Personal Information Protection Law -How to deal with leakage of personal information-
In recent years, there has been a growing interest in personal information, but at the same time, there has also been an increased scrutiny of leakage of personal information. In the event of a leakage of personal information, the following actions are primarily required.
1. How to deal in case of leakage
In the event of a leakage of personal information, it is important not only to identify the cause and prevent recurrence, but also to make appropriate disclosure as soon as possible. In addition to reporting to the Personal Information Protection Commission and notifying the individual, in some cases, explanations to shareholders, press releases, etc. are also required. If these countermeasures are made incorrectly, they can result in a “blow up”.
2. Reporting to the Personal Information Protection Commission and notification to the individual in the event of a leakage
In addition, in accordance with the revision of the Act, from April 1, 2022, in the event of a leakage of personal information, notification to the Personal Information Protection Commission or the individual (i.e., the specific individual identified by the personal information) may be required (Article 26 of the Act on the Protection of Personal Information).
According to the annual report for fiscal year 2020, there were 4,141 reports of leakage to the Personal Information Protection Commission in fiscal year 2020, which is, although, a statistic from before the establishment of this article (※1).
Thus, a considerable number of leakages have been reported to the Personal Information Protection Commission alone, and it is estimated that a considerable number of leakages have occurred, including those that have not been officially reported.
(※1 https://www.ppc.go.jp/aboutus/report/annual_report_2020/ Chapter 2, Section 3, Referred on January 14, 2022)
3. Compensation for damages in the event of leakage
If personal information is leaked, the subject of the leakage may claim compensation for damages.
The amount of damages for information leakage is calculated in consideration of various factors, as determined by the Osaka High Court rendered on November 20, 2019.
“In considering whether or not a person whose personal information has been leaked to the outside has suffered mental anguish and the amount that is reasonable to compensate for the mental damages suffered when his or her privacy has been infringed, a judgement should be made by comprehensively considering the circumstances that emerged in this case, including the content of the leaked personal information, the extent of the leakage, whether any actual damage has occurred, and the measures taken by the person who had control of the personal information.”
Even if the amount of damage per person is small, if the number of persons whose information is leaked is large, the amount of damage will be large.
Recent statistics on the amount of damages show that the average estimated damages per person is 29,768 yen (average estimated damages per leakage case is 637,670,000 yen) (※2).
(※2 Japan Network Security Association “2018 Survey Report on Information Security Incidents [Preliminary]” Referred on January 14, 2022
https://www.jnsa.org/result/incident/2018.html)
4. Consultation with an Attorney
In the unlikely event of a leakage of personal information, please contact us as soon as possible so that we can take appropriate initial action and provide legal support to minimize the damage.
