Japan's Personal Information Protection Commission Secretariat has put a non-binding basic-approach paper to the Commission's 369th meeting that proposes facial-feature data as the biometric category covered by the amended APPI's notice and use-cessation regime and lists open questions on the under-16 and contract-based consent exceptions

What this paper is, and what it is not

Printed page 1 sets the frame. The Secretariat says it will first examine the basic approach to the Cabinet Order and Rules for three items under the amended Act: the rules on purpose-exceeding use, acquisition of sensitive personal information and third-party provision (item 1-1); the rules on children's personal information (item 2-1); and the rules on facial-feature data and the like (item 2-2). Other items and the guidelines are to be considered at future Commission meetings, in order. No dates are given. This is a non-binding deliberation paper and nothing in it is a rule.

Two labels sit on the PPC website. The amendment page says the paper was discussed and files it under a 369th-meeting decision of 16 September 2026. The meeting page lists agenda item 1 as the basic approach marked as a draft. We do not read either label as approval of each proposal in the paper, and the paper itself frames its proposals as questions ending in the Japanese equivalent of "how about" or "would this do".

The paper is also not a first statement of anything. Printed page 2 says the background section is built on material previously reported or published at past Commission meetings and elsewhere. Printed pages 6, 7, 16 and 35 reproduce Diet supplementary resolutions of 21 May and 8 July 2026 and ministerial answers of 21 April and 17 June 2026 that already point at the facial-feature and consent-exception issues. What is new on 16 September is a written Secretariat position on how to implement them.

Facial-feature data is the one category the paper proposes

Amended Article 16(5), reproduced on printed page 27, defines specified biometric personal information by reference to a specified biometric personal identification code: a personal identification code, among those in Article 2(2)(i), made from information on a bodily feature that can be acquired by a method needing no special technology or large expense and whose acquisition the person cannot easily recognise, as specified by Cabinet Order. The Cabinet Order therefore decides which biometrics the regime would touch, once the amended Act is in force; the paper does not state a commencement date.

Issue 1 under the definition heading, printed page 31, gives the Secretariat's proposal. Of the personal identification codes listed in the current Cabinet Order, it proposes facial-feature data, at current Cabinet Order Article 1(1)(ro), as the covered code. The paper then asks whether, at this stage, anything else has the statutory properties and should be covered. The passage we quote reads, in our translation: "Among the personal identification codes specified by Cabinet Order as falling under Article 2(2)(i) of the amended Act, how about covering facial-feature data (current Cabinet Order Article 1(1)(ro))?" The Japanese original is in the quotation box on this page.

The reasoning is on printed page 29. The regime rests on facial-feature data being easy to obtain, and so obtainable in volume, without the person's knowledge, and on its high uniqueness and immutability, so that its power to identify a person continues semi-permanently. The paper says the Cabinet Order under Article 16(5) can only reach biometric data that has those properties, taking account of trends in biometric technology. Printed page 34 reproduces the current Cabinet Order list of biometric identification codes (DNA sequence, face, iris, voice, gait, vein pattern, fingerprint or palm print); the proposal names only the second.

Two footnotes on printed page 5 draw the line the Secretariat has in mind: not mere face photographs, but the facial-feature data among personal identification codes, meaning feature information extracted from facial bone structure, skin colour and the position and shape of eyes, nose, mouth and other parts, rendered by a device or software whose purpose is to identify the person. The paper does not use the words artificial intelligence for this. It uses the PPC's existing term for camera systems with a facial identification function.

Notice near the camera, cessation requests, and the exceptions still open

Under amended Article 21-2, reproduced on printed page 27, an operator handling specified biometric personal information would have to notify the person in advance, or put in an easily knowable state, five statutory items plus any items set by Rules: the operator's name, address and representative; the fact that such information is handled; its purpose of use; the content of the bodily feature converted into the code; and the procedure for requests. Once the amended Act takes effect, that is what the statute would require; the paper adds nothing to the list and instead asks how the Rules should fill in method and content. This paragraph describes a passed amendment whose commencement the paper does not state.

Issue 2 on printed page 31 proposes the method. The Secretariat suggests it is important that notice be posted clearly around the camera or sensor, in a place where people the device detects can sufficiently recognise it, and that the notice items be those needed to ease the person's unease and let them exercise a cessation request. It proposes working from the notice methods in the PPC's 2023 document on facial identification camera systems for crime prevention and security, and the related Q and A, extracts of which appear on printed pages 36 and 37. The House of Councillors resolution of 8 July 2026, printed page 7, had already asked for posting near the equipment and where detected people can sufficiently recognise it.

The cessation right is narrower than a summary would suggest. Amended Article 35(7), printed page 28, lets a person ask an operator to stop using or providing their specified biometric personal information without showing any unlawful conduct, but only where the information is included in retained personal data, and subject to ten listed exceptions. This too is passed amendment text, not yet shown by the paper to be in force. Those include information created or acquired with the person's prior consent, handling required by law, protection of life, body or property, public health and child welfare, cooperation with government functions, two academic research cases, handling clearly necessary and unavoidable to perform a contract with the person, or another Rules-defined case where, from the circumstances of creating the code or acquiring the information, it is obvious the handling is not contrary to the person's intent, and a Cabinet Order catch-all for analogous cases.

Issues 3, 4 and 5 on printed pages 32 and 33 are open questions. Should the Cabinet Order add exceptions to the notice duty beyond the three statutory ones? A footnote explains why no exception exists for cases where the purpose is obvious from the circumstances: for facial-feature data, the Secretariat says, it is not normally conceivable that all notice items are obvious to the person. Should the Rules-defined cessation exception mirror the one proposed for item 1-1? And is there any further analogous case for the Cabinet Order catch-all? Printed page 30 states the limit: the Rules exception can only cover cases where it is self-evident that the person is willing, or is in a position, to consent to the handling of facial-feature data. Printed page 26 also records that, under the amended Act, whose commencement the paper does not state, third-party provision of this information under the opt-out mechanism would be barred, citing the Article 27(1) proviso.

Under-16 rules: the threshold is in the Act, the exceptions are the question

The age line is statutory, not a 16 September proposal, and like the rest of the amendment its commencement is not stated in the paper. Printed page 20 restates that for a person under 16, amended Article 40-2 reads the consent and notice provisions as addressed to the legal representative, subject to exceptions such as a justified reason for not knowing the person's age, and that Article 58-3 would place a responsibility clause on operators to endeavour to take necessary measures, giving priority to the child's best interests. Under amended Articles 35(9) and (10), the first reproduced on printed page 21, a person under 16, or their legal representative, could request cessation of use or of third-party provision of retained personal data without showing unlawful conduct, subject to twelve listed exceptions. Printed page 4 notes the current position rests only on guidelines and a Q and A that generally put the line at 12 to 15.

The paper's own questions are on printed page 23. Issue 1 asks what the Rules should specify as cases where, from the circumstances of acquisition, it is obvious that the under-16 person's rights and interests are not harmed (exception viii), and proposes aligning with the general contract-based exception discussed under item 1-1. Issue 2 asks which publishing bodies should count for the public-information exception (exception ix) and proposes the same list as current Rules Article 6, reproduced on printed page 24: foreign governments and international organisations, foreign academic bodies and foreign press equivalents. Issue 3 asks whether the Cabinet Order catch-all (exception xii) needs any further case.

Printed page 22 states the same limiting principle for children as for adults. A Rules-defined exception can only cover cases where it is self-evident that the legal representative is willing, or is in a position, to consent and that no unforeseen infringement of the child's rights results. The Cabinet Order catch-all can only cover cases analogous to the eleven statutory exceptions.

Contract-based consent exceptions, and the AI rules that are listed but not discussed

Item 1-1 is the general consent exception. Amended Articles 18(3)(vii), 20(2)(vii) and 27(1)(viii), reproduced on printed page 13, would allow purpose-exceeding use, acquisition of sensitive personal information and third-party provision without prior consent where it is clearly necessary and unavoidable for performing a contract with the person, or in other Rules-defined cases where, from the circumstances of acquisition, it is obvious the handling is not contrary to the person's intent. Printed page 14 says the Rules can only cover cases where the person's willingness to consent is self-evident. These are passed amendment provisions; the Rules that would fill them do not yet exist.

Issue 1 on printed page 15 proposes two additions for the Rules, each carrying the same necessity test as the statutory exception. The first is handling that is clearly necessary and unavoidable to perform a contract between the operator and a third party, where the contract is one that, from the circumstances, is obviously not contrary to the person's intent and so does not harm their rights and interests; the example is a family member booking a hotel stay for the person, so that the booking site passes the person's name to the hotel. The second is handling that is clearly necessary and unavoidable to meet the person's own request before a contract with the person is concluded; the example is a 3-D Secure card authentication passing device data from an e-commerce site to a card company. Printed page 16 reproduces the minister's Diet answer of 21 April 2026 that necessary and unavoidable means there is a necessity and the purpose of the contract cannot be achieved by other means. Issue 2 asks whether the same cases should apply where the person is under 16.

The statistics-and-AI rules appear once, on printed page 8, in a table of matters to be set by Cabinet Order, Rules and guidelines. That table records that the Rules are to specify which statistics creation and AI development activities carry little risk to individual rights and interests under amended Article 2(13), together with publication requirements and a conformity system under Articles 30-2, 31-3 and 72-3. The paper does not discuss those rules, propose their content or give a date. It says only that other items will be taken up at future meetings. Nothing in this paper grants any consent-free AI processing.

What we did not verify

What we opened: the 39-page PDF served by the PPC at the 260916 basic-approach URL, read as pdftotext output end to end, including the cover, printed pages 1 to 38, the reproduced statutory text on printed pages 13, 21, 27 and 28, and the Diet materials on printed pages 6, 7, 16 and 35. We also opened the PPC's 369th meeting page, which lists the paper as agenda item 1 and document 1 for 16 September 2026 with a draft marker in its title, and the PPC amendment page, which links the PDF we read under a 369th-meeting decision label. The verbatim quotation was matched character for character against the extracted text; the extraction renders one character with a CJK radical code point and we preserved the extracted bytes.

What we did not open: the separate document-1 PDF linked from the meeting page, whose file name and size differ from the PDF we read, so we cannot say whether the two versions differ; the meeting summary and minutes; the reading-substitution table for under-16 provisions; the promulgated text of Act No. 56 of 2026 beyond the extracts reproduced in the paper; the current Cabinet Order and Rules beyond the extracts reproduced; the PPC's 2023 facial identification camera document and the biometric survey report of December 2025; and any commencement order for the amendment.

What we refuse to claim: we do not say the Commission adopted each proposal, because the paper phrases them as questions and we did not read the minutes. We do not say a public consultation is open or closed, because this paper is not a consultation notice and we did not search the consultation register. We do not say whether any part of the amended Act is in force, because the paper does not state a commencement date and we did not check one. We do not say facial-recognition deployments in Japan now face notice or cessation duties, because no duty is created or commenced by this paper. We do not say this was the first signal that facial-feature data would be covered, because the paper cites earlier material and Diet debate on that point. We do not say when or how the statistics-and-AI rules will be settled, because the paper gives no installment and no date. We give no estimate of how many operators or systems are affected, because the paper gives no number. Where we use the word would, it describes a passed amendment whose commencement we have not verified.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Japan APPI amendment Act No. 56 of 2026 promulgated
• Japan APPI amendment enacted: surcharge and sensitive data
• Japan APPI amendment: statistical processing and profiling
• Asia-Pacific AI regulation tracker
• AI Regulation News hub