Survey of the Act on the Protection of Personal Information in Japan and International Standard Framework for De-identification

Abstract

This paper discusses the law definitions of de-identification, re-identification, anonymization, and pseudonymization based on Japan’s amendment act of the Act on the Protection of Personal Information. It also introduces the current international standardization trends in de-identification, including the standardized framework ISO/IEC 27559 and ITU-TSG17 X.1148, and related international standards, ISO/IEC 20889, etc. Personal data de-identified by anonymization or pseudonymization must be de-identified adequately before being used as part of publicly available big data sets. Dealing with Big Data and sensitive personal data requires knowledge and technical competence to maintain the appropriateness of that data. Many companies are implementing Big Data projects and need a sound legal understanding to develop in line with international standards to remain compliant with the ever-increasing regulatory risk requirements.