The government on Tuesday adopted a bill requiring companies to obtain consent from users when handing over personal data, such as internet browsing history, to third parties.
The bill, approved at a Cabinet meeting, requires consent when it is clear that the data can be traced to individuals by third parties.
The bill to revise the Act on the Protection of Personal Information comes after Recruit Career Co., the operator of the Rikunabi job information website, was found to have sold data predicting the odds of job-hunting students declining informal job offers. The data was based on personal information such as internet browsing history.
The bill also makes it easier for individuals to demand that businesses stop using their data. Under current laws, users can only seek to have the use of their personal information stopped or have such information deleted if the company is at fault, even when the data was acquired fraudulently.
The revision allows users to demand that use of personal data is halted when their personal rights and interests are at risk of being harmed, such as when data is stored even after the company has finished using it for its stated purposes.
Elsewhere, the bill calls for the pseudonymization of data, in which names and other personal information are replaced with markers.
Use of the technology will be limited to internal use in companies, such as for research and development. It will be exempt from the requirement to meet user demands for companies to stop using their data, thereby encouraging innovation within firms.
Punishment for failing to follow warnings issued by the government’s Personal Information Protection Commission will be raised, with the upper limit on fines for corporations being lifted to ¥100 million from the current ceiling of ¥300,000.