Japan's Privacy Complaints Reveal Little

Abstract

Japan’s Act on the Protection of Personal Information (the ‘PPI Act’) has been operational since 2005. What evidence is there of its effectiveness? One source of evidence in most jurisdictions is the reports by data protection authorities of the outcomes of complaints that have been investigated. Under the PPI Act, complaint about the handling of personal information by a business may be filed with one of four bodies. There are no specific provisions in the PPI Act allowing persons to make complaints to an authorized personal information protection organization (APIPO), local government department or (iv). The National Consumer Affairs Centre of Japan (NCACJ), or to the ‘competent minister’, nor to require that complaints are first made to the business concerned. The result is a complaint system characterised by vagueness and lack of concrete obligations on any parties. But complaints are made to these bodies, because complainants lack alternatives.

In financial year 2009, 8,559 complaints were lodged with either local governments or the NCACJ. The only examples of how complaints are resolved are found on the website of the National Consumer Affairs Centre of Japan. It gives summaries of 18 complaints from 2004-07 (of which 13 are relevant to the enforcement of the law), but none since then, which is of itself reason for concern. This paper concludes, based on translations of these summaries, that the NCACJ complaint summaries reveal little about whether this complaint system is effective. There is no indication that NCACJ ever investigates the factual issues necessary to come to a final conclusion about a complaint, so in many instances the reader is left with no idea whether there actually was a breach. When NCACJ does reach a conclusion in favour of a complainant, there is no indication whether the business concerned acted on that conclusion. In any other country, these summaries would be regarded with derision if presented by a complaint resolution body.

A study by Greenleaf published in 2010 by the European Commission, found that it was very difficult to assess the effectiveness of Japan’s data protection because the enforcement mechanisms were so vague, and because so little information was published about their outcomes. The system is comprehensively opaque. This study is consistent with that finding.

Keywords: privacy, Japan, data protection, complaints, consumers