Japan introduces new rules on biometric data in APPI amendment bill

Amendments are coming to Japan’s Act on the Protection of Personal Information (APPI). The country’s cabinet has approved a bill that introduces new consent exemptions, enhanced protections for minors, obligations for facial recognition data, and new enforcement powers that come with fresh fines.

The Register reports that the Bill to Amend Part of the Act on the Protection of Personal Information (APPI) mixes more enforcement power with a slackening of regulations on AI, in a move to make Japan, in the words of Minister for Digital Transformation Hisashi Matsumoto, “the easiest place in the world to develop AI apps.”

Specifically, the legislation expands consent exemptions for statistical and AI-related processing, and relaxes them for “low-risk or socially beneficial processing” – intentionally broad classifications that Matsumoto hopes will spur investment and kickstart Japan’s digitization efforts.

The approach is to be more permissive – at least for individuals over 16 – but to make violations hurt more. Fines can equal any profit a company makes from improperly using data, but are unlikely to be levied unless mass violations have occurred.da

There are also new fines for obtaining data through fraudulent means.

Parental consent requirements for kids’ data; disclosure for FRT

For child safety, collecting the biometrics of a child aged under 16 will now require explicit parental approval, and a “best interests” test will apply in cases of data that describes minors. Organizations will be required to prioritize kids’ best interests when handling their data. The rule applies to any sensitive personal information, including facial images.

Per DataGuidance, amendments covering facial recognition apply new restrictions and transparency rules, requiring organizations to “publicly disclose specified handling information.”  An opt-out mechanism for third-party provision will be prohibited.

Article Topics

AI  |  biometric data  |  children  |  data protection  |  facial recognition  |  Japan  |  regulation