The Personal Information Protection Act ("the Act") applies to government or private entities that collect, handle or use personal information. The Act, however, does not apply to persons and companies who handle the personal information of less than 5,000 individuals. Those parts of the Act affecting the private sector will come into force on April 1, 2005.


Requirements
According to the Act, an entity handling personal information must:
• Specify its purpose for collecting and using personal information
• Not acquire information by fraudulent or other unfair means
• Promptly notify the data subject of the purpose for which their personal information will be used, or otherwise announce the purpose for use
• Ensure that personal data are kept secure from loss and unauthorized access and disclosure
• Refrain from supplying personal data to third parties without the prior consent of the individual concerned, except in certain defined circumstances (presumably the restrictions on providing information to third parties covers transfers both inside and outside the country)
• Respond to data subject requests for correction, supplementation or deletion of personal data
• Respond to data subject requests that an entity cease using personal data altogether
• Endeavor to appropriately and promptly handle individual complaints about the handling of personal information. Businesses must also endeavor to set up an internal complaint-handling system
Privacy & Security Risks
Because of these factors, organizations operating in Japan must include privacy and data protection concerns in their strategic planning process to avoid fines, law suits, regulatory penalties, and disruption of data collection, use or trans-border transfers, or a damaged reputation. Also, many companies are striving to realize competitive advantages by establishing a privacy and data protection framework that enables e-business efforts while addressing privacy and security regulatory requirements.
Advanced Healthcare Solutions Japan Co.,ltd(AHSJ) can assess the current state of your compliance with Japan's new Personal Information Protection Act, develop and implement solutions, and monitor your ongoing security and privacy posture. Working with you we can raise the awareness on matters related to Japan's new law, as well as other security and privacy issues within your organization. Privacy Council offers a wide range of privacy and security services to organizations operating in Japan:
• Privacy and/or security assessments
• Web site seculity
• Development of Gap analysis and collection plan
• Implementation of privacy/security programs
• Development or review of privacy and security policies and procedures
• Management/employee level awareness and training programs on privacy and security issues, policies, and procedures
• Premium access to the Privacy Knowledge Base™
For more information about regulatory compliance or to speak with a consultant, call 0120-54-0143, 81.3.5754.1160(outside).