Photo/Illutration The Ministry of Internal Affairs and Communications (Asahi Shimbun file photo)

The telecommunications ministry is pushing a legal revision that would require major operators of social media and internet search engines to clearly state which countries their users’ data is stored in.

It comes following a series of reports in The Asahi Shimbun from March that revealed the personal information of users of the popular social messaging app Line was accessed by a Chinese company and that video and other user data was being stored in South Korea.

The ministry plans to include the new requirement in legislation revising the Telecommunications Business Law to be submitted to the Diet early next year.

Officials presented the proposal to a panel of experts on Dec. 14.

According to the outline, it would make social media operators and search engines publish what countries their data storage computers are located in, along with the locations of foreign subcontracted companies that handle personal data.

Companies with at least 10 million users in Japan will be covered under the new provision. Mobile phone companies will also fall under the new regulations, along with overseas companies such as Twitter and Facebook.

It will also apply to search engines that cut across subject categories. But search engines limited to certain topics, such as travel and food, will not be covered.

The revelation that a Chinese company had access to the personal information of Line users prompted the ministry to investigate into whether new regulations were needed.

After the reports, the Ministry of Internal Affairs and Communications ordered Line to improve its operations in accordance with the Telecommunications Business Law.

Social media companies were targeted under the new law because those services can serve as important communications tools, much like emails.

Search engines were also included because the huge volume of search results related to personal political beliefs and tastes has been used for advertising purposes.

Companies that fail to declare where the computers are located will be issued business improvement orders.

The measures come alongside the revised Personal Information Protection Law, which takes full effect in April 2022.

Among the tougher restrictions is a requirement on companies that provide personal information about its users to foreign third parties. It would require them to inform its users about the local personal information protection regimes in those nations and obtain their consent before providing that data.

Related News