Personal Information Protection Commission Releases Guidelines Regarding Data Breach Responses

Japan has enacted sweeping amendments to its Act on the Protection of Personal Information, introducing an administrative surcharge regime with monetary penalties for data protection violations, new protections for children under 16 and biometric data, and expanded exceptions for data utilization in statistical analysis and AI development. The reforms, which take effect in stages through 2028, fundamentally reshape Japan's privacy enforcement landscape by granting the Personal Information Protection Commiss

Although domestic enforcement volumes in Japan remain modest in some areas compared with overseas authorities, actions by foreign regulators against Japanese companies...

Japan and the European Union recently announced an agreement to recognize each other's data protection regimes as adequate.

In an effort to increase artificial intelligence ("AI") and Metaverse business in Japan, the government has enacted new legislation and established various supporting guidelines in recent years.

The rise of social media combined with expanded opportunities for flexible work present new challenges for Japanese employers.

The Act on the Protection of Personal Information ("APPI"), which was enacted in 2003, took full effect in April 2005.

The Supreme Court affirmed the lower court's decision to dismiss the individual's claim because the facts were related to public interest and because the search results were not widely disseminated.

The Commission aimed to unify existing ministerial guidelines under these new procedures and also released a set of specific draft guidelines, including: (i) draft guidelines regarding the provision of personal data to a foreign third party...

Japanese Government Issues Cybersecurity Guidelines

Under a supplementary provision in the Act on the Protection of Personal Information (the "APPI"), it is stipulated that a review of the APPI must be made every three years following its implementation.

The Code is voluntary, but it will likely become an important reference point for demonstrating compliance with Article 50 of the AI Act.

The New York Stock Exchange and Nasdaq are implementing overnight trading sessions starting December 6, 2026, extending the trading day to nearly 23 hours by compressing the daily pause to just one hour. While this evolution toward continuous trading introduces new considerations for corporate actions, disclosure timing, and deal execution, the practical impact varies significantly between NYSE-listed companies,

The Ninth Circuit Court of Appeals vacated a preliminary injunction against Perplexity AI, determining that when an AI agent acts at a user's direction, it is the user—not the AI company—who "accesses" computer systems under federal and California computer fraud statutes. This landmark appellate decision addresses how existing computer-access laws apply to agentic artificial intelligence and has significant implications...

China's Supreme People's Court has issued comprehensive judicial rules addressing artificial intelligence disputes, establishing frameworks for product liability, intellectual property rights, and data protection. These landmark opinions provide critical guidance for global companies navigating AI-related legal risks in China's evolving regulatory landscape.

The Illinois Holocaust Museum & Education Center (IHMEC) held a third program as part of its Jones Day Foundation Community Series, a special series of educational events

The Ninth Circuit has ruled that health plan participants whose confidential information was disclosed without authorization have standing to sue in federal court, even without showing financial loss or future harm. This decision, which departs from the risk-based approach many courts have applied since TransUnion, relies on the centuries-old action for breach of confidence and could have significant implications for companies' privacy commitments and data-sharing practices.

The European Commission has initiated infringement procedures against 20 EU Member States for failing to transpose the EmpCo Directive by the March 27, 2026 deadline. This directive aims to combat greenwashing by requiring substantiation of environmental claims and third-party certification for sustainability labels, with full implementation expected by September 27, 2026.

Mexico's comprehensive anti-money laundering framework has undergone a sweeping transformation through Acuerdo 115/2026, introducing mandatory risk-based methodologies, enhanced client due diligence protocols, and automated monitoring requirements. With implementation deadlines beginning March 1, 2027, obligated parties conducting vulnerable activities face compressed timelines to overhaul their compliance infrastructure while navigating heightened enforcement risks and stricter beneficial ownership thresho

The Environmental Protection Agency has proposed two rules that would significantly alter the regulatory landscape for PFAS in drinking water, rescinding standards for four substances...

A federal court ruling in Indiana has opened the door to class action lawsuits against email marketers, holding that promotional subject lines like "SO MANY FREE GIFTS INSIDE" may violate state anti-spam law even when email bodies contain full disclosures. The decision exposes businesses to $500 in statutory damages per email and creates a new litigation hotspot following similar developments in Washington state.