Japan’s Cabinet has approved amendments to the country’s core data protection law, the Act on the Protection of Personal Information (APPI), that would let companies use sensitive personal data for AI model training without obtaining individual consent. The catch: the data has to be pseudonymized well enough that re-identifying someone from it would be, in the government’s view, sufficiently difficult.
What the new rules actually change
The core of the reform is a new statutory exception for what Japan is calling “statistical processing” of personal data. If a company can strip your data down to the point where you personally can’t be identified from it, they can feed it into AI systems without asking you first.
That might sound reasonable until you consider what falls under “sensitive data” in this context. Medical histories. Racial information. Categories that most privacy frameworks, including Europe’s GDPR, treat with maximum caution. Under the amended APPI, these categories will no longer require the stringent consent protocols that previously governed their use.
There are some limits. Biometric data, things like fingerprints and facial recognition markers, will face heightened transparency obligations. The amendments also tighten rules around data belonging to minors under 16.
