JapanAct on the Protection of Personal Information, individual identification code and biometric provisions
Act No. 57 of 2003 as amended by Act No. 37 of 2021, Art. 2(2)(i); Cabinet Order to Enforce the Act (Cabinet Order No. 507 of 2003, as amended), Art. 1
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that derives a faceprint, voiceprint, or other individual identification code from a person in Japan, including one derived from a photo, video, or audio recording, must give purpose-of-use notice and avoid wrongful acquisition under APPI's general rules, and must obtain the data subject's consent before disclosing the identifier to a third party.
These lines are LexLint's reading of the law's text. Also read by: Personal Information Protection Commission (PPC), Japan (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ppc.go.jp/personalinfo/legal/guidelines_tsusoku/
- Guidance body
- Personal Information Protection Commission (PPC), Japan
- Open questions
- Does a feature set that a model extracts from a face count as codes "used to identify a specific individual by a distinguishing physical feature of theirs" under Article 2(2)(i) of the Act on the Protection of Personal Information when the business never uses it to authenticate that person?
What it makes you log
Logging duty
Article 2(2)(i) of the Act and Article 1 of the Cabinet Order define an individual identification code, naming the bodily features (DNA base sequence, facial appearance, iris pattern, voice, gait, vein pattern, fingerprint or palm print) whose computer-readable conversion counts. They are definitions and impose no duty to make, keep or produce a log or record. The Act's record duties sit in Article 29 (a record of each provision of personal data to a third party, with the date and the third party's name, kept for the period a Commission order sets) and Article 30 (confirmation and a record on receiving personal data from a third party); neither article is among the provisions this row cites, so the row does not borrow them.
- Kind
- None
- As of
What this law does
APPI reaches biometric identifiers through the concept of an individual identification code (Art. 2(2)(i)): a code converted to identify a specific individual by a distinguishing physical feature. This definition sits among the Act's Chapter I general provisions, so it binds both the private-sector duties in Chapter IV and the administrative-entity duties in Chapter V of the Act.
Cabinet Order Art. 1 enumerates the covered features and names both facial appearance and vocal characteristics expressly, alongside DNA base sequence, iris pattern, gait, and palm or hand vein pattern.
Personal information containing an individual identification code is personal information in itself, without needing to be combined with other data, but it sits outside the Art. 2(3) sensitive personal information category, so its capture does not trigger the Art. 20(2) prior-consent requirement that applies to race, health data, and similar categories.
Disclosure to a third party instead falls under the general third-party-provision rule in Article 27, which requires the data subject's consent unless an exception applies, and the opt-out mechanism in Article 27(2) remains available for data containing an individual identification code, because that mechanism excludes only sensitive personal information, data acquired in violation of the Act's rule on proper acquisition, and data received from another business under the opt-out itself.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .