundown of the APPI's scope.

### Who the APPI applies to

In principle, any business (whether for-profit or not) that handles the personal information of Japanese residents falls under the law, regardless of where the business is headquartered. The current APPI applies to non-Japanese entities if they acquire the data of Japanese residents and process it in a foreign country, except for certain provisions that are considered not applicable or enforceable to non-Japanese entities. There are [limited exceptions](https://www.dataguidance.com/notes/japan-data-protection-overview) for the press, professional writers and academics, religious groups, and political parties. This part of the law is largely unchanged from the previous version.

Under the current version of APPI, the Japanese government can report incidents involving non-Japanese businesses to the foreign business' own regulatory authorities. The 2020 amendments expand that power, and the PPC can demand documents and reports from foreign entities, as well as enter a facility and conduct and audit with a foreign regulatory authority.
                                                                       
### How the APPI defines personal information and personal data

The definition of personal information and personal data under the APPI hasn't changed since the 2017 revisions. It defines personal information as any information from which one can deduce the identity of a living individual. Such information includes biometric markers and official identifier numbers. Like the EU's General Data Protection Regulation (GDPR), there's also a special category of "sensitive personal information," which includes race, religion, criminal record, and medical history. Under the 2020 amendment, personal data includes personal data that are to scheduled to be deleted within six months from the date the entity obtained it, which is excluded under the current law.

It's important to note that the 2020 amendment introduces the concept of pseudonymized information, which can only identify individuals when combined with other data. According to the [_IAPP_](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi/), pseudonymized information is exempted from parts of the APPI, including the requirement to disclose and stop using personal data. Since pseudonymized information is limited to the internal use by businesses, it is not allowed to be shared with third parties by consent of the individual or through opt-out procedure.     

### The penalties for noncompliance

The current APPI establishes fines and penalties for violations, but the 2020 amendments make the penalties heavier. The amended APPI stipulates that parties who fail to comply with corrective orders by the Personal Information Protection Commission (PIPC, sometimes abbreviated as just PPC) can be liable for criminal punishment of up to 1 year imprisonment or fines of as much as 1,000,000 Japanese yen (if the party is a business entity, up to 100,000,000 Japanese yen). In addition, the 2020 amendments allow the PIPC to publish the names of operators who don't comply with orders.

In the case of a business or employee using personal information with a purpose to gain profit illegally, this Act is considered criminal and can be punished by up to a year in prison or a fine of as much as 500,000 Japanese yen (if the party is a business entity, up to 100,000,000 Japanese yen).           
Individuals can also sue for damages relating to the loss of privacy, which may end up having the biggest financial repercussions for businesses.

In practice, the PIPC usually follows an enforcement pattern of an initial inquiry into allegations, followed by recommendations to correct any violations. The PIPC can pursue legal action against companies who fail to change their behavior after this process.

### New rights of individuals under APPI

The 2020 APPI amendments give individuals an **expanded right of deletion or suspension of use**. According to [the law](https://www.ppc.go.jp/files/pdf/20200612_comparative_table_amended_APPI.pdf), data subjects can now demand their data be erased "if it has become unnecessary for a personal information handling business operator to utilize retained personal data," if that entity has had a certain data breach or leakage, or "there is a possibility that handling of the retained personal data... would harm the rights or legitimate interests of the principal."

Allowing individuals to demand erasure when there is a possibility of harm stands in contrast to the previous language, which allowed for deletion only when personal data was handled or acquired illegally. In addition, in the prior version of the APPI, any data scheduled to be erased within six months was exempt from the right to erasure. The new version removes the six-month exception.
     
<include src="TweetQuote" quoteText="The 2020 amendments also give subjects the right to request an electronic copy of their personal data."/>

### New obligations for companies under APPI

As we mentioned earlier, the old APPI guidelines did not include **mandatory reporting of data breaches**, but the new law does require businesses to report certain "leakage, loss or damage" to the PPIC, which thresholds will be set forth in the rules for the APPI later. However, the language of the requirement is still somewhat murky when it comes to informing individuals that their data has been compromised. The law says this requirement doesn't apply "when it is difficult to inform a principal and when necessary alternative action is taken to protect a principal's rights and interests."

The 2020 amendments include two notable provisions regarding **transfer of personal data to a third party**. The first expands regulations to transfers in cases where the disclosing party can't use the data to identify specific individuals, but the recipient of the data can.

According to [Data Guidance](https://www.dataguidance.com/opinion/japan-impact-adopted-appi-amendment-bill), "Given that provision of online identifiers (such as cookies) to third parties may become subject to consent requirements, this amendment will likely affect targeted advertising and other ad tech practices. The practical impact of the Amendments on businesses, in this respect, is high." However, Data Guidance goes on to say that, because obtaining consent for using cookies is already required under the GDPR, this requirement shouldn't be too onerous for GDPR-compliant companies.

The other unique element regarding third parties concerns **transfer of data across national borders**. Under the current version of APPI, businesses sharing data outside Japan must obtain the consent of the data subject and share information about the data-privacy systems of the third party and their country. If a business does not obtain prior consent (for example, because the transfer isn't to a third party), they are required to ensure that the recipient of the data has equivalent data protection standards to the APPI or is in a country with equivalent standards. At present, the only foreign countries for which this applies are the UK and the European Union.

The 2020 amendments make several changes to this regulation. They expand the information that must be shared with individuals when obtaining consent (the specific details have yet to be released). They also require that when sharing personal data with operators that have equivalent data protection standards, businesses must ensure that the protection standards are maintained.

Also, under the amended APPI, personal information operators are required to disclose their addresses and the name of the representative director in case the operator is a corporation. In addition, additional information needs to be disclosed for the provision of information through opt-out procedure or in case of joint use of personal information.

## Preparing Your Business for APPI Amendments

Like many international data-privacy rules, the text of the APPI doesn't make many specific suggestions for best practices. However, the PIPC has issued guidelines regarding appropriate security measures. The good news is that many of these guidelines are familiar to GDPR-compliant companies, and they start with some basic data housekeeping.

_The following guidelines are not intended as legal advice. Contact your legal counsel for specific recommendations for the provision of personal data._

### Appoint a Data Protection Officer (DPO)

This isn't a hard and fast requirement, but PIPC guidelines recommend it for companies in which a breach could cause harm, provided the business is large enough. If you're running an international corporation handling sensitive personal information and conducting cross-border data transfers, consider this recommendation a requirement.

A DPO can help ensure you're taking appropriate measures to stay compliant, such as regularly reviewing your privacy policy as guidelines evolve. 

### Update legacy systems

Given the prevalence of vulnerable legacy technology in Japan, it's essential to take a hard look at your company's internal systems. A failure to do so could lead to costly legal action. For example, in the Benesse case, the company's negligence hinged on the fact that they hadn't updated their processes to prevent the transfer of data to new Android phones. A small oversight with a big consequence.

In addition, staying on top of the latest encryption standards can free your company from some of its legal obligations. Under the current guidelines, businesses are not required to inform the PIPC of a breach, provided the leaked data is encrypted "[at a high level](https://www.dataguidance.com/notes/japan-data-protection-overview)."

### Implement access controls

The APPI demands that businesses take "necessary and appropriate action for the security control of personal data." The bedrock principle of "necessary and appropriate" security is that you should limit the number of people who can access personal information.

Implementing a sophisticated [workforce identity and access management (IAM)](https://auth0.com/b2e-identity-management-for-employees) system lets you assign permissions for who gets to access sensitive data. Moreover, it creates an immutable record of access, so if there is a breach, you can limit the damage.

If a simple username/password combination is all that it currently takes to access your company's personal information databases, then workforce IAM is a priority.

## Data Protection Is Mandatory, With or Without Privacy Laws

In passing the latest APPI amendments, the Japanese government has made it clear that it intends to take a tougher stance on the handling of personal data. But it shouldn't take a Diet approval for businesses to examine their use of personal information or to ensure that they have appropriate security control measures in place.

Hopefully, these amendments will lead to improved outcomes for Japanese companies, citizens, and everyone doing business in Japan.

For further information on how a modern approach to IAM can help protect your company's data and comply with data protection laws, reach out to the [team at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


The New Japanese Privacy Law: What Businesses Need to Know

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

The growing list of new privacy laws outside the EU can be challenging. Auth0 provides a list of recently enacted laws or those under consideration.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

Governments around the globe are changing how they view privacy as a result of the EU’s deliberations on personal data protection and breach notification.

Those deliberations resulted in the General Data Protection Regulation (GDPR) coming into force on May 25, 2018. Meanwhile, many other governments, including two states in the U.S., have recently enacted or are considering similar regulations. These changes mean that organizations which have previously avoided the effort to become GDPR-compliant could still find themselves facing similar regulatory requirements and fines—or at least the need to get their data and processes in order to scale into new regions.

<include src="TweetQuote" quoteText="Keep up with the growing list of new privacy laws and amendments outside the EU with the help of Auth0"/>

## GDPR Whitelisting Influence

While GDPR applies directly to data from EU citizens, the EU also regulates whether or not personal data may [flow from within the EU to an outside country](https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en).

These agreements allow for data to securely flow between two countries and often diminish or remove the need for additional contractual clauses.

The EU is also going to create a European Data Protection Board that will wield the power to influence large swathes of the digital data economy. Warnings about adequacy protections are already influencing other government’s data protection efforts.

The threat of removal from this whitelist is reportedly part of what influenced some changes in Argentina’s latest data protection bill. Canada is also looking to align data protection efforts with GDPR.

Most recently, the UK’s Prime Minister Theresa May made it abundantly clear that she’s seeking [more than an adequacy agreement with the EU](https://iapp.org/news/a/can-theresa-may-get-the-data-protection-deal-she-wants/), pushing for the UK’s Information Commissioner’s Office (ICO) to serve as GDPR’s UK enforcing agency, with the likely goal of having the ICO serve on European Data Protection Board. 
South Korea, as well as Japan, are also in white-list discussions with the EU. 
If you’re a global company like Auth0, it’s a good idea to keep up with the growing list of new privacy laws and/or amendments to existing privacy laws in countries outside of the EU. 

The countries listed below are currently "whitelisted" by the EU as having adequate protections, meaning that data may currently flow from the EU (and Norway, Liechtenstein, and Iceland) to one of these countries without additional protections: 

- Andorra
- Argentina
- Canada (commercial organisations)
- Faroe Islands
- Guernsey
- Israel
- Isle of Man
- Jersey
- New Zealand
- Switzerland
- Uruguay 
- United States ([Privacy Shield framework](https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_en) only)

### Argentina: [Draft Data Protection Act](https://iapp.org/news/a/gdpr-matchup-argentinas-draft-data-protection-act/#)

On Jan. 2017, after a public comment period, The Argentine Data Protection Agency (Dirección Nacional de Protección de Datos Personales) presented a draft of the Data Protection Act. The proposed bill offers several changes, including the elimination of registration databases and limiting the recognition of data subjects to individuals removing the current inclusion of legal entities. Like GDPR, the updated bill also revised legal definitions to include biometric and genetic data. Subjects must also be notified if a deal is canceled due to a credit report. The bill also seeks to make DPPA an independent entity to preserve GDPR whitelisting, since the EU raised objections to its current position under the National Ministry of Justice and Human Rights. The bill is expected to reach Argentina’s congress in 2018.

### Australia: [Notifiable Data Breach Scheme (NDB)](https://www.oaic.gov.au/privacy-law/privacy-act/notifiable-data-breaches-scheme)

This amendment to Australia’s Privacy Act of 1988 went into effect last month on Feb. 28, 2018. Under NDB, individuals must be notified if a data breach is likely to result in "serious harm" and requires that the notification indicate steps that harmed individuals should take to protect themselves. The Australian Information Commissioner must also be notified. NDB applies to organizations with an annual turnover of $3 million AUD or more, as well as businesses that trade in personal information, health information, and tax file number (TFN) recipients.

### Canada: [Personal Information Protection and Electronic Documents Act (PIPEDA)](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/)

At the end of Feb. [the Canadian government published a report](https://www.ourcommons.ca/DocumentViewer/en/42-1/ETHI/news-release/9691065) recommending an update to the Personal Information Protection and Electronic Documents Act (PIPEDA) in force since April of 2000. Including GDPR-familiar principles like consent and data portability, the recommendation also includes considering implementing measures to improve algorithmic transparency. Also striking is the inclusion of language that  demonstrates GDPR’s reach citing the intent to "work with its EU counterparts to determine what would constitute adequacy status for PIPEDA in the context of the new General Data Protection Regulation (GDPR)."

### Japan: [Act on the Protection of Personal Information (APPI)](https://iapp.org/news/a/matchup-gdpr-and-japans-act-on-the-protection-of-personal-information/)

Into force as of May 30, 2017, APPI, shares many GDPR similarities, including a "whitelist" of other countries with acceptable data protection regulations that may encourage safe data flow. 
But while GDPR’s purpose is to encourage the "free movement" of data while also providing protection, APPI focuses on protecting the rights of individuals and extends protections to include personal identifier codes, and aggregated information in the "business operator’s" database. The EU and Japan remain in discussions regarding mutual "whitelisting".

### UK: [Data Protection Bill](https://services.parliament.uk/bills/2017-19/dataprotection.html)

The UK’s third-generation Data Protection bill is intended to fill many of the gaps generated by Brexit and protect the free-flow of data between the UK and the EU, accounting for [75% of the UK’s cross-border data flows](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/639853/The_exchange_and_protection_of_personal_data.pdf), worth billions of pounds in trade. The bill also addresses data standards for social, health, law enforcement, and intelligence agencies as well as legal enforcement of GDPR standards. The portion of the bill seeking to [deny data access rights](https://www.theguardian.com/technology/2018/mar/05/home-office-immigration-data-access-eu-citizens-data-protection-bill) for "effective immigration control" came under fire during the first weekend of March 2018, with groups seeking to have the exemption removed and threatening legal action.

### CALIFORNIA: [California Consumer Privacy Act (CCPA)](https://www.caprivacy.org/inthenews/)

Targeting the November 2018 ballot in the state of California in the United States, the California Consumer Privacy Act seeks to limit companies’ ability to collect and sell consumer data and includes data breach notification requirements as well as the right to know what is being collected and the right to say "don’t sell my data." Also included is the right to be protected from discriminatory practices like denying services or charging higher prices, influenced by collected data. The bill faces [significant opposition](https://qz.com/1219254/california-democrats-are-trading-blows-with-silicon-valleys-libertarians-in-a-fight-for-the-left/), from within the tech industry.

### NEW YORK: [DFS Cybersecurity Regulation](http://www.dfs.ny.gov/about/press/pr1708281.htm), [The Stop Hacks and Improve Electronic Data Security Act (SHIELD)](https://www.nysenate.gov/legislation/bills/2017/s6933)

The U.S.’s New York State took the lead in new and proposed regulations last year with [cybersecurity regulations](http://www.dfs.ny.gov/legal/regulations/adoptions/dfsrf500txt.pdf) for all non-governmental agencies operating under banking law, including scrutiny of third-party vendors. Annual compliance reports for businesses providing financial services in New York State are due this March. But in the wake of the [Equifax breach](http://searchsecurity.techtarget.com/news/252436307/Equifax-data-breach-affected-24-million-more-consumers), New York is now considering more stringent regulations. Currently under review in the Senate Rules Committee, [The Stop Hacks and Improve Electronic Data Security Act](https://www.nysenate.gov/legislation/bills/2017/s6933) (SHIELD) provides breach notification requirements and protections for personal data. Breaches would be considered a violation of business law. SHIELD would also add the option of seeking remedies under the civil law. Like GDPR’s protection for EU’s citizens, the SHIELD Act would apply to any business holding sensitive data for New Yorkers, regardless of location.

<include src="TweetQuote" quoteText="Governments around the globe are taking a cue from GDPR. Check out @auth0’s list of countries and states with new privacy laws or amendments."/>

## Global Deployment and Compliance with Auth0

Auth0’s ability to deploy anywhere and remain current with constantly changing laws and regulations gives companies the flexibility to grow without having to worry about whether or not their authentication solution can scale. If you’d like insight into how Auth0 can help you deploy in particular regions, please reach out to [sales@auth0.com](mailto: sales@auth0.com).

Auth0, a global leader in Identity-as-a-Service (IDaaS), provides thousands of customers in every market sector with the only identity solution they need for their web, mobile, IoT, and internal applications. Its extensible platform seamlessly authenticates and secures more than 50M logins per day, making it loved by developers and trusted by global enterprises. The company's U.S. headquarters in Bellevue, WA, and additional offices in Buenos Aires, London, Tokyo, and Sydney, support its customers that are located in 70+ countries.


"laws"