Japan to mandate pre-approval for sharing large-scale personal data sets

Tokyo officials intend to revise the 2022 economic security promotion law to obligate organizations that manage large volumes of personal data to seek government approval before any third-party sharing. The scope covers medical records, location tracking, biometric identifiers, genetic profiles and transaction histories, targeting hundreds of entities including banks, hospitals and cloud service users. The requirement would be triggered by the amount of data held and would extend to data stored in overseas cloud facilities or data centers.

An expert panel will convene this month to shape the reporting mechanism, assess national-security implications and recommend sanctions for non-compliance. The government aims to introduce the bill during the next ordinary Diet session, emphasizing the strategic importance of personal data in the era of generative AI. While seeking to protect national security, the proposal also tries to avoid unduly restricting the operations of data-center and cloud providers.