Privacy (Puraibasii プライバシー) is the fourth of 10 Principles per Japan AI Guidelines for Business + intersects with APPI Act on Protection of Personal Information (2022 Amendment effective April 2023) + Copyright Act 2018 Amendment Article 30-4 (text and data mining exception). (1) Privacy Principle Definition: (a) personal information protection across AI lifecycle; (b) APPI compliance + Personal Information Protection Commission (PIPC) coordination; (c) Privacy-Enhancing Technologies (PETs) deployment where appropriate; (d) data minimisation + purpose limitation. (2) APPI 2022 Amendment + AI Coordination: (a) effective 1 April 2022 (revisions effective 1 April 2023 + 1 April 2024); (b) personal information includes AI training data containing identifiable individuals; (c) pseudonymous information (Kameisei) category for AI/analytics use with relaxed obligations + retained obligations + statistical use exemptions; (d) Anonymous information (Tokumeisei) category for fully anonymised + statistical use; (e) Article 21 right to disclosure of processing logic for individual automated decisions; (f) Article 21-2 right to human review + intervention; (g) Article 27 cross-border transfer restrictions; (h) PIPC enforcement + administrative + criminal penalties up to JPY 100 million corporate. (3) Copyright Act 2018 Amendment Article 30-4 Text Data Mining Exception: (a) widely used for AI training data acquisition; (b) permits use of copyrighted works for non-enjoyment purposes including (i) statistical processing; (ii) machine learning training; (iii) information analysis; (b) limits - cannot reproduce + distribute output containing substantial copyrighted content; (c) cannot use if author has expressed opt-out + technical opt-out signals emerging; (d) Japan's relatively permissive AI training data regime vs EU + US; (e) ongoing debate + 2025-2026 review. (4) Training Data Governance: (a) Source Verification - licensing + copyright status + APPI personal information flagging; (b) Quality Assessment - completeness + accuracy + representativeness + freshness; (c) Bias Assessment - protected attribute distribution + intersectional analysis; (d) Provenance Tracking - end-to-end data lineage + audit trail; (e) Version Control - dataset versioning + reproducibility; (f) Documentation - Datasheet for Datasets per AI dataset. (5) Data Provenance + Lineage: (a) Source - origin + acquisition method + licensing; (b) Acquisition Date + Process; (c) Pre-processing Steps - cleaning + augmentation + filtering + transformation; (d) Pre-processing Code - reproducible pipeline; (e) Storage Location + Access Control; (f) Usage History - which models trained + which experiments; (g) Update + Refresh history; (h) Decommissioning + retention; (i) Tools - MLflow + DVC + Weights and Biases + LakeFS. (6) Personal Information Specific Controls: (a) APPI-aware data pipeline; (b) Pseudonymisation + Anonymisation + Differential Privacy; (c) Federated Learning + on-device processing; (d) Encryption at-rest + in-transit + in-use (TEE); (e) Access Control + Role-Based + Need-to-Know; (f) Audit trail of personal data access; (g) Right to deletion impact on trained models (machine unlearning emerging). (7) Cross-Border Data Considerations: (a) APPI Article 24 restrictions on transfer to non-adequacy jurisdiction; (b) Japan EU Adequacy 2019 + UK Adequacy 2023; (c) Standard Contractual Clauses (SCC) Japan-PIPC approved; (d) Binding Corporate Rules + Privacy Mark (J-Mark); (e) US Adequacy decision under negotiation; (f) Foreign AI provider data residency. (8) Sensitive Data Specific: (a) APPI Article 2 Sensitive Personal Information; (b) explicit consent required; (c) AI training on sensitive data - medical + biometric + genetic + criminal record - additional safeguards; (d) PIPC guidance on AI sensitive data processing; (e) sector-specific - PMDA medical AI + FSA financial. (9) Children's Data: (a) APPI special protection for children under 18; (b) parental consent for under 16; (c) AI services targeting children - age-appropriate design; (d) COPPA-equivalent emerging in APPI + 2026 revision. (10) Data Retention + Deletion: (a) retention period documented per processing purpose; (b) deletion mechanism + secure wipe; (c) backup retention compliance; (d) AI model containing personal information - retention vs APPI right to deletion (open issue + machine unlearning research); (e) decommissioning process for AI systems containing personal data. Coordinates with APPI Act on Protection of Personal Information 2022 Amendment + Personal Information Protection Commission (PIPC) + Copyright Act 2018 Article 30-4 Text Data Mining + EU GDPR + EU AI Act + UK DPA 2018 + ISO/IEC 27701 PIMS + ISO/IEC 27018 Cloud PII + Datasheets for Datasets + MLflow + DVC + Privacy-Enhancing Technologies (PETs) Network + Federated Learning frameworks + Differential Privacy frameworks + Japan EU Adequacy Decision 2019 + UK Adequacy 2023 + Privacy Mark J-Mark + JIPDEC. Japan AI Guidelines Data Governance + Privacy applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.