JapanAct on the Protection of Personal Information, pseudonymized and anonymized personal information
Act No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 41-46
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- none
As of .
What it requires
- Process personal information into pseudonymized personal information only to the standards the Personal Information Protection Commission sets, secure the deleted information and the means of processing against leaking, and keep the pseudonymized personal information to the specified purpose of use (Article 41(1) to (3)).
- Do not collate pseudonymized personal information with other information in order to identify the person it came from, whether you prepared it or received it (Articles 41(7) and 42(3)).
- Do not provide pseudonymized personal information to a third party, whether or not it is personal information, except in cases based on laws and regulations (Articles 41(6) and 42(1)).
- Process personal information into anonymized personal information only to the standards the Commission sets so that a specific individual cannot be identified and the information cannot be restored, secure the deleted identifiers and the processing method against leaking, and disclose the categories of individual information it contains (Article 43(1) to (3)).
- Before you provide anonymized personal information to a third party, disclose the categories of individual information it contains and the means of providing it, and state explicitly to the third party that the information is anonymized personal information (Articles 43(4) and 44).
- Do not collate anonymized personal information with other information in order to identify a person, and, if you received it and did not prepare it, do not acquire the deleted identifiers or the processing method (Articles 43(5) and 45).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Logging duty
Articles 41 to 46 set the standards for preparing pseudonymized and anonymized personal information, the security of the deleted information, the disclosure and statement before provision, the bans on collation and on acquiring deleted information, and complaint handling. None of them requires a log, register or record. The records of provision and receipt are required by Articles 29 and 30, held on a separate row.
- Kind
- None
- As of
What this law does
Pseudonymized personal information is information prepared so that a specific individual cannot be identified unless it is collated with other information (Article 2(5)), and anonymized personal information is information prepared so that a specific individual cannot be identified and the personal information cannot be restored (Article 2(6)).
A business handling personal information that prepares pseudonymized personal information must process the data to the standards the Personal Information Protection Commission sets (Article 41(1)), must secure the deleted information and the means of processing against leaking (Article 41(2)), and must keep to the specified purpose of use (Article 41(3)).
A business handling pseudonymized personal information must not collate it with other information in order to identify the person the information came from (Article 41(7)).
A business handling pseudonymized personal information must not provide pseudonymized personal data to a third party except in cases based on laws and regulations (Article 41(6)), and must not provide pseudonymized personal information that is not personal information to a third party except in cases based on laws and regulations (Article 42(1)).
Article 42(3) applies Articles 23 to 25, Article 40 and Article 41(7) and (8) to the handling of pseudonymized personal information by a business handling pseudonymized personal information, so the ban on identifying a person by collation binds a recipient as well as the business that prepared the information.
A business handling personal information that prepares anonymized personal information must process the data to the Commission's standards so that a specific individual cannot be identified and the information cannot be restored to its original state (Article 43(1)), must secure the deleted identifiers and the processing method against leaking (Article 43(2)), and must disclose the categories of individual information the anonymized information contains (Article 43(3)).
Before providing anonymized personal information it prepared to a third party, it must disclose those categories and the means of providing it and state explicitly that the information is anonymized personal information (Article 43(4)), and when handling anonymized personal information it prepared itself it must not collate it with other information in order to identify a person (Article 43(5)).
A business handling anonymized personal information that did not prepare it must make the same disclosure and statement before providing it to a third party (Article 44), and must neither acquire the deleted identifiers or the processing method nor collate the anonymized personal information with other information in order to identify a person (Article 45), so the ban on identifying a person binds a recipient as well as the creator.
Both must endeavor to take the necessary and appropriate security and complaint-handling measures and to disclose them (Articles 43(6) and 46). The duties bind a business handling personal information, pseudonymized personal information or anonymized personal information, a class that excludes national government organs, local governments and incorporated administrative agencies (Article 16(2), (5) and (6)).
When LexLint raises it
When your app profile says your app processes personal data.