Japan, like many countries, is asking to what extent the right to privacy, a fundamental human right, should be sacrificed to control COVID-19.
On 3 April 2020, the Japanese Personal Information Protection Commission (PIPC) clarified that the processing or transfer of personal data without consent from the data subject is permitted under existing law in cases categorised as statutory exceptions. This can include measures aimed at preventing the spread of COVID-19, even if the individual was not originally notified of this purpose to, or if personal data is transferred to third parties (including government agencies).
As the COVID-19 outbreak becomes more severe, many countries are acquiring personal citizens’ data and monitoring their actions to prevent the spread of the virus. Prioritising the containment of COVID-19 over individual privacy rights in this was has proliferated, not only among ‘socialist’ states like China, but also in democratic nations including Israel, Italy and South Korea.
Human rights and civil society organisations from around the world have jointly called for governments to respect human rights laws when using digital surveillance technologies to track and monitor individuals and populations to combat the spread of COVID-19.
To date, Japan has taken a cautious stance on social controls. A state of emergency has been declared, but there has (at time of publishing) been no ban on going out. Only a ”request for self-restraint“ has been issued.
As more people become infected with coronavirus (mainly in metropolitan areas such as Tokyo and Osaka), and infection paths become more difficult to identify, containment of COVID-19 through the use of personal data has become an urgent issue in Japan.
At the end of March, the Japanese government asked major digital platform operators such as Google, Yahoo Japan and Amazon to share (on a voluntary basis) general user location data and usage information, with a view to implementing specific utilisation measures, such as identifying infection ‘hotspots’ where people gathering are more likely to become infected.
When is a data subject's consent not required in Japan?
The Act on Protection of Personal Information (Act No. 57 of 2003, the APPI) stipulates that: (a) when personal data is acquired, the purpose of its use must be clearly indicated to the data subject; and (b) processing of the personal data acquired must be within the scope of the purpose of its use.
In addition, in principle, when using personal data for purposes other than the notified purpose or providing it to a third party, the consent of the data subject is required. However, it is permitted to use and provide personal data to a third party in the following circumstances (Article 16.3 and 23.1 of the APPI):
- when it is necessary for the protection of the life, body, or property of an individual and it is difficult to obtain the consent of the data subject;
- when it is particularly necessary for improving public health and the data subject’s consent is difficult to obtain; or
- where it is necessary to cooperate with a state organ, a local government, or an individual or a business operator entrusted thereby in executing the affairs prescribed by laws and regulations and in which obtaining the consent of the data subject is likely to hinder the execution of the affairs.
The latest announcement by the PIPC did not change the interpretation or application of the law, but confirmed the following considerations concerning the prevention of the spread of COVID-19:
- if a government agency, municipality, or similar makes a request to prevent the spread of COVID-19, and if any of the above three conditions are met, a business operator (especially a major IT company) may use personal data obtained from smartphones, apps, etc for purposes other than those notified to the user, and transfer their personal data to a third party without their consent; and
- if an employee tests positive for COVID-19 and there is a high risk of contact with others in the course of their employment, their employer may provide their personal data to a third party outside the company who may have had contact with such employee without the consent of the employee if any of the three conditions above are met.
Privacy rights vs public health in Japan
It should be noted, however, that the latest announcement does not provide for unlimited transfer of personal data to governmental authorities or other third parties.
The scope of use of personal data and transfer to third parties beyond what has been notified to the individual is only permitted to the extent necessary to prevent the spread of COVID-19, to continue business activities, and to improve public health. It is important to fully examine whether there are any less restrictive alternatives after taking into account the degree of infringement on the privacy rights of individuals.
For example, Yahoo Japan has been asked by the Japanese government to provide users’ location data, and search history of words such as "fever" and "symptom" etc. Yahoo Japan agreed to disclose the data to the government subject to the following conditions: (a) the data provided is anonymously processed; (b) the purpose of its use is clear; and (c) the provision can be discontinued at any time.
Like Yahoo Japan, it will be necessary for businesses to consider carefully the scope of personal data to be transferred and the number of people receiving the personal data.
The PIPC may issue remedial orders if a company is considered to have unreasonably disclosed personal data of customers or employees beyond what is necessary. In some cases, customers or employees may claim damages for violation of their privacy rights.
Once personal data has been disclosed, it may prove extremely difficult to return to a pre-COVID-19 situation. Businesses should recognise that protection of privacy is a public interest that, once lost, may not easily be recovered.
