The Supreme Court (Second Petty Bench) issued a decision on October 23, 2017, overruling an Osaka High Court original decision that had dismissed a claim for damages filed by a plaintiff, an individual who alleged that the leak of the plaintiff's personal information (including the plaintiff's name, date of birth, address, telephone number) possessed by the defendant, a correspondence education provider, caused the plaintiff mental distress. The Supreme Court remanded the case to the Osaka High Court for further action regarding the defendant's negligence, the plaintiff's mental damage and its degree, etc.

There are several judicial precedents affirming that plaintiffs may claim damages for infringement of their privacy rights due to personal information leakage. Some of the existing precedents support damage claims in the range of ¥5000–10,000 based on types of mental distress, such as anxiety, even without any proof of harassment or financial loss due to the misuse of personal information. By contrast, the Osaka High Court's decision in the instant case had ruled that discomfort or anxiety alone was insufficient grounds for damages. The Supreme Court's recent decision overruled this decision and suggested the possibility that a court may recognize mental distress such as discomfort or anxiety as the basis for damages in cases of personal information leakage.

Due to the widespread adoption of technological developments including big data and the Internet of Things, we expect that the number of opportunities for companies to deal with large amounts of personal information will increase dramatically in the future and that the potential liability due to personal information leakage may be very large. Any company dealing with personal information in Japan should carefully review the Supreme Court's decision and the progress of the remanded trial, as well as reconsider the possible economic impact of, and countermeasures against, leaks of personal information.