Japan
Act on the Protection of Personal Information (APPI)
Japan's APPI was significantly amended in 2022 to strengthen protections for biometric data. Facial recognition data is classified as personal information requiring a specified purpose of use and individual consent for collection. The PPC has issued specific guidance on facial recognition technology, emphasizing the need for transparency and purpose limitation. Japan also has an EU adequacy decision, meaning data can flow freely between the EU and Japan.
Key Provisions
- Facial recognition data qualifies as personal information under APPI
- Businesses must specify and publicly disclose the purpose of use
- Consent required for use beyond the specified purpose
- Cross-border transfer rules require consent or equivalent protections
- PPC guidance specifically addresses facial recognition in retail and public spaces
- 2022 amendments added mandatory breach notification and strengthened individual rights
Your Biometric Rights
- Right to disclosure of retained personal data
- Right to correction of inaccurate data
- Right to cessation of use (deletion)
- Right to cessation of third-party provision
- Right to be informed of the purpose of use
Penalties for Non-Compliance
Criminal penalties: up to 1 year imprisonment or ¥1 million fine for individuals; up to ¥100 million for corporations. PPC can issue recommendations and orders; non-compliance with orders is criminally punishable.
What We Do Here
We file opt-out requests on your behalf with the face search engines we support, and re-file as necessary. APPI gives residents of Japan the right to demand that an operator stop using or delete their facial data. We file through each engine's own opt-out process rather than under APPI, and a complaint to the Personal Information Protection Commission is yours to make.
Get Protected