TOKYO -- The Japanese government will revise a law on personal data protection and introduce new rules on how companies can analyze personal information, Nikkei has learned.
The new rules will require companies to obtain the consent of users when "cookies" are used, and when these cookies are given to third parties to create individual profiles. The regulations will also require companies to explain how the profiles are created, such as through artificial intelligence.
A government panel, the Personal Information Protection Commission, plans to introduce legal provisions giving web users the right to ask companies not to use their personal information for unwanted purposes. The commission aims to make the changes next year as part of the revised Personal Information Protection Act.
Cookies are small text files that keep track of users' web browsing history. Many companies use them to understand user preferences. Although cookies can be combined with other information to identify individuals, they are not considered personal data under current Japanese law because the cookie itself does not include the name of the user. Legal experts have raised concerns about gaps in the law.
Under the new rules, cookies will be handled in the same way as other personal information when it is turned over to a third party for the purpose of identifying an individual. The company will be required to inform the person that their information is being gathered and obtain the person's permission.
New rules requiring companies to explain in detail how they use personal data will also be created. Current regulations require only that users be told why personal data is being collected, such as "for notification about new products." With the legal changes, more specific explanation will be required, and companies will have to disclose how the data is handled, explaining that they "use AI to determine a credit rating," for example.
In Europe, cookies are considered personal data and users have the right to object to profiling. While the regulations have improved consumer protections in Europe, companies complain about the regulatory burden this imposes.