2.2k VIEWS
Pinterest LinkedIn LINE

Now, regarding the obligation to keep records of third-party provision that I pointed out on 3/12[1], I subsequently learned a great deal from people at the Cabinet Secretariat’s IT Office, whom attorney Itakura introduced to me on April 1, so I would like to share what I learned. Incidentally, they told me this strictly in a personal capacity; it is not the official view of the IT Office. Please read this while keeping in mind that their interpretation could quite conceivably be overturned later.

1. Was this not intended as a measure against list brokers, with cases involving the person’s consent excluded?

In the 3/12 article, I wrote that this was probably a bug, but it seems that I was mistaken. According to what I heard, the failure to exclude cases where the person has consented was intentional. They believe traceability is necessary for all third-party provision, and because the record-keeping obligations in Articles 25 and 26 of the bill are intended to ensure that traceability, the provisions were drafted to cover cases involving consent as well.

Thus, somewhat surprisingly, it was not a bug.

2. If so, the provider would also have a record-keeping obligation for public SNS profile pages and the like, but is that realistic?

A public SNS profile page is generated by first recording information entered by the person or others in a database and then extracting and processing information from that database. Naturally, the person has consented to the displayed items. Because the page uses information recorded in a searchable form in a database, what is displayed constitutes personal data. As an example, Figure 1 shows a screen capture of the author’s public Google+ page.

+NatSakimura/about
(Figure 1) The author’s Google+ profile page

 

A third party then views this page. Because the viewer is a third party, the SNS provider is subject to the obligation to keep a record of the provision. I confirmed this point with them as well, and they said that this was indeed the case.

We spent some time considering whether this is a type of strict regulation not implemented in other countries and whether it might suppress industry.

As stipulated in new Article 25, the items subject to the record-keeping obligation are “the date on which the personal data was provided, the name of the third party, and other matters prescribed by rules of the Personal Information Protection Commission.”

Article Twenty-Five: When a personal information handling business operator provides personal data to a third party (excluding persons listed in the items of Article Two, paragraph five; the same applies in this Article and the following Article), it must, as prescribed by rules of the Personal Information Protection Commission, prepare a record concerning the date on which the personal data was provided, the name of the third party, and other matters prescribed by rules of the Personal Information Protection Commission. However, this does not apply when the provision of the personal data falls under any of the items of Article Twenty-Three, paragraph one or paragraph five (or, in the case of personal data provided pursuant to the preceding Article, any of the items of Article Twenty-Three, paragraph one).
 2 A personal information handling business operator must retain the record referred to in the preceding paragraph for the period prescribed by rules of the Personal Information Protection Commission from the date the record was prepared.

The issue that day was whether it was realistic to obtain a person’s or entity’s name. Their view was that ordinary logging would suffice, because one would presumably keep records identifying who viewed a page, and that “if you have the IP address, you should be able to determine the viewer’s name.” I explained, however, that “with a public profile page or timeline, you do not know which user is viewing it, and even if you look at the IP address, you cannot necessarily tell whose it is or which company it belongs to.” They seemed to understand that recording names, addresses, and similar information would be unrealistic.

At the time I thought the problem was the phrase “the name,” but on rereading it closely today to write this article, I noticed that it says “the name and other matters prescribed by rules of the Personal Information Protection Commission,” not “the name and other matters prescribed by rules of the Personal Information Protection Commission.” In other words, it can be read as “(the personal name) or (the entity name and other matters prescribed by rules of the Personal Information Protection Commission),” with “entity name and other matters prescribed by rules of the Personal Information Protection Commission” constituting 1 phrase[2]. If so, an IP address alone could, for example, be designated as one of the “entity name and other matters prescribed,” and the IP address in the logs might suffice. The page address recorded in the logs would, however, need to make clear which personal data it contains, so there would probably be quite a few cases requiring system modifications.

3. Furthermore, the recipient would have an obligation to keep acquisition records for public SNS profile pages and the like, but is that realistic?


[1] Nat Sakimura, “【Amendment of the Act on the Protection of Personal Information】Anonymously Processed Information and Records of Third-Party Provision”http://www.sakimura.org/2015/03/2924/2/ (2015/3/12)

[2] Based on Toshihiro Yoshida, “Techniques for Reading and Learning the Law, Taught by a Former Legislative Bureau Official [2nd Edition]”. I also asked attorney Itakura (through Dr. Takagi of AIST) and Professor Suzuki (directly) about this interpretation. Attorney Itakura’s view was: “Both ‘personal name OR matters prescribed by rules (including entity name)’ and ‘matters prescribed by rules (including personal name OR entity name)’ are possible. In a phrase such as ‘A or B and other C prescribed by rules,’ A and B are examples and may not be included.” Professor Suzuki, by contrast, took the view that “even if it is theoretically an illustrative enumeration, placing typical examples at the beginning of the statutory text and then operating on the basis that they may be omitted would prompt the reaction, ‘What?’ That seems implausible.” It is a difficult question.

Related posts