Legal Regulations and Outlook on Cross-Border Sharing of Medical and Health Data: A Japanese Legal Perspective

The increasing cross-border sharing of medical and health data among professionals, coupled with the global use of various Software as a Service (SaaS) platforms in health management and the expansion of Software as a Medical Device (SaMD)Software as a Medical Device (SaMD), highlights the unignorable conflict between data sharing and personal information protection. Current personal information protection laws in JapanJapan, primarily represented by the Act on the Protection of Personal InformationAct on the Protection of Personal Information (APPI), fail to adequately prioritize the health and life of patients and citizens over personal information protection. Consequently, this failure impedes the proper resolution of the conflict. This chapter outlines the legal framework for personal information protection in JapanJapan, including perspectives on both domestic and cross-border data sharing. Furthermore, this chapter examines the application of Japanese laws to cross-border sharing of medical and health data using multiple use cases. To aid readers in their understanding, the authors have prepared use cases in which every node is located within JapanJapan, before moving on to use cases where nodes are distributed both inside and outside JapanJapan. Lawmakers, governments, and legal and medical practitioners in JapanJapan are not unaware of the conflict between personal information protection and the protection of health and life. This chapter also outlines the Next Generation Medical Infrastructure ActNext Generation Medical Infrastructure Act (NGMIA), which is a typical example of efforts to mitigate such conflict, though its scope of application is limited to R&D purposes and is domestic. This chapter does not merely detail the application of current laws and their drawbacks, but also envisions directions for legal improvements that would enable the promotion of international cooperation.