On January 17, 2024, the Personal Information Protection Commission (PPC) announced that it had issued administrative guidance to Business Planning Co., Ltd., Chuo Business Services Co., Ltd, and Company Information – Free Business Co., Ltd. regarding their compliance with the opt-out procedure according to Article 27(2) of the Act on the Protection of Personal Information (APPI).

Background to the guidance

The PPC noted that from February 2023 to March 2023 it surveyed businesses' use of the opt-out procedure. During this time, the PPC contacted 162 businesses that had notified their use of the opt-out procedure, 24 of which were subsequently selected for a separate survey due to lack of or insufficient responses.

Findings of the PPC

Following its investigation, the PPC found problems with three companies. In particular, the PPC explained that Business Planning violated the prohibition of inappropriate use under Article 19 of the APPI and the requirement to prepare records on the provision of personal data to third parties under Article 29(1) of the APPI. Similarly, Chuo Business Services violated Article 29(1) of the APPI when failing to prepare records on providing personal data to third parties. Finally, Free Business was found to have violated the requirements under Article 30(1) and (3) of the APPI which requires businesses to confirm matters related to receiving personal data from third parties and prepare records when receiving provisions of personal data.

Importantly, the PPC clarified that businesses must strictly comply with the provisions of the APPI to ensure the opt-out system does not become a mere formality.

Outcomes

Further to the above, the PPC provided guidance to the companies, which included:

• ensuring that personal information is not used in a way that may encourage illegal or unjust acts;
• proper monitoring of the handling of personal information through periodic audits; 
• ensuring companies appropriately prepare and preserve documents; and
• appropriately confirming and recording prescribed matters when receiving personal information. 

Furthermore, the PPC noted that the companies have until February 29, 2024, to provide an update on the status of their implementation of the remedial measures.

You can read the guidance, only available in Japanese, here.