Rights to Control Self-Information and Bill to Protect Personal Information
SUZUKI Masatomo (Nifty Corp.)
1. Introduction
It has been a long time since the word "privacy" became part of everyday language. Still, in Japan, no written law exists to define and regulate rights to privacy and we cannot draw any explicit primary legal concept from past judicial precedents. In case people's privacy is infringed by the power of authority, the generally accepted view is to acknowledge rights to privacy as a new type of human rights based on the Article 13 of the Constitution which stipulates that "all of the people shall be respected as individuals" and that "right to - the pursuit of happiness shall - be the supreme consideration." But it remains unclear as to whether this should be interpreted as a right to be left alone or a right to control one's self-information, whether or not a right to self-determination should be included, and how a privacy right relates to rights to one's portrait and name. Given this, we must conclude that the legal concept of privacy has yet to be established.
The situation is very much same in the sphere of civil laws that provide remedies for victims (private person) of privacy infringement by others (private person). A number of judicial precedents of privacy infringement, particularly those involving illegal acts, have been accumulated. They are often referred to as privacy protection legislation but it is difficult to find any unified common rules.
It is disputable how privacy rights should be protected, specifically, as to whether the infringement of privacy should be defined as the infringement of personal rights or as the infringement of personal interest, and whether or not to allow for injunction for plaintiffs against defendants. Also, questions remain as to whether it is legitimate or not to acknowledge rights to the disclosure, changes and elimination of information concerning personal privacy on the ground of personal rights under the Civil Code.
Under the existing judicial system, it is difficult to relieve injured individuals in a privacy infringement case. This is attributed to a range of problems such as: 1) difficulties in requesting injunction and disclosure, 2) the lack of promptness, 3) compensation payouts which are too modest in amount, and 4) the financial burden of court proceedings.
I believe it is because people acknowledge the need to address these problems that high expectation is being placed on the enactment of a law to protect personal information.
2.
In dealing with issues concerning privacy and personal information protection, the words "self-information control rights" always have wings and any ideas that do not accept this concept are criticized as being contradictory to the common belief. However, I believe it is necessary for us to rethink whether this belief is appropriate especially in handling issues between or among private persons.
Just because no written laws exist, should we introduce the concept of self-information control rights based on the personal rights under Civil Code? To be honest, I have a great deal of reservation as I believe that this will cause too significant adverse effects in relations to the inhibition of information transfer, suppression of others' freedom, and the freedom of expression.
A bill concerning the protection of personal information (hereinafter referred to as the personal information protection bill), which has been subject to hot debates lately, provides that private sector entities handling personal information should, in principle, "notify" concerned individuals of or "publicize" the purpose and use of personal information after acquiring the information, and seek the prior approval of concerned individuals only in exceptional cases. This idea is reflected on a provision stipulating that those entities must only "clearly state" the purpose and use of personal information even when they acquire such information directly through a contract with concerned individuals.
The proposed legislation is thus restrained in exercising administrative authorities and should be appreciated to that effect. (Although some consumer groups insist that the bill is too lenient, reinforcing restrictions might end up giving greater authorities to administrative agencies.)
In my view, one of the core problems of the personal information protection bill is that it defines "personal information" as information based on which an individual can be identified, an extremely broad concept. In other words, the bill, which is proposed as an administration law, is problematic in that it enables administrative agencies to exercise power in an extremely broad range of scope.
Meanwhile, under the light of a judicial law or a case law, the legal concept of privacy right is too ambiguous and it is not clear whether it is considered to be a legal right or simply concerns personal interests. I am suspicious about introducing at this stage a right to control self-information, which is in nature a right to claim as seen in real rights.
It is understandable that such logics are sometimes adopted in a lower court ruling out of the need to relieve victims in particular cases. But I think it is doubtful that the logics are the best.
It seems that the underlying idea of a right to control self-information is to allow for claiming the right to information about oneself just like authors claiming their copyrights. The right enables an individual to exercise legal rights to force others to disclose, change, suspend the use of, or eliminate information about him- or herself. This is an extremely strong right and should not be granted without clear provisions.
The personal information protection bill calls for subjecting information providers to an administrative law duty to properly respond to individuals' request to disclose, change, and suspend the use of "personal data," a concept somewhat broader than privacy information.
Some people see it as a provision to acknowledge a right to control self-information. Taking a closer look at the details of the bill, however, I think we should see this as an attempt to block the idea of a self-information protection right (though we never know how a court will actually judge once the bill becomes a law).
As long as we stand on the understanding that the bill calls for a right to control self-information, we should take this legislative move as a legal endorsement of an idea that the same rule shall apply to the handling of information between and among individuals. But then, it would be difficult to explain why restrictions apply only to companies handling personal information. Government-approved bodies for personal information protection would also find it difficult to define the scope of information disclosure, for instance, by setting guidelines for personal information protection.
If we focus solely on infringement cases by large companies in which victims need to be relieved, we might as well conclude that the bill can be interpreted as calling for a self-information control right. However, when individuals claim the same right against grocery shops or fish stores, a series of problems - such as how they can identify individuals, how the scope of disclosure should be set, and what to do if personal information is disclosed to a wrong person either by getting tricked by false personation or purely by mistake - would arise in reality. Major companies may have to take full-scale counter-measures that would mobilize both a legal division and a call center.
Furthermore, adapting to a new system based on the premise of disclosing information would necessitate enormous amount of clerical work, for instance, to redesign databases, rework or eliminate various data. Some major companies have already formulated a budget worth hundreds of millions of yen for information-related investment. And whether companies are large or small in size there would be no difference in that they need money and skilled personnel.
Because the personal information protection bill covers employment management information, personal information providers as users would be required to respond to individual employees' request for disclosure. But would it be possible to unconditionally disclose such information?
When regulations apply as a general law to cover a wide range or areas, it is necessary to narrow down companies subjected to the regulations and set the scope of disclosure in a reasonable manner.
Should a self information control right be introduced as a general law that has a Constitutional foundation to regulate information transfer between or among private citizens, it may put certain restrictions in creating a realistic guideline such as the limitation of the scope of information disclosure. In such a case, there arise concerns as to whether the proposed legislation is too idea-oriented. As far as standing on the premise of this personal information protection bill, I cannot support the idea of introducing a self information control right to regulate the private sector.
The personal information protection bill provides no penalty for eliminating personal data and it would be possible to eliminate certain information before responding to a request for disclosure. Thus, whether or not it is based on a self information control right, any legislation of duties under an administrative law to respond to a disclosure request or a right to claim should be introduced only to areas where the imposition of duties to keep certain records - such as gene information and medical information - is deemed appropriate by enacting individual laws.
3.Conclusion
Private laws provide for real rights, claims and intangible property rights. And today, how to handle "information" is becoming another big theme.
Information has an aspect of property rights and an aspect of personal rights. How can we handle such information within the framework of the existing principles of laws? The word "information" in itself may be too vague as a legal concept. Still, as we live in an information network society, we need to study ways to regulate "information" by laws, not stopping just with the interpretation of existing laws but stepping into the area of legislative policies. This may be a subject for "information laws," a new field of laws.
In this sense, I am hoping to learn a lot through my activities at the newly created Information Network Law Association.
