Japan Expands Use of Sensitive Personal Data for AI and Statistics Without Consent

Amendments to Japan’s Act on the Protection of Personal Information allow the collection and use of sensitive personal data, including medical histories and criminal records, without individual consent when used for AI development or the creation of statistical data. According to a report by Bengoshi.com, these changes expand the “statistical exception” to facilitate the growth of the domestic AI industry by reducing legal hurdles for data acquisition.

Expanded Scope of the Statistical Exception for AI Training

The Japanese government is broadening the application of the statistical exception within the Act on the Protection of Personal Information. This legal framework traditionally requires explicit consent for the handling of “special care-required personal information,” which encompasses sensitive data such as race, religion, medical records, and criminal history. However, the revised interpretation allows this data to be processed without consent if the purpose is the creation of statistical data or the training of artificial intelligence models.

Bengoshi.com reports that the objective is to ensure Japanese AI developers can access large-scale, high-quality datasets to remain competitive globally. By treating AI training as a form of statistical processing, the government aims to remove the practical impossibility of obtaining individual consent from millions of data subjects.

Legal Risks and Privacy Implications

The expansion of these exceptions raises significant concerns regarding the “right to be forgotten” and the potential for data leakage. Under the current proposal, once sensitive data is integrated into a statistical dataset or an AI model, it becomes difficult to remove or redact, even if the original subject requests deletion. Bengoshi.com notes that the primary risk lies in the possibility of “re-identification,” where AI models might inadvertently output sensitive personal details through specific prompts or patterns.

Legal analysts cited by Bengoshi.com argue that the boundary between “statistical use” and “individual profiling” is thin. While the law intends for the data to be used in aggregate, the nature of generative AI means that the model learns from individual data points. This creates a tension between the legal definition of statistical data—which is meant to be anonymous and aggregate—and the technical reality of how AI models are trained.

Comparison of Data Handling Requirements

The shift in policy creates a distinct divide in how personal information is managed based on the intended outcome of the processing:

• Standard Commercial Use: Requires explicit opt-in consent for sensitive data, such as using medical records for targeted marketing.
• AI and Statistical Use: Permits acquisition and utilization without consent, provided the data is used to create a general model or a statistical report.

This distinction is designed to prevent the law from becoming a bottleneck for technological innovation. However, critics argue that the lack of a strict “opt-out” mechanism for sensitive data in the AI context leaves individuals with little control over their most private information.

Industry Impact and Implementation

For Japanese businesses, particularly in the healthcare and legal tech sectors, these changes lower the cost and complexity of data procurement. Companies can now leverage existing databases for research and development without the administrative burden of contacting every individual listed in a medical or legal record.

The implementation of these rules places a higher burden of responsibility on the “personal information handling business operator” to ensure that the data is not used for purposes other than statistics or AI training. Failure to maintain this distinction could lead to regulatory penalties under the broader framework of the Act on the Protection of Personal Information.