In 2019, the EU and Japan recognised each other’s data protection systems as “equivalent”(1). The Act on the Protection of Personal Information (APPI) was amended successively in 2020 and 2021, and the first review of the Japan-European Union (EU) mutual adequacy arrangement was concluded on April 4, 2023(2). While the APPI has developed generally, discussions on individual areas are underway.

Privacy violations by third-party cookies result in law amendment

The APPI does not require an individual’s prior consent to the collection of their personal information, except for sensitive information (Article 20(2)), and interpretations of the APPI as to whether or not an online identifier, such as a cookie constitutes personal information differs on a case-by-case basis.