The Personal Information Protection Commission ('PPC') announced, on 2 November 2022, that it had issued administrative measures under Article 42 of the Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020) ('APPI') against business operators, for violations of Articles 16-2, 18(1), and 23(1) of the APPI, following an investigation.

Background to the guidance

In particular, the PPC highlighted that the business operators, on their website, handle personal information, such as the name and address of an individual who has received a decision to initiate bankruptcy proceedings or a decision to initiate civil rehabilitation proceedings, which is used by a large number of unspecified persons. More specifically, the PPC noted that the data is displayed in a form that is linked to a data map published on the internet, despite the fact that it is fully foreseeable that it may induce property and personality discrimination against the individual concerned.

Findings of the PPC

Following its investigation, the PPC concluded that the personal data is being used in a way that may encourage or induce illegal or unfair acts in violation of Article 16-2 of the APPI. In addition, the PPC considered the website's use of personal information in the manner described above, as well as the fact that it had not promptly notified or publicly announced the purpose of use of personal information after it was obtained, thus violating Article 18(1) of the APPI. Furthermore, the PPC detailed that the website making the personal data available to a large number of persons on the internet makes it possible to provide personal data to third parties without the prior consent of the person concerned, noting that providing personal data to third parties without obtaining the prior consent of the individual violates Article 23(1) of the APPI.

Outcomes

In light of the above, the PPC ordered, on 2 November 2022, that the business operators immediately stop providing personal data via the website, detailing that the business operators did not respond to the recommendations by the PPC.

Furthermore, the PPC confirmed that it has filed a criminal complaint seeking the application of penalties under Article 85 of the APPI, stating that if the business operators in question violate the order in the future, it will seek the application of penalties under Article 83 of the APPI. Finally, the PPC confirmed that the operator in question has been served with a service of public notice under Article 58-4 of the APPI.

You can read the guidance, only available in Japanese, here.