665 VIEWS
Pinterest LinkedIn LINE

I had vaguely suspected as much ever since it was enacted, but the thought that it really could be this riddled with loopholes leaves me feeling utterly bleak.

The Act on the Protection of Personal Information states as follows in Article 23:

Article Twenty-Three: Except in the cases listed below, a business operator handling personal information must not provide personal data to a third party without obtaining the person’s consent in advance.
[..中略..]
2 Notwithstanding the preceding paragraph, a business operator handling personal information may provide personal data to a third party if, at the person’s request, it will cease providing to third parties personal data by which that person can be identified, and if it has notified the person in advance of the following matters or has placed those matters in a condition where the person can readily learn of them:
(i) That provision to third parties is a purpose of use.
(ii) The items of personal data to be provided to third parties.
(iii) The means or method of provision to third parties.
(iv) That, at the person’s request, it will cease providing to third parties personal data by which that person can be identified.

In other words, if an opt-out is provided and the person has been “notified in advance, or the information has been placed in a condition where the person can readily learn of it,” personal data may be freely provided to third parties.

The problem is this phrase: “or has been placed in a condition where the person can readily learn of it.”

According to the METI Guidelines, a “condition where the person can readily learn of it” means a condition in which, if the person seeks to know, they can easily do so both in terms of time and means, using “a reasonable and appropriate method by which the content will be recognized by the person, according to the nature of the business and the circumstances in which personal information is handled…” One example given is that the information is continuously posted in a location reachable from the top page of a website in about 1 operation. I had thought that this provision referred to cases where the individual has an opportunity to interact with the business or service in question, but according to expert opinion, that apparently is not the case.

If so, this is an outrageous sieve—or rather, not so much a sieve as a pipe.

Even by common-sense standards, it is impossible to proactively discover, one by one, the websites of list brokers whose identities and locations are unknown. That can hardly be called a condition where the information can readily be learned. And it would be absolutely impossible if someone carried out a chain attack like the following.

Example attack:

Business A, whose business is providing data to third parties, provides it to a similar business B. B then provides it to C. Each creates a website and posts a notice 1 click away from it. This continues forever. Of course, all of these businesses have “properly acquired” the data from businesses whose business is providing it to third parties.

If this is permitted, the Act on the Protection of Personal Information has no effect whatsoever. On the contrary, it merely obstructs legitimate uses that properly limit their purposes, making it a harmful law that does nothing but damage and offers no benefit at all.

I want to believe that surely this cannot be the case… In any event, it would be unacceptable under the EU Directive… If so, it should cause enormous problems—unless Japan intends to isolate itself from the world, that is.

Or is the interpretation something like this?

Provision to third parties is permitted, but only for the purpose of providing the data to third parties. Acquiring it and using it to make sales calls or the like would constitute a change of purpose, requiring consent, and consequently the person would be notified at that point, so it should be fine.

In other words, this interpretation holds that controlling only the point of use should suffice, and that businesses engaged solely in providing data to third parties are nothing more than a means of transmission.

That sounds like sophistry…

Related posts