A new law lets Japanese businesses use medical records, criminal history, and race to train AI systems — with penalties only kicking in when 1,000 or more people are affected in a single case.
Japan's parliament has passed a bill letting businesses collect and use personal data, including criminal records, medical history, and race, for AI development without individual consent. Penalties for misuse only trigger when 1,000 or more people are affected in a single case, a threshold opposition parties have called too narrow to deter abuse.
The House of Councillors, the upper chamber of Japan's Diet, passed the bill on May 26, 2026, amending the Personal Information Protection Act by majority vote. The bill had already cleared the House of Representatives earlier in May. The ruling Liberal Democratic Party-led coalition received support from two smaller parties, the Democratic Party for the People and Team Mirai.
Four opposition parties voted against: the Constitutional Democratic Party of Japan, Komeito, Sanseito, and the Japanese Communist Party. Their shared critique was that the bill opens sensitive records to commercial AI training without requiring consent, while the enforcement regime is too weak to prevent misuse.
The law creates a new exemption allowing businesses to collect and provide personal data without consent solely for statistical analysis and AI development, a move the government frames as essential to Japan's competitiveness in AI. The exemption explicitly covers sensitive personal information, a defined legal category that includes criminal records, race, and medical history, despite opposition calls to exclude such data from the carve-out.
The bill introduces an administrative penalty system requiring those who illegally obtained or used personal data to pay penalties equivalent to unlawfully earned profits. The deterrent only applies in serious cases affecting more than 1,000 individuals. Critics say that floor leaves most violations untouched by financial penalty.
Legal practitioners tracking the bill note the practical surface area of the law will be set by Personal Information Protection Commission guidelines, which have not yet been published. Until those guidelines land, the law's text is the only rule in force.
In the same Diet session, the Upper House also enacted a bill to revise the digital administration advancement law. The companion measure establishes a framework allowing certified private-sector operators to use government-held data, including map information, for purposes such as autonomous driving technology. Read together, the two bills form a single policy package that expands the data available to industry while leaving most of the regulatory perimeter to be defined by future cabinet order and agency guidance.
The revised privacy law takes effect within two years of promulgation in principle. Promulgation date, the cabinet order that implements the law, and the Personal Information Protection Commission's first guideline package are the next concrete milestones. Each one will determine how much of the new permission is actually used, and how often the penalty regime ever fires.