The Act on the Protection of Personal Information (APPI), which was introduced in 2003, regulates the protection of personally identifiable information. Amendments were introduced to the APPI in September 2015, which were fully implemented on 30 May 2017. The APPI requires companies to obtain consent to process personal data, unless any of the exceptions permitted under the law are applicable.
When the parties plan to provide documents or ESI containing personal data to the court, the APPI will apply. Under the APPI, parties are generally prohibited from providing personal data to the court without consent; however, it allows the provision of personal data without consent if the 'personal data is necessary for the protection of the life, body, or property of an individual and if it is difficult to obtain the consent of the person'. A party will be able to provide personal data to the court if this exception applies.
In addition, there are cases when a company is asked by the court of a foreign country, or by the parties to foreign litigation themselves, to produce documents or data that contain personal information. Under the APPI, if personal data is to be transferred to third parties in a country outside Japan, a requirement is imposed to obtain the prior consent of the relevant individuals. If the company does not receive consent, which is normally the case, it should consider whether an exception to the rule applies.