p. 100 · PDF 104

4 - 2 Security-related Laws and Regulations

This subsection explains major laws, regulations, standards, and guidelines surrounding information security. Generally accepted names are given in the text, with official names in brackets.

(1) Unauthorized Access Prohibition Act

[Act on the Prohibition of Unauthorized Computer Access]

The Unauthorized Access Prohibition Act is a law for the purpose of maintaining the safety and order of telecommunications by preventing crime that is committed via telecommunications lines (e.g., networks) and by controlling access to computers. Under this law, the act of unauthorized access itself is subject to punishment, even if there is no actual damage. Moreover, it stipulates not only measures against the perpetrators of unauthorized access, but also measures (e.g., enforcing strict password management) that are aimed at the administrators of access in order to prevent unauthorized access.

[Acts that are made illegal under the Unauthorized Access Prohibition Act]

• • Acts that are conducted over networks (e.g., the Internet, intranet) by using the user
  ID and password of another person to access computers or wireless LAN base stations for which access is controlled
• • Acts that help unauthorized accesses, such as disclosing another person’s user ID
  and password to a third party without the person’s permission
• • Acts that misuse (or attack) security holes in OS or software · 1 question

(2) The Penal Code

The Penal Code is the law that stipulates punishments for crimes or similar acts. The area of the Penal Code that deals with computer-related criminal law is also known as the Computer Crime Prevention Law.

• • Crimes related to Electromagnetic Records of Unauthorized Command (crime
  of computer virus creation) (Penal Code of Japan, Article 168, paragraphs 2, 3) Penal regulations for persons creating computer viruses
• • Crime of computer fraud (Penal Code of Japan, Article 246, paragraph 2)
  Penal regulations for persons committing acts of fraud by using computers

p. 101 · PDF 105

• • Crime of obstruction of business by damaging a computer (Penal Code of Japan,
  Article 234, paragraph 2) Penal regulations for persons obstructing business by destroying data on computers or causing operations contrary to the intended use of computers
• • Crime of unauthorized creation of electromagnetic records (Penal Code of Japan,
  Article 161, paragraph 2) Penal regulations for persons engaging in unauthorized creation of data in computers
• • Crime of unauthorized creation of electromagnetic records of payment cards
  (Penal Code of Japan, Article 163, paragraph 2) Penal regulations for persons engaging in unauthorized creation of credit cards or other cards for payment of charges for goods or services, or persons engaging in unauthorized creation of data in cards for withdrawal of money

(3) Personal Information Protection Act

[Act on the Protection of Personal Information]

The Personal Information Protection Act is a law that aims to balance the use of personal information with protection of the information. It defines the duties, etc. to be observed by business entities that handle personal information.

[Terminology related to the Personal Information Protection Act]

• • Personal information
  This refers to information about a living individual which can identify the specific individual.
• • Business operator handling personal information
  This refers specifically to those private enterprises (excluding national or local government bodies) that, among business operators possessing personal information databases, etc. necessary for business, have 5,000 or more of specific individuals identified by personal information on any day in the past six months.
• • Personal information databases, etc.
  This refers to a database, etc. in a state where specific personal information can be easily retrieved, regardless of whether the information has been digitized or not.
• • Personal data
  This refers to personal information that constitutes a personal information database, etc.
• • Retained personal data
  This refers to the retained data on individuals, for which a business operator handling personal information has the authority to disclose, to correct, add or delete

p. 102 · PDF 106

the contents, to discontinue or erase its utilization, and to discontinue its provision to third parties, etc.

The Act on the Protection of Personal Information stipulates the following duties for business operator handling personal information. However, in situations otherwise determined by laws and regulations or when these are required to protect human life, body, or property, these do not apply when it is difficult to gain the consent of the individual.

• • The purpose of utilization of personal information shall be specified as much as
  possible. Moreover, personal information about a person shall not be handled without obtaining the consent of the person, beyond the scope of the purpose of use.
• • Personal information shall not be acquired by wrongful means. Moreover, except in
  cases in which the purpose of utilization has already been publicly announced, the purpose of utilization shall be promptly notified to the person or must be promptly publicly announced when personal information is acquired.
• • Necessary and proper measures shall be taken for the security control of information,
  including the prevention of leakage or loss of personal data.
• • Personal data shall not be provided to a third party without obtaining the consent of the
  person. However, this does not apply when the fact that provision to a third party is the purpose of utilization is notified to the person or is in a readily accessible condition for the person.
• • The business operator shall endeavor to maintain personal data accurate and up to date.
• • When a business operator is requested by a person to disclose, to correct/add/delete
  retained personal data, to discontinue/erase its utilization, etc., the business operator shall respond without delay.
• • A business operator shall be endeavor to appropriately and promptly process
  complaints about the handling of personal information.

With regard to the state organ and local governments, incorporated administrative agencies, etc. not included among business operators handling personal information, four (excluding the Act on the Protection of Personal Information) of the five laws concerning protection of personal information apply.

p. 103 · PDF 107

Private	Public bodies
Act on the Protection of Personal Information	Act on the Protection of Personal Information Held by Administrative Organs	Act on the Protection of Personal Information Held by Incorporated Administrative Agencies
	Act for Establishment of the Information Disclosure and Personal Information Protection Review Board
	Act for establishment of related laws and regulations
Basic Policy on the Protection of Personal Information (Cabinet decision)

View original table · p. 103

Enlarge original table

The following guidelines and systems concerning protection of personal information also exist. These guidelines and systems do not carry legal force. However, considering the loss to companies (e.g., loss to corporate image) which is revealed to be in violation of the Act on the Protection of Personal Information, companies should incorporate these into their compliance activities.

• • Guidelines on Personal Information Protection
  The Act on the Protection of Personal Information establishes the minimum required rules for the handling of personal information shared across areas of business. Items on the basis of those minimum rules, established by ministries and agencies overseeing their respective business areas, form the Guidelines on Personal Information Protection.
• • Privacy Mark System (P Mark System)
  This is a system that confers a Privacy Mark on private businesses and other organizations that have constructed management systems in conformance with JIS Q 15001 (Personal information protection management systems―Requirements) and have prepared appropriate protection systems for the handling of personal information. Examination organizations that are designated by the JIPDEC (Japan Institute for Promotion of Digital Economy and Community) perform examination of whether implementation systems, regulations, records, implementation status, and other matters fulfill the requirements that are noted in JIS Q 15001.

(4) Electronic Signature Act

[Act on Electronic Signatures and Certification Services]

The Electronic Signature Act is a law that defines the certification systems and other necessary matters concerning designated certification service, to ensure the same legal trust in an electronic signature as that of a “physical signature” or a “personal seal.”

p. 104 · PDF 108

[Terminology related to the Electronic Signature Act]

• • Electronic signature <Digital signature>
  An electromagnetic record that can confirm the identification of the person who created the information and whether or not any alternation of the information has been performed
• • Certification service <Issuance of digital certificates>
  A service that certifies digital signatures as legitimate
• • Accredited certification business operator <Certificate authority>
  A business operator that is accredited by the competent minister to perform accreditation service (i.e., designated certification service) for electronic signatures that conform to standards specified by the ordinances and notifications of competent ministries.

There is also a law called the Official Personal Authentication Act. It stipulates the full provision of the electronic certification systems that are required for the official personal authentication services of electronic government.

(5) Act on the Limitation of Liability for Providers

[Act on the Limitation of Liability for Damages of Specified Telecommunications Service Providers and the Right to Demand Disclosure of Identification Information of the Senders]

The Act on the Limitation of Liability for Providers is a law that stipulates limitation of liability for compensation of damages of specified telecommunications service providers, and the right to demand disclosure of identification information (e.g., name, address, mail address, IP address) of the senders, in case of infringement of the rights through information distributing by specified telecommunications services (e.g., the Internet).

(6) Specified Electronic Mail Act (Spam E-mail Prevention Act)

[Act on the Regulation of Transmission of Specified Electronic Mail]

The Specified Electronic Mail Act is a law that regulates the transmission of e-mail by defining prohibited items and other details for transmitting specific types of e-mail for the purpose of commercial gain. It mandates display of “unapproved advertisement*”, display of information of the sender (e.g., the business operator, sender), display of the sending e-mail address, acceptance of e-mail reception rejection, and other matters in the sending of specified e-mail. It prohibits transmissions using false sender information such as fictitious e-mail addresses or forged headers; provides for orders for improvement from the Minister for

p. 105 · PDF 109

Internal Affairs and Communications when the prohibitions are not followed; and provides for the imposition of criminal penalties when the orders for improvement are not followed.

(7) Standards concerning information security, etc.

• • Standards for Measures Against Computer Viruses
  These are collected by the Ministry of Economy, Trade and Industry. They are measures which are effective in the prevention, discovery, and removal of computer viruses, and in restoration from damage.
• • Standards for Measures Against Unauthorized Access to Computers
  These are collected by the Ministry of Economy, Trade and Industry. They are measures that individuals, corporations, and other organizations should perform for the prevention and discovery of damage that is caused by unauthorized computer access, for the restoration from damage, and for the prevention of the expansion and the recurrence.
• • Guidelines for Information System Safety Measures
  These are notices by the National Public Safety Commission. They are aimed at parties concerned with information systems, for the purpose of securing the safety of citizens’ lifestyles and maintaining the order of information society. They indicate measures that should be taken to prevent or minimize damage that is caused by crimes, fraudulent behavior, leaks of personal information, and disaster that involve information systems, and also indicate measures to ensure cooperation with police following crimes.
• • Standards for Information System Safety Measures
  These standards from the Ministry of Economy, Trade and Industry enumerate measures to be implemented by users of information systems to prevent risks such as natural disasters, equipment faults, and intentional and negligent risks, and to minimize impacts and speed recovery after occurrences, for the purpose of securing the confidentiality, integrity, and availability of information systems.

(8) Guidelines concerning information security

• • Information Security Early Warning Partnership Guideline
  This is a guideline that is jointly established by parties including IPA, JPCERT/CC, JEITA, CSAJ, JISA, and JNSA, in order to control the occurrence of damage from unauthorized computer access, computer viruses, and so on.
• • OECD Security Guidelines

[Guidelines for the Security of Information Systems and Networks] These are international guidelines for information security, which are established by

p. 106 · PDF 110

the OECD (Organization for Economic Cooperation and Development). They were considerably revised in 2002, at which time they adopted “security management” and “security culture.” The guidelines set three targets for application: information system owners, providers, and users. The guidelines are composed of nine principles: awareness, responsibility, response, ethics, democracy, risk assessment, security design and implementation, security management, and reassessment.

• • OECD Privacy Guidelines

[Guidelines on the Protection of Privacy and Transborder Flows of Personal Data] These are international guidelines on protection of personal information, which are recommended by the OECD (Organization for Economic Cooperation and Development). They recommend that OECD member nations respect the following eight basic principles concerning personal information. Japan’s Act on the Protection of Personal Information also covers the content of the OECD Privacy Guidelines. (i) Collection Limitation Principle Collect information by lawful and fair means. (ii) Data Quality Principle Keep data accurate, complete, and up-to-date, to the extent necessary for the purpose of use. (iii) Purpose Specification Principle Specify the purposes not later than at the time of information collection. (iv) Use Limitation Principle Do not use information for purposes other than that specified. (v) Security Safeguards Principle Protect information against such risks as loss, destruction, modification, or disclosure. (vi) Openness Principle Make general disclosure concerning developments, practices, and policies. (vii) Individual Participation Principle Clearly indicate the location of data concerning persons, and allow challenges to the data. (viii) Accountability Principle Data controllers must comply with measures which give effect to the principles.