--- title: "Japan — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/japan/algorithmic-biometric-and-surveillance-governance/ source_html: /jurisdictions/japan/algorithmic-biometric-and-surveillance-governance/index.html description: "Japan — Algorithmic, Biometric & Surveillance Governance: algorithmic_biometric_and_surveillance_governance Algorithmic, Biometric & Surveillance Governance 6 sub-modules 8 claims Amber ▾ # AI-specific promotional legislation and sectoral" generated_at: 2026-10-25T04:46:50Z content_sha256: bcf730f2f9183f0574c29f83a0c1c509fa89d77613c5815dbd0381292b8af74e generator: "fe-fleet/md-twin@1.0" --- # Japan — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor ### D8Algorithmic, Biometric & Surveillance Governance6 sub-modules8 claimsAmber▾# AI-specific promotional legislation and sectoral biometric/genetic guidance exist, but core ADM/profiling and binding biometric protections remain in the proposal stage, and state-surveillance carve-outs limit PPC coercive reach over public bodies. Primary framework APPI (general); Act on Promotion of Research and Development, and Utilization of AI-related Technology (AI Promotion Act, 2025) Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Amber AI-specific promotional legislation and sectoral biometric/genetic guidance exist, but core ADM/profiling and binding biometric protections remain in the proposal stage, and state-surveillance carve-outs limit PPC coercive reach over public bodies. #### Sub-modules (6) #### Profiling RestrictionsRed No comprehensive profiling-restriction framework currently exists under the APPI; reform is under PPC consideration. Claims (2): - The PPC's triennial-review Interim Summary flags continued consideration of profiling regulation as an open policy issue for the APPI reform. - The pending APPI amendment bill would create a 'Specific Biometric Personal Information' category for facial-recognition data, requiring notice/accessibility to data subjects and an unconditional right to demand suspension of use. #### Automated Decision Making TransparencyRed Neither the APPI nor PPC Guidelines contain comprehensive legal provisions on automated decision-making and profiling, per the European Parliament's adequacy-review findings; only limited sectoral rules touch the issue. Claims (1): - Neither the APPI nor PPC Guidelines contain comprehensive legal provisions on automated decision-making and profiling; only limited sectoral rules address the matter without an overarching protective framework. #### Ai Risk AssessmentsAmber Japan's AI Promotion Act establishes a national AI governance framework, supplemented by non-binding AI Business Operator Guidelines rather than mandatory AI-specific risk assessments. Claims (2): - Japan enacted the Act on Promotion of Research and Development, and Utilization of AI-related Technology (AI Promotion Act) in May 2025, which came into full effect in September 2025. - Japan's AI Business Operator Guidelines consolidate AI-governance principles and best practices but constitute non-binding soft guidance rather than a mandatory AI-specific risk-assessment regime. #### Biometric RegimeAmber No binding biometric-specific data regime currently exists; a proposed 'Specific Biometric Personal Information' category for facial-recognition data is pending in the 2026 reform bill. Claims (1): - The pending APPI amendment bill would create a 'Specific Biometric Personal Information' category for facial-recognition data, requiring notice/accessibility to data subjects and an unconditional right to demand suspension of use. #### Genetic DataAmber Genetic data is addressed only via non-binding METI sectoral guidance; the PPC's triennial review is separately considering genomic-data regulation. Claims (2): - METI has issued non-binding sectoral guidelines for the protection of personal information in industries using genetic information of individuals. - The PPC's triennial-review Interim Summary lists regulation of genomic data among issues requiring continued consideration. #### State Surveillance CarveoutsAmber The PPC's oversight of Administrative Organs (including law-enforcement and national-security data collection) is limited to non-coercive tools; it cannot issue binding orders or impose fines on those public authorities. Claims (1): - Although the PPC oversees Administrative Organs' collection and processing of personal information, including law-enforcement and national-security data collection, it has not been empowered to issue binding orders to, or impose fines on, these public authorities; its tools are limited to reporting requests, on-site inspections, guidance, advice and recommendations. Category narrative 114 words The APPI currently contains no comprehensive automated-decision-making or profiling framework equivalent to GDPR Article 22; the European Parliament has explicitly flagged this gap. Reform is under active PPC consideration as part of the ongoing triennial review, alongside a proposed 'Specific Biometric Personal Information' regime for facial-recognition data. Separately, Japan's AI Promotion Act (enacted May 2025, in force September 2025) establishes a light-touch, innovation-oriented national AI framework, complemented by non-binding AI Business Operator Guidelines. Genetic data is addressed only via non-binding METI sectoral guidance, with genomic-data regulation flagged for further PPC review. Government/national-security data access by public authorities is subject to PPC oversight powers that stop short of binding orders or fines against those authorities. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Act No. 56/2026 introduces heightened statutory treatment of biometric data used for identification purposes, a category not previously subject to bespoke statutory rules of this kind under the APPI. Three distinct elements are reported: first, heightened transparency requirements specific to biometric identification data; second, an expanded deletion-request right applicable to such data; and third, a prohibition on providing biometric identification data to third parties via the opt-out mechanism that otherwise allows certain categories of personal data to be shared with third parties absent individual consent, provided the data subject has not opted out. Removing the opt-out pathway specifically for biometric identification data means that, once this provision commences, third-party sharing of such data will generally require an affirmative lawful basis rather than reliance on a standing opt-out notice. This set of changes is reported consistently in secondary law-firm commentary, though the amendment's own text and any PPC explanatory guidance were not independently retrieved this cycle. The provision is enacted but not yet in force, tied to the same Cabinet-order commencement mechanism governing the main body of Act No. 56/2026 generally, with likely effect around mid-2028. No separate finding concerning algorithmic decision-making or automated-surveillance governance specifically was identified for Japan this cycle; the material secured concerns biometric data treatment within the forthcoming amendment. #### Outlook The practical significance of these biometric provisions, once in force, will depend substantially on how the PPC defines "biometric data used for identification purposes" in implementing guidance, and on the specific content of the heightened transparency requirements, neither of which has been established this cycle. Businesses deploying biometric identification systems in Japan, including in sectors such as finance, retail, and access control, would be the primary population affected once the provision commences, and the removal of the opt-out pathway for third-party sharing is the single most consequential practical change within this set of provisions. 2 earlier distinct update(s) Periodic update · new data 2026-10-06 #### Algorithmic, Biometric & Surveillance Governance Act No. 56 of 2026 introduces heightened governance for facial-recognition-type biometric data, enacted but not yet in force. Once the amendment commences, facial-recognition-type biometric data becomes subject to heightened transparency requirements, an expanded individual right to request deletion, and a prohibition on third-party provision of such data via the opt-out mechanism that otherwise applies more generally under the APPI to certain categories of personal data. This is a targeted governance upgrade specific to one category of biometric data, facial recognition, rather than a general biometric-data regime covering all biometric identifiers; the amendment does not establish a broader algorithmic-governance framework beyond this specific biometric category based on the evidence available this cycle. #### Outlook Commencement is expected by Cabinet Order no later than July 2028, alongside the other Act No. 56/2026 provisions. The practical reach of the expanded deletion right and the opt-out prohibition for facial-recognition data will depend on implementing guidance from the PPC, whose basic-concept discussion in September 2026 signalled a continuing focus on data-utilisation rulemaking alongside youth-data protection, though biometric-specific implementing detail was not addressed in the evidence available this cycle. Periodic update · new data 2026-09-21 #### Algorithmic, Biometric & Surveillance Governance The APPI Amendment Act establishes "Specific Biometric Personal Information" as a distinct regulated category for the first time, subject to heightened transparency obligations, expanded deletion rights, and a prohibition on third-party provision via opt-out. This marks a structural addition to Japan's special-category data architecture, bringing biometric data under materially tighter handling rules once the provision takes effect. #### Outlook The biometric category will not apply until Cabinet-order commencement, due no later than July 2028. Organisations handling biometric identifiers in Japan face a defined but not-yet-active compliance shift; the opt-out prohibition in particular removes a sharing pathway that exists for other categories of personal data under the current regime. Evidence 8 Sources and claims (8) - Probable[IAPP](https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations) — The PPC's triennial-review Interim Summary flags continued consideration of profiling regulation as an open policy issue for the APPI reform.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/navigating-japan-s-proposed-appi-amendments-key-timelines-open-issues-and-action-points) — The pending APPI amendment bill would create a 'Specific Biometric Personal Information' category for facial-recognition data, requiring notice/accessibility to data subjects and an unconditional right to demand suspension of use.observed 2026-07-29 - Confirmed[EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52018IP0529) — Neither the APPI nor PPC Guidelines contain comprehensive legal provisions on automated decision-making and profiling; only limited sectoral rules address the matter without an overarching protective framework.observed 2026-07-29 - Confirmed[IAPP](https://iapp.org/resources/article/global-ai-governance-japan) — Japan enacted the Act on Promotion of Research and Development, and Utilization of AI-related Technology (AI Promotion Act) in May 2025, which came into full effect in September 2025.observed 2026-07-29 - Confirmed[IAPP](https://iapp.org/resources/article/global-ai-governance-japan) — Japan's AI Business Operator Guidelines consolidate AI-governance principles and best practices but constitute non-binding soft guidance rather than a mandatory AI-specific risk-assessment regime.observed 2026-07-29 - Confirmed[OneTrust DataGuidance](https://free.dataguidance.com/laws/japan-act-on-the-protection-of-personal-information-2/) — METI has issued non-binding sectoral guidelines for the protection of personal information in industries using genetic information of individuals.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations) — The PPC's triennial-review Interim Summary lists regulation of genomic data among issues requiring continued consideration.observed 2026-07-29 - Confirmed[EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=SWD:2023:75:FIN&qid=1680566066374) — Although the PPC oversees Administrative Organs' collection and processing of personal information, including law-enforcement and national-security data collection, it has not been empowered to issue binding orders to, or impose fines on, these public authorities; its tools are limited to reporting requests, on-site inspections, guidance, advice and recommendations.observed 2026-07-29