Recent updates to Japan Personal Information Protection Law

Japan tax tax alert 6 April 2022

The Personal Information Protection Law (“PIPL”) in Japan was recently revised to provide customers with additional disclosures when reporting their personal information to a third party outside of Japan. These revisions are scheduled to come into effect from April 2022 and may be relevant to financial institutions in Japan if they are required to submit FATCA reporting of their US account holder information to the IRS. In such case as the personal information of customers is being reported to a third party outside of Japan, financial institutions in Japan reporting to the IRS are required to disclose certain information about where the personal information is being reported to and obtain customer consent prior to reporting. The revisions to PIPL in Japan relevant to FATCA reporting to the IRS are summarized as follows:

 I. Disclosures required to be made to customers when reporting their personal information

1. Name of the country/jurisdiction of the third party
2. Purpose and usage by the third party
3. Content and type of personal information
4. Description of the regulatory or legal framework in place in a country/jurisdiction to protect personal information for comparative purposes with equivalent PIPL law in Japan
5. Description of measures taken by the third party to protect personal information for comparative purposes with a Japan party/operator subject to PIPL law in Japan

II. Consent required to be obtained from customers on the above disclosures before reporting their personal information

Financial institutions in Japan are required to provide the above disclosures to their customers and obtain their consent to the disclosures before reporting their personal information to third parties outside Japan.

Under Japan FATCA model 2 IGA, customer consent is generally being obtained for customers who are US account holders before reporting their personal information to the IRS. Currently such customer consent forms only include the first three disclosures above:
(1) Name of the country/jurisdiction of the third party
(2) Purpose and usage by the third party
(3) Content and type of personal information

Financial institutions in Japan should ensure that the remaining two disclosures are also provided to their customers when obtaining their consent for reporting to the IRS:
(4) Description of the regulatory or legal framework in place in a country/jurisdiction to protect personal information for comparative purposes with equivalent PIPL law in Japan
(5) Description of measures taken by the third party to protect personal information for comparative purposes with a Japan party/operator subject to PIPL law in Japan

Information for the disclosures in points 4 and 5 above should be obtained from the governments and third parties in the relevant countries/jurisdictions using reasonable means such as publicly available information and other appropriate sources. The information obtained for the disclosures should generally be consistent with the OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (“OECD Privacy Guidelines”) and PIPL in Japan.

For purposes of FATCA reporting by financial institutions in Japan to the IRS, the US regulatory and legal framework with respect to protecting personal information are generally considered to be consistent with OECD Privacy Guidelines and PIPL in Japan (based on publicly available information on relevant US laws), and the measures taken by the IRS to protect personal information are also generally in line with the OECD Privacy Guidelines (based on publicly available information from the IRS).

Financial institutions in Japan are required to incorporate the revised disclosures in their customer consent form from April 2022. EY Japan is providing assistance to financial institution clients to update their customer consent forms for the recent revisions to PIPL in Japan