Tech⁠, IP and Telecoms Law Newsletter Vol⁠.20 March 2026

On January 9, 2026, the “Policy for Revising the Personal Information Protection Act⁠: The So-called Triennial Review” (the “Reform Policy”) was published. The Reform Policy sets out the fundamental direction for the next round of amendments to the Act on the Protection of Personal Information (the “APPI”), and constitutes a significant release with practical implications. A notable recent development is that the agenda item entitled “Bill for Partial Amendment of the Act on the Protection of Personal Information and Related Laws“ was taken up at the 352nd meeting of the Personal Information Protection Commission (the “PPC”) held on March 18, 2026. With respect to this agenda item, the PPC stated that “the relevant materials as approved by the Cabinet will be posted separately following the Cabinet decision.” Although the text of the bill itself has not yet been publicly confirmed as of the date hereof, it is apparent that substantive work toward the formulation of the bill has progressed considerably since the publication of the Reform Policy, and the matter warrants continued close attention.

The following provides an overview of the Reform Policy. For further details, please also refer to the Reform Policy itself and the illustrated explanatory materials published (in Japanese) by the PPC Secretariat.

（1）　Promotion of Appropriate Data Utilization
①　The data subject’s consent shall not be required for the provision of personal and other data to third parties, or for the acquisition of publicly available special care-required personal information, where such data is used solely to create statistical information or support related research and reporting activities (including AI development and similar activities that can be classified as statistical production and evaluation).¹

②　Relaxation of restrictions on purpose-exceeding use, acquisition of special care-required personal information, and provision to third parties:

• The data subject’s consent shall not be required where, in light of the circumstances of acquisition, it is evident that such handling does not contravene the data subject’s intent and therefore does not harm their rights or interests.²
• The consent requirement shall be relaxed in cases where personal information is handled for the protection of life or similar interests, for the improvement of public health, or the like, and obtaining consent is difficult.³
• It shall be expressly stipulated that “academic research and other institutions” eligible for the academic research exception include institutions or organizations whose purpose is the provision of medical care.

（2）　Regulations Proportionate to Risk
①　Introduction of regulations concerning the handling and related matters of personal information of minors under the age of 16:

• It shall be expressly provided that the obtaining of consent, provision of notice, and similar actions shall be directed to the statutory representative (legal guardian) of the relevant data subject.
• The requirements for requests for cessation of use or other handling of retained personal data shall be relaxed.
• A duty provision shall be added requiring that the data subject’s best interests be given primary consideration in the handling and related matters of personal information of minors.

②　With respect to facial feature and other such data, it shall be made mandatory to publicly disseminate certain information concerning the handling thereof; the requirements for requests for cessation of use or other handling shall be relaxed; and provision to third parties based on the opt-out system shall be prohibited.
③　The obligations concerning the proper handling of entrusted personal and other data by business operators that have been entrusted with data processing and similar activities shall be revised.⁴
④　In the event of a data breach or similar security incident, the obligation to notify the data subject shall be relaxed where there is little risk of harm to their rights or interests.

（3）　Prohibition of Improper Use and Wrongful Acquisition
①　Improper use and wrongful acquisition shall be prohibited with respect to information that, although not constituting personal information, enables targeted contact with or influence on specific individuals.
②　Under the system that permits provision to third parties without consent on condition that such provision will be ceased at the data subject’s request (the “opt-out system”), it shall be made mandatory to verify the recipient’s identity and purpose of use.

（4）　Regulations to Ensure Effective Compliance
①　The requirements for issuance of orders shall be revised to enable prompt correction of violations; furthermore, provisions shall be developed to enable the PPC to issue recommendations and orders requiring that measures necessary for the protection of data subjects’ rights and interests be taken, including notification to data subjects of facts pertaining to any violation or public disclosure thereof.
②　A statutory basis shall be established for requesting third parties who aid or abet violations to take measures necessary for the cessation of such violations.
③　Expansion of the scope of punishable offenses and strengthening of criminal penalties.⁵
④　In order to effectively deter egregious violations involving the handling of large volumes of personal information where economic incentives exist, a surcharge system shall be introduced whereby, in cases where the rights and interests of individuals have been infringed as a result of serious violations, payment of surcharges equivalent to the pecuniary and other benefits obtained through such violations shall be ordered (introduction of the surcharge system). 

From February 18 to March 19, 2026, the Ministry of Economy, Trade and Industry (METI) published⁷ the “Guidelines on the Interpretation and Application of Civil Liability in AI Utilization (Draft)” (in Japanese) (the “Guidelines”), which summarize the issues and perspectives regarding interpreting and applying tort liability and related laws in the context of AI utilization, and solicited public comments. The final version of the Guidelines will be determined based on the public comments received; therefore, businesses should continue to monitor the latest developments.

The Guidelines use basic hypothetical scenarios in which AI-based services or systems contribute to accidents, and primarily examine and organize issues and approaches regarding interpretation and application from the perspective of tort and other relevant laws.^8,9  Accordingly, we provide the following overview of the Guidelines.

In the Guidelines, when examining tort liability related to the use of AI, the technology is classified into two categories: (i) AI intended to involve human judgment or action at the final stage (Assistive/Supportive AI); and (ii) AI provided on the premise of replacing all or part of human judgment or action and intended to be used in reliance on the AI’s own judgment (Reliance/Substitute AI). The analysis is conducted separately for users and for developers/providers of each type of AI, incorporating hypothetical examples. An overview of the two categories, along with the general approach to determining responsibility for each, is summarized in the figure below. For further details, please refer to the Guidelines or our firm’s March Data Security Newsletter March 2026 (in Japanese).
 

In addition to the substantive legal issues discussed above, the Guidelines also examine evidentiary matters and procedural issues arising in the context of international disputes.

On January 23, 2026, the Study Group on the Promotion of the Utilization of Medical and Related Information (the “Study Group”), established within the Cabinet Office, published an “Interim Report” (in Japanese) (the “Report”).

With respect to medical data, in addition to its primary use aimed at improving the quality of medical care, it is important to further facilitate its utilization (secondary use) by researchers, companies, and other entities to contribute to the research and development of effective methods of treatment, pharmaceuticals, and medical devices, as well as the establishment of effective and efficient medical care delivery systems. In light of the fact that both the “Priority Policy Program for the Realization of a Digital Society”¹² and the “Regulatory Reform Implementation Plan”¹³ have identified, as matters for consideration, the formulation of a grand design and the development of a legal framework for facilitating the secondary use of medical data, the Study Group has been convened eight times since September 2025. The Interim Report constitutes an interim compilation of the status of such discussions.

The Interim Report first sets forth as the fundamental philosophy regarding the utilization of medical and related information, the envisioned state of society to be achieved, as well as the basic concepts and directions. It refers to the approach underlying the EU’s European Health Data Space (EHDS) Regulation, and indicates that it is important to adopt a perspective that captures primary and secondary uses in an integrated manner. In addition, with respect to the five principal issues identified as key points of discussion by the Study Group—(i) the scope of medical and related information; (ii) methods of collection of such information; (iii) the protection of patients’ rights and interests and the protection of information; (iv) the structure of information linkage infrastructure; and (v) the allocation of costs—the Interim Report introduces the principal views expressed by each member of the Study Group.

The Study Group will continue its examination, taking into account the issues and opinions organized in the Interim Report, developments in the current and related systems, as well as legal perspectives, with a view to organizing its discussions by around the summer of 2026. Furthermore, according to the “Priority Policy Program for the Realization of a Digital Society,” where the measures deemed necessary in connection therewith require legislative amendments, it is contemplated that a bill will be submitted to the ordinary session of the Diet in 2027. Accordingly, further developments, including the submission of such legislation, may be anticipated.

On March 19, 2026, draft amendments (in Japanese) (the “Draft Amendments”) to the “Ethical Guidelines for Medical and Biological Research Involving Human Subjects” (the “Ethical Guidelines”) were published.¹⁴

With respect to the Ethical Guidelines, it has been pointed out that certain aspects of their relationship with the APPI are unclear, and that the procedures for obtaining informed consent (“IC”) are excessively complex, thereby constituting factors that impede the progress of the relevant research. In response thereto, the “Joint Meeting on the Handling of Personal Information in Life Science and Medical Research” (the “Joint Meeting”), has been engaged in cross-ministerial discussions regarding the direction of the review.¹⁵

The Draft Amendments propose categorizing research subjects covered by the Ethical Guidelines into three types—(i) research involving invasiveness or intervention; (ii) research using specimens; and (iii) research using only information—and tailoring consent procedures to the level of risk associated with each type. In addition, the Draft Amendments unify terminology by replacing expressions such as “written IC,” “oral IC” and “appropriate consent” with the single term “IC,” and restructure the consent procedures into two principal frameworks: IC and opt-out.

As for the future schedule, it is contemplated that, by June 2026, the Draft Amendments and the draft amendments to the “Guidance for Ethical Guidelines for Medical and Biological Research Involving Human Subjects” (in Japanese) (the “Guidance”) will be organized, and that, thereafter, the revised Ethical Guidelines will be promulgated and the revised Guidance will be published. In addition, with respect to the portions related to the so-called “triennial review” of the APPI, it is contemplated that examination will be conducted once it becomes possible to engage in more concrete discussions.¹⁶

While compliance with the Ethical Guidelines and the Guidance is required in order to conduct life science and medical research appropriately, the present amendments are also expected to contribute to the promotion of such research and to the reduction of the burden on research institutions. Accordingly, future developments warrant close attention.

In January 2026, the Intellectual Property Division of the Tokyo District Court published guidelines titled “Procedures for Adjudicating Patent-Infringement Suits Based on Standard-Essential Patents (SEPs)” and “Procedures for SEP Mediation (SEPJM)” (both in Japanese). A standard-essential patent (SEP) is a patent whose practice is required to make products compliant with a technical standard, and which has gone through the relevant procedures established by a standard-setting organization (such as a FRAND declaration). The newly released guidelines systematically organize how SEP disputes will be handled in Japan and are clearly geared toward responding to global licensing disputes. They are therefore expected to have significant practical impact.

First, the adjudication guidelines for SEP litigation make clear that court proceedings will focus on achieving agreement on license fees under global FRAND terms. As a general rule, the court will promote settlement at the first hearing and will schedule dedicated, concentrated sessions for settlement negotiations. The court is expected to actively encourage settlement from the early stages of proceedings, with an emphasis on reaching early agreement on licensing terms between the parties. Consequently, parties will be required to submit practical evidence, such as concrete royalty proposals and relevant sales data, and the guidelines offer pragmatic direction on the form and content of claims and proof.

Second, the procedural guidelines for SEP mediation (SEPJM) likewise position mediation as the mechanism for reaching agreement on FRAND-based licensing terms. The SEPJM is characterized by three features: internationality (calculation methods referencing global standards), speed (mediation sessions are, in principle, limited to three or fewer hearings), and expertise (a mediation panel composed of one IP-division judge and two specialists such as lawyers or patent attorneys).

By publishing these guidelines, Japan signals an intent to strengthen its role as a forum for resolving global SEP disputes. Going forward, attention will focus on how these procedures are applied in practice and on the overall development of Japan’s framework for resolving these disputes.

On February 26, 2026, the Agency for Cultural Affairs launched (announcement in Japanese) two new systems—the “Cross-Sectoral Rights Information Search System” and the “Individual Creator Rights Information Registration System”—to streamline the process of identifying copyright holders when obtaining permission to use copyrighted works.

When using copyrighted works, unless an exception under the Copyright Act applies, users must obtain permission from the relevant rights holders or copyright management organizations (entities that manage copyrights on behalf of rights holders based on contractual arrangements). To do so, users must first identify and contact the relevant rights holders or organizations. However, identifying such parties and their contact information has not been easy in practice, often imposing a significant burden on users.

The Cross-Sectoral Rights Information Search System enables users to search for relevant copyright management organizations and rights holder groups based on the field, type and intended use of a work. Through this system, users can identify which websites should be consulted to obtain information on rights holders, thereby improving the efficiency of rights holder searches.

The Individual Creator Rights Information Registration System allows individual creators who have not entrusted their rights to management organizations to register information regarding their works, including contact details and their intentions regarding permitted uses. Through this system, users can directly confirm the rights holder’s intentions and engage in individual licensing negotiations.

These systems are closely related to the “Compulsory License System” (in Japanese), which is scheduled to come into operation on April 1, 2026. This new system allows the use of works under certain procedures where the works are not managed by a copyright management organization and the rights holder’s intentions cannot be confirmed. The Cross-Sectoral Rights Information Search System serves as a means to confirm whether a work is managed by a management organization and whether the rights holder’s intentions can be ascertained, and conducting a search through this system is positioned as one of the requirements for filing an application for a compulsory license (Article 67(1)(i) of the Copyright Act). In addition, where individual creators indicate their intentions regarding the use of their works through the Individual Creator Rights Information Registration System, such works fall outside the scope of the compulsory license system.