Japan
Act on the Protection of Personal Information (APPI)
Japan's APPI was significantly amended in 2022 to strengthen protections for biometric data. Facial recognition data is classified as personal information requiring a specified purpose of use and individual consent for collection. The PPC has issued specific guidance on facial recognition technology, emphasizing the need for transparency and purpose limitation. Japan also has an EU adequacy decision, meaning data can flow freely between the EU and Japan.
Key Provisions
- Facial recognition data qualifies as personal information under APPI
- Businesses must specify and publicly disclose the purpose of use
- Consent required for use beyond the specified purpose
- Cross-border transfer rules require consent or equivalent protections
- PPC guidance specifically addresses facial recognition in retail and public spaces
- 2022 amendments added mandatory breach notification and strengthened individual rights
Your Biometric Rights
- Right to disclosure of retained personal data
- Right to correction of inaccurate data
- Right to cessation of use (deletion)
- Right to cessation of third-party provision
- Right to be informed of the purpose of use
Penalties for Non-Compliance
Criminal penalties: up to 1 year imprisonment or ¥1 million fine for individuals; up to ¥100 million for corporations. PPC can issue recommendations and orders; non-compliance with orders is criminally punishable.
Our Removal Process
We submit cessation-of-use requests under APPI. Japanese privacy law gives individuals the right to demand operators stop using or delete their facial data. We file requests with each operator and monitor compliance within the statutory timeframe.
Get Protected