Japan Business Law: Anonymously Processed Information
What is anonymously processed information?
Anonymously processed information is processed personal information from which it is impossible to identify a specific individual and restore the personal information.
When producing anonymously processed information, it is necessary to follow the processing standards below (Article 2, paragraph 9, Article 36 paragraph 1 of the Amended Act on the Protection of Personal Information, and an excerpt from Article 19 Enforcement Rules for the Act on the Protection of Personal Information)
Deleting a part or all of descriptions with which it is possible to identify a specific individual, such as name, address, date of birth date, etc.
Deleting all individual identification codes such as DNA, fingerprints, facial photographs and passport number etc.
Deleting member codes, IDs etc. which can be linked with name, address etc.
Deleting unique information such as unusual blood type and medical history
Deleting location information with which it is possible to specify home address or work place (deletion of records and cells)
By deleting all of these information, the information will be inapplicable as personal information but become anonymously processed information. The information can be provided to a third party without consent.
There are also strict provisions for the handling of anonymously processed information
Under the Amended Act on the Protection of Personal Information in May 2017, new obligations were imposed on companies who create anonymously processed information and companies who receive and use information, respectively.
【Production/provision of anonymously processed information】
When personal information handling companies produce anonymously processed information, personal information must be properly processed in accordance with the Article 36 paragraph 1 of the Amended Act on the Protection of Personal Information.
In addition, personal information handling companies are obligated to “have security controls to prevent the leakage of processing methods and deleted personal information to produce anonymously processed information”; “disclose to the public the categories of information relating to an individual contained in the anonymously processed information” and “are prohibited from collating anonymously processed information with other information in order to identify an individual”
Furthermore, personal information handling companies, when providing the anonymously processed information to a third party, shall disclose to the public the categories of information concerning an individual contained in anonymously processed information to be provided to a third party and its providing method, and state to the third party explicitly that the information being provided is anonymously processed information.
【Utility of anonymously processed information】
Anonymously processed information handling companies are prohibited from acquiring the information related to processing method of anonymously processed information and collating anonymously processed information with other information in order to identify an individual.
Anonymously processed information handling companies, regarding the handling of anonymously processed information, shall strive to deal appropriately and promptly with any complaints and establish a system necessary to achieve the proper handling of anonymously processed information.
Rules for the protection of personal information are frequently reviewed due to the development of the information society. It is hard to be excused with “I did not know”, so try to have regular confirmation and consultations with lawyers and other specialists.