What does this cover?

Under the Use of Numbers to Identify a Specific Individual in the Administrative Procedure 2013 (the Act), the Specific Personal Information Commission (SPPC) was responsible for overseeing the implementation of the Act.

On 1 January the new Personal Information Protection Commission (PPC) replaced the SPPC and takes over responsibility for overseeing the Act as well as producing numerous guidelines for implementing the Amendments to the Act on the Protection of Personal Information 2003 (the Amendments) when the Act comes into force in 2017.

The Amendments are understood to address, amongst other things, cross border data transfers, and are also expected to remove the exemption for organisations falling below the '5000 individual' limit with respect of personal data processing. Further details are regarding the implementation of the Amendments are expected to follow and will come into force in September 2017.

What action could be taken to manage risks that may arise from this development?

Organisations operating in Japan should consider the Amendments when full details are available in preparation for a potentially more stringent enforcement regime under the PCC.