Japan’s Act on the Protection of Personal Information (PPI Act, 2003) is currently being amended,1 largely due to information and communication technology developments that have markedly increased the nature and usage of personal data. Indeed, the growth and global movement of data have caused countries around the world to reconsider the categories of personal data that should be protected, and how they should be protected. The amendments also come in the wake of efforts by the Organization for Economic Co-operation and Development, European Union and the United States to encourage the use and application of personal information by reconsidering their regulatory environment.2, 3, 4

The PPI Act, 2003 provided for general obligations for proper handling of personal information with very few definition of data type, therefore have not treated currently important personal data including sensitive data and ‘big data’ in detail. The amendments aim to stimulate the discussion for multidisciplinary utilization of such personal data to create and promote economic innovations in Japan.5 The general outlines of the amendment of the PPI Act were made public in 2014 on 19 June and the period for public comment ended on 24 July.

The discussion relating to the amendments of the PPI Act barely touched upon the issue of human genome data. One reason for this was that very few of those involved in the amendment process raised the issue. Another reason was that ultimately genome data were not considered to fit into any of the categories of ‘personal information’, including a new category created by the governmental committee.

This was a missed opportunity. Since next-generation sequencing technology has appeared, full-genome sequencing for large numbers of people has become possible. And with the rise of the data analysis techniques that can be used for a variety of purposes, it can be said that the age of the ‘personal genome’ has arrived. Over the past several years in Japan, the creation and reorganization of large-scale genome cohort studies has begun, and data related to personal genome information, as well as other clinical and health data, have been gathered from hundreds of thousands of individuals and are already being put to use. More recently, Internet advertisements for personal genetics services have become more common in Japan, and even some national universities have been collaborating with businesses in order to popularize these services. So, it seems inevitable that such consumer-directed services will continue to increase in popularity among the general public in the future. Even in academia, many medical institutions are outsourcing ever-advancing and complex DNA analyses to business services by commercial companies, which analyze the genomes of patients and healthy individuals for medical research.

What all this suggests is that genome data should have been dealt in the amendment process of the PPI Act. In fact, the new category (which as yet has no official name) being created can be applied to much of the genome data indicated above, even if the old category of ‘personal information’ may not have covered them. If implemented, this unnamed category would include the kinds of data that, although not specific enough to identify and distinguish individual persons on their own, could do so when linked with other kinds of data. One of the main discussion points of the amendment process is how to protect these kinds of data and how they could be used for industry and social services innovations while protecting the rights and interests of individuals. Given this, it is somewhat surprising that genome data, which seems perfectly relevant here, was excluded from the discussion. Only 1 year was allowed for discussion before the amendment process began, and because Japanese law hitherto had not dealt with the protection of genome data, this limited discussion period did not give interested parties enough time to make clear the value of legal protection of genome data, and the terms on which such protection should be included in the amendment. Thus far, each ministry and governmental body has fixed its own guidelines for the use and protection of genome data, and these divergent guidelines also might have made it difficult for the discussion surrounding genome data to be clarified and settled.

Genome data are registered in many databases around the world, which are available on the internet, or are at least available in some form to certain approved users. However, from 2007 onwards, there were reported cases of de-identified genome data and gene expression data being taken from these databases and manipulated or linked with other available data sets to (re)identify individuals.6, 7, 8, 9 In the wake of such incidents, as well as traditional types of the security threats, such as hacking and stealing of the storage devices,9 data protection laws should provide assurances that misuse of genome data will minimized to the greatest extent possible. Yet, Japan’s current regulations on the management of genome data are based on government guidelines and not actual laws, which is wholly insufficient. It is necessary for Japan to have internationally recognized data protection standards so that we can both help prevent the misuse of Japanese data at home and abroad and at the same time encourage the appropriate use of foreign data within Japan.

The public comment period for the current amendment has ended, so introducing new points for discussion will be difficult. However, if we recognize the importance of providing legal support for the proper usages and protection of human genome data, immediate actions are needed. Specifically we suggest: (1) the academic and corporate institutions, which make use of large amounts of human genome data, create a unified human genome data protection policy recommendation toward the domestic policy makers, government and the global communities, and at the same time (2) increase awareness in the Japanese society on the proper usage of human genome data through the mass media and other means. The current amendment of the PPI Act, 2003 gives not only people in certain domains, but also the society at large, an important opportunity to examine and discuss the proper usage of human genome data. We should not let this opportunity pass us by.