Japan: PPC releases guidelines on handling personal information to prevent spread of Coronavirus
The Personal Information Protection Committee ('PPC') released, on 2 April 2020, guidelines ('the Guidelines') and a question and answer ('the Q&A') on the handling of personal information to prevent the spread of COVID-19 ('Coronavirus'). In particular, the Guidelines outline exceptions where personal information can be processed without the consent of the data subject, including when particularly necessary for the protection of human life, body, property, or for the purpose of improving public health when it is difficult to obtain the consent of the data subject. In addition, the Q&A highlights instances in which employee personal information can be processed without consent. Specifically, the Q&A notes that an employee's personal data can only be processed without consent where the employee has contracted the Coronavirus, and the processing of their personal data is necessary to prevent secondary infection, and to continue business activities.
UPDATE (12 May 2020)
PPC updates Guidelines and Q&A
The PPC announced, on 12 May 2020, that it had updated its Guidelines and Q&A. In particular, the updated Guidelines provide that the processing of personal data without the consent of the principal is only permitted as outlined in Article 23 (3) of the Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2016) ('APPI') or exceptionally to prevent the spread of the coronavirus. In addition, the updated Q&A note that where a public health centre has decided to provide a business operator with the work history of employee that has been infected with Coronavirus, no consent is required to provide that information.