How Businesses Should Prepare For Japan's New "My Number" Individual Identification Number System
Kazue Tanaka, Bengoshi
Beginning October 2015, individual identification numbers (colloquially known as “My Numbers”) promulgated pursuant to Article 7, Section 1 of the Acts for Individual Identification Number for Administrative Procedure (Law No. 27 of 2014 as amended; hereinafter “Number Law”) will begin to be distributed to all persons with a registered residence in Japan by local governments across the country.
The intent is to have a centralized “My Number” system to better link individuals to his/her tax and social welfare information on file with national or local governments; each My Number shall be treated as highly confidential information. Accordingly, all business entities will be required to handle My Number data carefully under the Number Law as well as pursuant to the Personal Information Protection Law (Law No. 57 of 2003 as amended; “PIPL”).
In this memorandum, we will outline the points which business entities should be aware of when handling My Number data.
1. Overview of Mandatory My Number Rules for Businesses
(1) Involvement of Businesses with the My Number System
Each business has a legal obligation to prepare its employees’ wage statements, payment records, health insurance/social insurance papers, etc. (the “Documents”). As such, businesses with employees should be involved with the My Number system in the following situations:
Upon collection of My Number data and concurrent identity verification;
Storage of My Number data;
Inscription of My Number data onto the Documents; and
Submission of the Documents and Storage of copies of the Documents.
There may be many businesses that outsource the preparation of the Documents to professional service providers. However, outsourcing does not absolve a business from being subject to the mandatory rules, and as such businesses are required to supervise the outsourced work and ensure compliance of the mandatory rules by each service provider (Number Law Article 11).
(2) Legal Requirements Applicable to Businesses
The Number Law and the PIPL list the following items as requirements applicable to businesses.
(a) Restrictions on the Use and Procurement of My Number data
My Number data cannot be sought for purposes other than the purpose of creating the Documents (Number Law Article 15).
Prescribed methods of identity verification, such as verifying by a My Number Card, shall be conducted upon obtaining My Number data (Number Law Article 16).
The purpose for collecting the My Number data must be communicated to the individual (PIPL Article 18 Section 1).
(b) Restrictions on the Administration of My Number data
Appropriate Measures must be put in place to prevent the loss or leakage of the My Number data (Number Law Article 12).
Employees who handle the My Number data must be supervised (PIPL Article 21).
When handling of the My Number is outsourced, the outsourcing party must supervise the handling of the numbers by the contractor (Number Law Article 11).
(3) Compliance with the Guidelines
Among the requirements listed above, the requirement that “appropriate measures be put in place to prevent loss or leakage” of the My Number data is abstract, and it is not clear at this time what concrete measures must be put in place. Also, another problem is what measures need to be taken internally at a business in order to have the entire business deemed to be in compliance with the requirements.
In order to deal with this problem, the Special Committee on Personal Information Protection, established pursuant to Number Law Article 36, has published guidelines (the “Guidelines”). There are some circumstances where businesses must follow the Guidelines, as the Guidelines state that violation of some of these Guidelines will likely be interpreted as a violation of the law.
The Guidelines are varied and detailed and require, in part, that businesses should (a) provide clarity as to which business and which persons are engaged in the business activity of collecting and handling the My Number data, (b) create essential principles on My Number data protection and (c) create rules on collection and handling. The Guidelines also illustrate matters which should be examined by businesses upon its outsourcing of My Number related work. Incidentally, there are different (less onerous) regulations for Small and Medium sized Enterprises, defined as companies with 100 people or less.
At first glance, handling My Number data may appear to be done easily by a HR department, as the main requirements are (a) not keeping and using the My Number data other than for situations allowed by law and (b) not leaking the My Number data. However, there may be situations where many employees other than HR staff might have access to the My Number data, as the My Number data might be utilized not only for matters related to the Documents mentioned above but for payments by businesses for service fees such as translation fees. Thus in order to meet the requirements described above, it is important to set internal rules on handling My Number data and notify and ensure such rules are known to all employees.
In addition, outsourcing service providers of My Number related work appear to now be aggressively promoting their services and so it is advisable that businesses thoroughly understand the Guidelines, in order to choose an appropriate service provider under the appropriate terms and conditions.
We suggest that businesses prepare for the introduction of the My Number system in a systematic manner, by appointing persons in charge and setting milestones.
Should you wish to discuss any of the issues outlined in this memorandum, please do not hesitate to contact any of the attorneys at our firm or the contact person listed below.
Kazue Tanaka, attorney in Japan: email@example.com
My Number data is also deemed to be “Personal Information” and thus needs to be protected under the Personal Information Protection Law (See Article 2 Section 1 of the PIPL.) Therefore both the Number Law and the PIPL apply to the handling of My Number.