Ignored discrepancies in the fundamental concepts of data protection laws in Japan and the EU

equivalent to its own. 4 The joint statement by the data protection commissioners of the two territories welcomed their mutual adequacy decisions, as they 'ensure the sustainability of our increasingly data driveneconomy and facilitate commercial flows'. 5 To make the EU-Japan data cooperation more robust, this article highlights the fundamental conceptual discrepancies between the APPI and the GDPR that remain unaddressed.These relate to the definitions of who is a regulatory subject and what is protected information.We found that these discrepancies in the definition of core concepts of data protection have gone unexamined by governments and scholars, albeit the mutual adequacy findings.The narrower scope of the APPI manifested itself in tangible harms in cases such as the Rikunabi data scandal in 2019.By tracing the government discussion to enact the APPI, we show that Japan inadvertently deviated from the Organisation for Economic Co-operation and Development (OECD) Privacy Guidelines of 1980 (the Guidelines) in defining the regulatory subject. 6 The article first discusses two discrepancies in the fundamental concepts of data protection in Japan's APPI and the EU's GDPR.The first discrepancy relates to protected information in the form of 'personal information' under the APPI and 'personal data' under the GDPR.The second relates to regulatory subjects, specifically the business handling personal information (BHPI) under the APPI and the controller under the GDPR.We show that the APPI has a narrower regulatory scope than the GDPR in both terms.We then delve into the Rikunabi data scandal.The operator of a webbased job board calculated jobseekers' probability of declining job offers based on their browsing history and sold these data to contracting companies without informing the data subjects.The data processed by the operator were designed not to fall under protected information under the APPI 2015.Therefore, the Personal Information Protection Commission (PPC) failed to point to illegality outside of procedural defects in this service. 7 We also trace Japan's discussion about the definition of regulatory subject from 1980 to 2003, when the APPI was enacted.The historical record suggests that Japan's divergence was an inadvertent consequence.Finally, we provide concluding remarks. Two differences between the Japanese and EU data protection legislationThe difference in defining protected information Four categories of personal data under the APPI One of the most conspicuous differences between the APPI and the GDPR resides in the definitions of protected information.Except for sensitive and anonymized data, the APPI categorizes protected information into four types defined by searchability and identifiability.In contrast, the GDPR is founded on personal data.The four categories of protected information under the APPI are discussed below.