News

In recent years, the accumulation of data by companies has progressed and active cross-border data transfer has taken place more frequently. In these circumstances, there have been many cases where a crime is committed in Japan, but data that is material evidence in the subsequent criminal investigation is held by a company on servers located in a foreign country. In order for Japanese investigating authorities to effectively obtain data necessary for investigations, and in order for the criminal laws and regulations of Japan to be appropriately and expeditiously applied, it is increasingly important not only to obtain data stored on the terminals of suspects, but also to obtain data held by companies in Japan and in foreign countries.

However, when obtaining data held by companies, it is essential to appropriately take into account the protection of the rights of Data Subjects, the burden on companies holding data, securing the effectiveness of investigations, how to ensure consistency with international law and shape an appropriate way of international collaboration, and various other issues.

Under these circumstances, on March 23, 2018, the Clarifying Lawful Overseas Use of Data Act (the “CLOUD Act”) was enacted in the United States. The CLOUD Act recognizes and clarifies the procedures performed, for example, when a U.S. investigation agency issues an order to disclose data that a U.S.-based company stores on servers located outside of the U.S. In connection with this, NIALS held a symposium about the CLOUD Act on March 13, 2019 to enhance awareness about issues concerning the CLOUD Act among the industrial, governmental, and academic sectors in Japan.

Following this, the CLOUD Act Study Group (Chairman: George Shishido, Professor, The University of Tokyo Graduate Schools for Law and Politics) was established within NIALS, for the purpose of analyzing and making proposals regarding broad issues related to methods for obtaining data held by companies for the purposes of criminal investigations in relation to the laws and regulations of Japan and international law. The Study Group also considers issues concerning cross-national collaboration and public-private collaboration. In sum, the Study Group aims to shape how Japan should react to the CLOUD Act.

The Study Group consists of legal scholars, and was managed by the lawyers of Nishimura & Asahi who served as the secretariat. In the course of discussions, the Study Group obtained input from a substantial number of domestic and foreign Internet companies and technology companies.

The results of the Study Group have been prepared and released in the Report by the CLOUD Act Study Group, which summarizes the legal analysis and the proposals on criminal investigation obtaining data held by companies. The report can be downloaded at the website below.

The results of the Study Group’s analysis can be summarized into the following three points, which are the main proposals in the report:

1. Further Utilizing Existing Investigative Techniques for Obtaining Data Held by Companies, and, in the Mid-long Term, Considering New System Designs
In terms of designing a system for the obtainment of data held by companies for investigative purposes, in order to address these issues in the short-term, it should be ensured that investigation authorities can efficiently and effectively obtain data held by companies by actively utilizing the existing means of seizure by an order to produce a copy of records through cooperation with companies, while taking into account the interests of Data Subjects and companies. In the mid- to long-term, it is necessary to advance discussions to design a new system, from various viewpoints, such as ensuring the fairness and transparency of procedures (including the establishment of systems to provide notice to Data Subjects and companies), expansion of the system to impose confidentiality obligations and similar restrictions, digitization of warrant proceedings, and to analyze relationships with other laws and regulations concerning data protection. In addition, the prospect of the data so obtained being used in a criminal trial should also be considered.

2. Deepening Discussions Regarding Trans-border Data Access From the Prospect of International Law and Establishing a Cross-national Framework
Given the importance of investigation authorities’ prompt access to certain data, Japan should endeavor to deepen discussions of investigation methods that accord with international law maintaining Japan’s policy of respecting the sovereignty of other states. Regarding the advancement of international collaboration, for Japan, it could be effective to first build a framework with like-minded countries with which Japan shares a common sense of values in accordance with the concept of Data Free Flow with Trust. From this viewpoint, it is advisable to advance necessary discussions regarding related legal issues by considering a bilateral international agreement with like-minded countries, such as the U.S.

3. Promoting Companies’ Efforts to Ensure Transparency of Public Access
In order to obtain a deeper understanding by Data Subjects and civil society regarding obtainment of data held by companies for investigative purposes, in addition to government-level efforts, it is important that companies and industries also make voluntary efforts to ensure transparency in the processing of public institutions’ requests for the provision of data held by companies (public access). Companies and industries are also expected to advance discussions on specific efforts to ensure transparency and public access and to make increasing efforts in this regard.

We hope that, moving forward, the Study Group’s proposals and supporting considerations, made from a legal perspective, will be helpful to discussions on laws and policies in Japan and for the creation of an international framework regarding data held by companies and investigations.