Japan privacy regulator drafts rules for AI data training

The secretariat of Japan’s Personal Information Protection Commission has released a draft paper outlining implementation rules for a law that allows companies to use personal data for statistics and AI development without prior consent.

The proposed regulations aim to establish a statutory route for companies to exchange personal data and collect sensitive information published online. Under the draft rules, companies utilizing this exception would be required to publish specific details on a public webpage accessible to search engines.

The proposal also addresses data management by suggesting a narrower regime for outsourced data processors, prohibiting them from using data for their own purposes. Additionally, the draft suggests lighter administrative requirements for reporting small-scale data leaks, allowing some to be reported to the regulator in batches rather than individually.