Japan's new data law sparks privacy fears as AI development accelerates

Japan’s revised personal information law permits broader data sharing without consent, raising concerns among privacy advocates about potential misuse and weakened protections amidst national push for AI growth.

Japan’s revised personal information law has triggered alarm among privacy specialists and consumer advocates, who argue that it lowers the threshold for handling highly sensitive data in the name of artificial intelligence and statistical analysis. The new framework, which was enacted in July and is due to be published formally on 17 July, allows certain personal information to be passed to third parties without the individual’s explicit consent if it is being used for those limited purposes. Critics say that change reaches into medical records, criminal history and other sensitive categories that were previously protected more tightly. According to Business and Human Rights Resource Centre, the law is meant to support AI development while introducing fines for misuse.

A key concern is that the reform appears to permit the transfer of raw personal data, rather than requiring it to be anonymised or pseudonymised first. That could allow organisations to combine records from hospitals, schools, retailers and social media platforms and then match them against names, dates of birth, sexes and postcodes to identify individuals more easily. The result, critics warn, is not just richer statistical modelling but detailed profiling of people’s private lives, with little practical guarantee that particularly sensitive information will remain insulated from misuse.

The issue is also regulatory. The reform gives the Personal Information Protection Commission responsibility for oversight, but sceptics question whether the commission has the capacity, resources or institutional independence to police such a broad regime effectively. Japan’s data protection rules already rely on guidance and enforcement powers that have been expanded over time, including penalties introduced in earlier revisions of the law. Yet those measures have not dispelled doubts that enforcement tends to follow public exposure rather than preventing abuse in advance.

The wider policy direction is clearer in comparative terms. APD noted that the amendment moves Japan closer to a model in which permission is assumed unless a person objects, rather than one in which explicit consent is the norm. That makes Japan more permissive than the European approach and is intended to make data use easier for businesses, especially those building AI systems. At the same time, legal guidance issued by the commission in June 2023 had stressed that sensitive personal information should not be collected for machine learning without consent and, if collected, should be removed before training. The new reform therefore raises questions about how far the older safeguard will continue to constrain practice.

The commercial argument for easing restrictions is straightforward: companies want easier access to data, and policy-makers want domestic AI development to accelerate. But the privacy trade-off is substantial. If users believe data can be repurposed too freely, trust in domestic providers may weaken rather than strengthen. That could push people towards overseas services, even though foreign platforms are not necessarily subject to the same domestic framework. In that sense, the very attempt to promote national competitiveness may end up favouring larger international technology companies with deeper data ecosystems.

For now, the debate has become less about whether Japan should use data for AI than about how far consent can be diluted before privacy protection becomes largely symbolic. Supporters of the reform see a practical update for a data-driven economy. Opponents see a legal shift that weakens individual control over medical, commercial and online histories without creating strong enough checks on how those records will be collected, linked or reused.