On May 1, the Personal Information Protection Committee in Japan (PPC) released guidance (only available in Japanese) on the use of contact tracing mobile apps (Apps) as one of the mechanisms to combat the spread of COVID-19 and highlighted five essential consideration points. Specifically, the PPC recommends that all “personal information handling business operators” carefully consider, and disclose their practices on, the following points in connection with Apps:
- Obtaining consent of individuals upon conspicuous disclosure of the processing purposes, including any collection of “special care-required personal information” and disclosure of personal data to third parties, with particularity and in an easily-understandable manner.
- Eschewing from collecting or disclosing data not necessary for the processing purposes.
- Implementing a mechanism to delete data, without delay, when they are no longer necessary for the processing purposes to avoid unnecessary retention of data.
- Securing data and supervising employees and vendors.
- Establishing a method to handle user inquiries and complaints.
In the guidance, the PPC acknowledges the potential benefits of Apps, if these Apps are widely adopted, as well as the role of collaboration between public and private sectors in combatting the spread of COVID-19. However, the PPC stresses the necessity of striking the appropriate balance between the protection of individuals’ privacy rights and the value of the information for public safety purposes. To achieve this balance, the PPC recommends trust building with App users by focusing on transparency and information safeguards.
The PPC also notes that information processed by these Apps may not be necessarily subject to the Act on the Protection of Personal Information (APPI) in Japan. However, whether certain information is subject to the APPI depends on other types of information businesses may already hold, and the PPC advises that each business review the potential impact of each App usage.
