Japan: Telecommunications Business Act amendments introducing new regulations for cookies and user identification information

In brief

On 13 June 2022, the Amendment of the Telecommunications Business Act ("Amendment") was enacted. The Amendment includes new regulations for the use of personally identifiable information and other information related to individuals, including cookies. Telecommunication service providers subject to the Amendment will be required to take measures based on the relevant ministerial orders to be enacted by the Ministry of Internal Affairs and Communications (MIAC) in the near future.

Regulations on the provision of user information to third parties, including cookies

Under the Amendment, when certain telecommunication service providers (to be stipulated in a forthcoming MIAC ministerial order) intend to send user information falling under the new regulations to a third party, they will be obliged to give the user an opportunity for confirmation.

The scope of the user information subject to this requirement will also be defined in a future MIAC order. So-called third-party cookies are a conceivable example, while first-party cookies and information related to a user's OS, screen settings and language settings are expected to be excluded.

After the Amendment comes into effect, prior to transmitting regulated user information to third parties, a telecommunication service provider subject to the new regulations must: (1) notify the user or make information regarding transmission of user information to third parties readily accessible to all users, (2) obtain the user's consent or (3) take opt-out measures. The details of each measure will also be defined in a forthcoming MIAC order.

Obligations for the proper handling of Specific User Information

Under the Amendment, telecommunication service providers that exceed a certain size may be designated by MIAC as businesses that are obliged to properly handle information protected by communication secrecy and certain user identification information ("Specific User Information"). Designated service providers are required to:

  • Create and notify users of information handling regulations for Specific User Information;
  • Formulate and publish an information handling policy to indicate the contents of collected Specific User Information and the purpose and method of its use;
  • Self-evaluate the status of information handling and revise the information handling regulations and information handling policy based on said evaluation; and
  • Appoint and notify a general manager of Specified User Information.

The subject industry and carrier size have yet to be determined. However, a threshold of over 10 million users is currently being considered as a criterion.

Other amendments

In addition to the above, the Amendment also introduces the following new regulations:

  • Telecommunication service providers will be required to report to the minister of MIAC in the event of a business suspension or leakage of certain information.
  • Carriers that provide search services or equivalent intermediary telecommunication services (e.g., providers of online search engines and SNS networks) will be required to file notification of their telecommunication businesses.
  • No carriers that provide certain wholesale telecommunication services (e.g., major mobile carriers and certain landline providers) may refuse a provision of their service in their business zone and a disclosure of information regarding conditions of service contracts without legitimate grounds.

Possible impact on businesses

Although the effective date of the Amendment will be determined in a MIAC order, it is expected to come into force no later than 16 June 2023. Telecommunication service providers should keep an eye on the enactment of the relevant ministerial orders and confirm whether they are in fact subject to the new rules under the Amendment.

Furthermore, subject telecommunication service providers will need to prepare for public announcements regarding the use of data — such as third-party cookies — in advance of the effective date. It is therefore essential that service providers closely monitor the MIAC orders enacted, determine whether they engage in any data processing subject to the Amendment and if so, update their current privacy policies and take other necessary measures.

Cookies and other information related to individuals which does not by itself identify a specific individual that can enable an individual to be identified when correlated with other information is regulated as personal information under the Act on the Protection of Personal Information (APPI). Also, if a business transfers such information to a third party that can then identify an individual even when the transferor cannot, the APPI applies and the transferor is required to confirm that the recipient has obtained the individual's consent. Therefore, in summary, even if data processing does not fall under the Amendment's new regulations, it may still be regulated under the APPI currently in effect.

When a telecommunication service provider is designated as subject to the Specific User Information regulations, it is required to take certain steps, including creating and notifying users of its information handling regulations. Accordingly, telecommunication service providers should pay close attention to the criteria for such designations to be issued by the minister of MIAC.


Copyright © 2024 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.