Japan to Tighten Regulations on Overseas Leak of Citizens' Sensitive Data Over Spying Concerns

The Japanese government plans to significantly strengthen the management of entities handling data to prevent the overseas leakage of personal information in sensitive sectors such as finance and healthcare.

The initiative aims to prevent the personal information of public and private sector personnel handling security-critical information from being leaked and exploited for espionage activities by foreign nations. The Japanese government is expected to actively step into information management regardless of whether the data owners consent.

According to the Nihon Keizai Shimbun today (October 18), the Cabinet of Sanae Takaichi and the ruling party plan to pursue an amendment to the Economic Security Promotion Act, which strengthens personal information protection, during the ordinary session of the Diet convened in January next year.

The amendment will require businesses and institutions handling genetic information or personal data related to the medical and financial sectors to verify the identities of cloud service providers or third-party recipients when newly introducing information storage systems like the cloud or providing data to third parties.

Biological samples such as blood, which are essential for the research and development of new drugs and treatments, as well as medical records, will also be included under the protection targets.

Target entities mentioned for the bill include financial institutions, credit information companies, credit card companies, research institutions such as universities, pharmaceutical companies, and medical facilities.

If these companies or institutions commission the storage of Japanese citizens' personal information or transfer data to a foreign government or an organization under its influence, they will be required to submit a preliminary report to the Japanese government detailing the type and content of the information.

The Japanese government plans to empower authorities to issue suspension orders or recommendations if security risks are identified at the locations where data is stored or provided.

This was modeled after the U.S. government's case, which uses the Information and Communications Technology and Services (ICTS) supply chain regulations to ban or halt transactions involving products supplied by businesses under the influence of specific nations threatening U.S. security, such as China, Russia, North Korea, and Iran, when risks are discovered.

The newspaper explained that the Japanese government intends to prevent the financial and debt statuses of individual Japanese citizens and medical-related information from leaking or being exploited by countries like China and Russia.

The commentary noted that this is mindful of cases such as Chinese intelligence agents approaching a former U.S. Central Intelligence Agency (CIA) employee struggling with credit card debts to extract classified information, or an Italian Navy official with a severely ill child handing over classified documents to Russia in exchange for money.

Until now, sensitive personal data such as medical information in Japan has been permitted to be provided to third parties under the Personal Information Protection Act based on individual consent. However, once the amendment to the Economic Security Promotion Act passes, the Japanese government is expected to step in to protect personal information for national security purposes regardless of individual consent.

The Nihon Keizai Shimbun pointed out that as dual-use technologies applicable for both military and civilian purposes advance, the targets of foreign espionage activities are expanding beyond government officials to include private citizens.
※ Please note: This article was translated by AI and may contain errors.