Japan's version of a social security and tax number system, nicknamed "My Number", has started from January 1, 2016.

Under the My Number system, all Japanese citizens, as well as foreigners who have legally resided in Japan for more than three months, are issued a 12-digit individual number that will remain with them for life. The purpose of issuing these individual "My Numbers" is to centralize certain systems, such as certain social benefits claims and tax filings, so that they can be more efficiently administered by the Japanese government.

The My Numbers will also be used as a means for the Japanese government to discover tax evasion or welfare benefits fraud. Beginning in 2018, My Numbers can be voluntarily linked to a person's bank account number, and the government is considering making such links mandatory in 2021.

The centralization of personal information, however, raises concerns over potential breaches of data security, particularly where such information could be accessed by unauthorized parties. The June 2015 data breach of the Japan Pension Service has only heightened this concern.

In order to address this concern, in addition to the requirements already placed on the handling of personal information under Japan's Act on the Protection of Personal Information, the My Number Act obligates every business entity with access to its employees' My Number information to:

  • Collect My Number information only for certain specified reasons described in the My Number Act (e.g., payroll, withholding tax, social insurance) and to make an announcement of those specified purposes to employees (e.g., email to employees, post a notice onto a bulletin board in the office or office intranet);
  • Verify the individual's identification when acquiring My Number information;
  • Limit the use of the individual My Numbers to the administrative purposes specified in the law;
  • Limit the storage of the collected My Number information to the extent such information is required. Business entities must dispose of My Number information as soon as possible after it is no longer necessary maintain it (e.g., when an employee retires or leaves the company); and
  • Not provide My Number information to third parties (other than secured service providers), even if the individual employee consents, unless otherwise specified under the My Number Act.

A business entity can outsource the handling of My Number information to a third party service provider without the individual's consent, but the business entity must exercise necessary and appropriate supervision over the service provider.

A business entity that violates the My Number Act may be subject to criminal liability. There may also be individual liability for those employees who violate the My Number Act (which includes the possibility of imprisonment).

For these reasons it is vital for companies to train all their employees who are in charge of handling My Numbers, such as those in payroll, accounting and Human Resources. As the scheme is new to Japan, many companies are using as a reference the manner in which similar numbers are handled and protected in other jurisdictions. A close example is the use of social security numbers in the United States.