Rule detail : 127031

JPN DP My Number Guideline Revised

On Jan. 19, JPN DP proposed rules on specified personal information.

JPN DP proposed guidelines on proper handling of specified personal information.
Aim to revise matters on reporting re data leak and notice to affected individuals, will impact guidelines for administrative entities, regional public entities, and businesses.
Follows JPN DP Sep. 2021 changes to personal data handling guides, see #114746.
Proposed Revisions
Concern mandatory reporting to JPN DP (on preliminary basis, with confirmed facts) and individuals in case of risk of data leak, harm to individuals' rights and interests.
Detailed explanations on measures that ought to be taken upon discovery of an information leak and notifications to be sent to JPN DP and the relevant individuals.
On matters including factual investigations, investigations of cause, examination and implementation of measures to prevent recurrence; public entity reporting deadlines.
Report within three to five days upon discovery of data leak (a rough indication), report with confirmed facts within thirty days in principle (stipulated as a rule).
Consultation Period
Comments on the public consultation should be received by Feb. 19, 2022.
Mar. 2022 Response to Comment
On Mar. 30, 2022, JPN DP issued consultation feedback after receiving 3 comments.
Clarified scope, revised definition on administrative work involving the use of personal number for clarity, made other revisions re technical matters, finalized guidelines.
Apr. 1, 2022 Update Webpage, FAQs
On Apr. 1, 2022, JPN DP updated webpage on specific personal data handling guides.
JPN DP included links to the data handling guidelines it had updated on Mar. 30, 2022.
Also updated FAQs on guides including those re financial business, mainly involving changes to paragraph references but also on outsourcing to third party overseas.
(Content published on Apr. 1, 2022; and summary added to Reg-Track Apr. 8, 2022).
Apr. 15, 2022 Update Summaries of Guides
On Apr. 15, 2022, JPN DP updated summaries of guidelines suitable for staff training.
Concern guidelines on specific personal information (my number) for business operators; financial business; and for administrative, regional public entities.
Apr. 15, 2022 Update Supplementary Materials
On Apr. 15, 2022, JPN DP updated supplementary materials associated with guidelines.
Re businesses, concern summary on application of guides on process from obtaining my number to disposal and relevant sections of guides for specified corporations.
Re public entities, involve revisions to personal information protection rules that could be necessary in the handling of specific personal information (my number).
On Apr. 20, 2022, JPN DP updated rules and guides for the public sector, see #128105.
Apr. 27, 2022 Guides to Prevent Data Leak
On Apr. 27, 2022, JPN DP issued guides for local public entities to prevent data leak.
May 2022 Training Video and Materials
On May 12, 2022, JPN DP issued video, presentation material for public sector training.

Regulators	JPN DP
Entity Types	Corp
Reference	Gd, Vid, 5/12/2022; Gd 4/27/2022; PR, Gd, 4/15/2022; FAQ, PR, 4/1/2022; RF, FS 240000078, PR, 3/30/2022; CP 240000078, PR, 1/19/2022; Law no. 57 of 2003; Law no. 7 of 2013; Law no. 44 of 2020; Law no. 37 of 2021; My Number;
Functions	Compliance; Cyber; HR; Legal; Outsourcing; Privacy; Record Retention; Reporting; Technology; Training
Countries	Japan; Cross-Border
Category
State
Products	Corporate
Regions	AP
Rule Type	Final
Rule Date	1/19/2022
Effective Date	5/12/2022
Rule Id	127031
Linked to	Rule :128105
Reg. Last Update	5/12/2022
Report Section	International