# Standards and Regulatory References — Japan APPI

## Primary Legislation

### Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律)
- **Original enactment**: 2003 (Act No. 57 of 2003)
- **2015 Amendment**: Effective 30 May 2017 — created PPC; modernised framework
- **2020 Amendment**: Effective 1 April 2022 — strengthened rights, cross-border rules, pseudonymised data
- **Next scheduled review**: 2025 (triennial review cycle per supplementary provisions)

### Cabinet Order for Enforcement of APPI
- Implements specific APPI provisions including special care-required information categories
- Defines thresholds and technical requirements

### PPC Rules for Enforcement of APPI
- Detailed implementation rules for business operators
- Consent collection methods, security measures, record-keeping requirements

## PPC Guidelines

### PPC Guidelines on the Act (General Rules, 2022 revised)
- Comprehensive interpretation of all APPI provisions
- Consent requirements, purpose specification, third-party provision
- Individual rights response procedures

### PPC Guidelines on Cross-Border Transfer (2022 revised)
- Pre-transfer information requirements
- Equivalent measures verification
- Adequate country/region recognition criteria
- Record-keeping for cross-border transfers

### PPC Supplementary Rules (EU Adequacy)
- Additional protections for personal data transferred from the EU/EEA under the adequacy decision
- Treats sensitive information transferred from the EU as special care-required under APPI
- Limits on re-transfer to third countries
- PPC enforcement cooperation with EU DPAs

## EU-Japan Adequacy Framework

### EU Adequacy Decision (23 January 2019)
- Commission Implementing Decision (EU) 2019/419
- Recognises Japan (under APPI with PPC Supplementary Rules) as adequate
- Subject to periodic review (first review completed 2021; second review scheduled)

### PPC Adequacy Determination for EU/EEA
- Reciprocal recognition of EU/EEA as adequate under APPI Art. 28
- Extended to UK following Brexit

## APPI vs GDPR Key Differences

| Feature | APPI | GDPR |
|---------|------|------|
| Consent default | Opt-out for some uses; consent for special care-required PI | Consent is one of six co-equal bases |
| Cross-border transfer | Pre-transfer info + consent; adequacy; equivalent measures | Adequacy; SCCs; BCRs; derogations |
| Pseudonymised data | Specific statutory category with relaxed rules (internal only) | Defined but no separate processing framework |
| Anonymised data | Statutory category; may be provided to third parties | Not within GDPR scope once truly anonymous |
| Criminal penalties | Yes — imprisonment up to 1 year; corporate fine up to JPY 100M | No criminal penalties in GDPR itself |
| DPO requirement | No statutory requirement (recommended) | Mandatory for certain organisations |
| Breach notification | Report to PPC "promptly" (PPC guidelines: 3-5 days); notify individuals | 72 hours to DPA |
| Maximum administrative fine | No administrative fines; enforcement through orders → criminal penalties | EUR 20M or 4% global turnover |
| Individual rights | Disclosure, correction, cessation of use, cessation of provision | Access, rectification, erasure, portability, objection, restriction |

## Enforcement Precedents

### Recruit Career / Rikunabi (2019)
- PPC recommendation for profiling job applicants without consent
- Significance: AI/profiling compliance; transparency requirements

### LINE Corporation (2021)
- PPC guidance on cross-border data access by China-based subsidiary
- Significance: Strengthened cross-border transfer transparency expectations

### Benesse Corporation (2014, pre-2022 amendments)
- Major data breach affecting 35 million customer records
- Employee of contractor sold data
- Significance: Led to strengthened security measures requirements in subsequent APPI amendments