JapanAct on the Protection of Personal Information, enforcement
Act No. 57 of 2003, as amended by Act No. 37 of 2021, Chapters VI, VIII
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app processing the personal data of a person in Japan must be prepared to answer to the Personal Information Protection Commission's investigative, recommendation, and order powers, and a responsible individual risks criminal liability for violating a PPC order. A person can also sue to enforce a disclosure, correction or cessation request, and can claim compensation under general tort law.
These lines are LexLint's reading of the law's text. Also read by: Supreme Court of Japan, Second Petty Bench, judgment of (Heisei 28 (Ju) No. 1892) (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Violating a Commission order under Article 148, paragraph (2) or (3) is an offence punishable by imprisonment with work for not more than one year or a fine of not more than 1,000,000 yen (Article 178); the corporation itself is subject to a fine of not more than 100 million yen (Article 184, paragraph (1), item (i)). Providing or misappropriating a personal information database or the equivalent for illegal profit carries imprisonment with work for not more than one year or a fine of not more than 500,000 yen (Article 179). The Act creates no offence for a breach of the handling duties themselves until the Commission has issued an order.
Penalty structure
Article 184, paragraph (1), item (i) subjects a corporation to a fine of not more than 100 million yen where its representative, agent, employee or other worker commits an offence under Article 178 (violating an order under Article 148, paragraph (2) or (3)) or Article 179 in relation to its business. The individual offender is punished separately: under Article 178, imprisonment with work for not more than one year or a fine of not more than 1,000,000 yen; under Article 179 (providing or misappropriating a personal information database or the equivalent for illegal profit), imprisonment with work for not more than one year or a fine of not more than 500,000 yen. Article 182 sets a fine of not more than 500,000 yen for failing to report or obstructing an inspection under Article 146, paragraph (1).
- Rule
- Fixed only
- As of
- Currency
- JPY
- Fixed cap
- 100,000,000
Who enforces it
Enforcement body
Personal Information Protection Commission (PPC), the Japanese administrative commission that requires reports, inspects, guides, recommends and orders under Chapter VI, Section 2 (Articles 146 to 148).
Settledness
- As of
- Case link
- https://www.courts.go.jp/assets/hanrei/hanrei-pdf-87154.pdf
- Case citation
- Supreme Court of Japan, Second Petty Bench, judgment of (Heisei 28 (Ju) No. 1892)
- Open questions
- How do the lower courts fix the amount of compensation for mental harm after a leak of personal information once the Supreme Court has required them to examine whether, and to what extent, that harm occurred?
What it makes you log
Logging duty
Chapters VI and VIII give the Personal Information Protection Commission its supervisory powers (Article 146: require information or material, enter and inspect; Article 147: guidance and advice; Article 148: recommendations and orders) and set the offences and fines, including a fine under Article 182 for failing to submit a report or material or refusing an inspection. They impose no duty to make or keep a log or record. Article 148(1) names Articles 29 and 30 among the provisions whose breach the Commission may recommend against, but the record duties themselves are in those articles, outside the cited chapters. The Commission's power to require material and inspect a book or document is a power to demand information, with no record named.
- Kind
- None
- As of
What this law does
The Personal Information Protection Commission (PPC) is Japan's independent supervisory authority, holding recommendation and order powers under Chapter VI. Violating a PPC order under Art. 148(2) or (3) is a criminal offense under Art. 178, punishable for an individual by imprisonment with work for not more than one year or a fine of not more than JPY 1,000,000.
A data subject can sue to enforce a disclosure, correction or cessation request under Arts. 33 to 35, after first making the advance request Art. 39 requires. A claim for compensation runs through general tort law under Civil Code Art. 709, outside APPI itself.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .