Japan’s Data Protection Law is the Act on the Protection of Personal Information (‘APPI’). Since the laws in this field need to be frequently updated as technology progresses, it is to be revised every three years. The APPI was most recently amended in 2020, and changes will take effect in April 2022. I am going to highlight how cookies are treated in this revision.
What are cookies?
Cookies are small text files that websites place on your device as you are browsing. They are processed and stored by your web browser. Cookies often track information like how frequently the user visits, what banners have been clicked on, items in the shopping cart, etc.
Cookies under the GDPR
The GDPR [1], the EU’s influential data protection legislation, seems to consider cookies personal data if they are used to identify users (see Article 4(1), Recital 30). Followingly, many websites now request users to consent to use cookies to avoid a legal risk due to the GDPR.
Cookies under the APPI
It became known that cookies can produce privacy issues in Japan too. In 2019, Recruit Group was found to have sold data predicting the odds of job-hunting students declining informal job offers. The data was based on their internet browsing history (i.e., cookies). The buyer companies seemed to use the data for screening candidates. As Recruit Group couldn’t identify each student with cookies alone, and therefore, they couldn’t be considered personal data to be protected under the APPI. However, the buyer companies could identify each student by comparing the data with their data, which infringes on their privacy rights.
The awareness of the issue above was reflected in the 2020 amendment. Unlike the GDPR, however, cookies are not personal data under the amended APPI. Instead, it has created a new category called ‘personal related data,’ which cookies fall, and regulates them separately. Take the case above; for example, the amended APPI imposes Recruit Group to confirm with the buyer companies if they’ve obtained consent from the candidates.
Overall, while the amended APPI is not as strict as the GDPR, it’s extended its protection to cookies to some extent. The APPI takes the balance between the rights of individuals and the use of personal information for business activities.
Note:
[1] The General Data Protection Regulation (EU) 2016/679.
—-
Disclaimer: While every effort has been made to ensure that the information on this article is accurate at the time of posting, it is not intended to provide legal advice as individual situations will differ. If you do require advice or wish to find out more about the information provided and related topics, please contact the author.
Text by: Atty. Atsushi Miyake of Miyake Law, November 2021.
Read more original and informative articles here.
