All notes · Consent

Sending personal data out of Japan

Article 28 of Japan's APPI sets its own rule for providing personal data to a third party abroad. When consent is needed, what must be shown before asking, and the two alternatives.

The rule

When a business in Japan provides personal data to a third party in a foreign country, Article 28 applies instead of the general third-party rule. By default, the business needs the person's prior consent to the provision to a third party abroad^1,2.

Two things catch teams off guard.

• Entrustment doesn't help. Inside Japan, handing data to a service provider for processing (entrustment) needs no consent. When that provider is abroad, Article 28 applies anyway¹.
• Consent must be informed in a specific way. Before asking, you give the person particular information (below)^1,3.

When consent isn't needed

There are two alternatives, plus the general exceptions such as provision required by law¹.

1. The destination is a designated country. The PPC has designated countries with a system it considers equivalent to Japan's. Currently these are the EU (the countries listed in the designation) and the United Kingdom⁴. The designation was made together with the EU's adequacy decision for Japan^4,5.
2. The recipient has a conforming system. The recipient has put in place a system to keep taking measures equivalent to those the APPI requires of a Japanese business. In that case, the provider must also check periodically that the measures are actually being taken, act if they aren't, stop the provision if they can't be maintained, and give the person information about these steps on request^1,3.

What to show before asking

If you rely on consent, give the person this information first^1,3:

1. The name of the foreign country
2. Information about that country's system for protecting personal information
3. Information about the measures the recipient takes to protect personal information

If the country can't be identified when you ask, say so, explain why, and give whatever other helpful information you have³. The PPC's guidelines describe how to present this⁴.

Records

Providing data to a third party abroad is still a third-party provision for record-keeping. The provider records the provision and keeps the record (Article 29)¹.

For the consent itself, keep who consented, the version of the information you showed, the recipient, the scope of the data, and the time. If you show the information in several languages, keep each version.

Recording it with a signature

With Clavis, the product includes the version hash of the information shown, the recipient, and the scope in the hash being signed. The person signs with their passkey after reading the one-line summary. Later, you can show that the version they signed is the version you kept.

Next

• Recording consent under Japan's APPI
• Passkey signatures as evidence in Japan