On 25 March 2020 the Tokyo High Court rendered a judgment regarding the amount of personal damages owed to victims of a personal information leak by a third party.
Prior to this ruling, the standard amount of compensation for personal damages proposed by numerous 'business operators handling personal information' (as defined under the Act on the Protection of Personal Information (57/2003)) was Y500 per victim.
Numerous victims have filed lawsuits demanding a higher level of compensation, such as Y100,000 per person. However, these claims have been rejected because any mental suffering or anxiety caused by a personal information leak cannot be evaluated monetarily; thus, victims are not considered to be entitled to financial compensation.
However, on 23 October 2017 the Supreme Court ruled in a case involving a leak of personal information (ie, name, sex, birth date, postcode, residential address, phone number and parent's name) by a company that collected this information for educational purposes. The leak was caused by an employee of a subcontractor of the company who had maliciously intended to earn money from the leak. The leaked data was disseminated to more than 500 personal information traders.
The Supreme Court ruled that affected customers could claim damages for their mental suffering even though they could not prove economic loss. However, because there was no definitive determination on the quantative evaluation of their mental suffering, the case was remanded to the Osaka High Court.
Following this Supreme Court judgment, numerous lower courts have granted financial remedies to victims of personal information leaks, but the criteria and valuation for determining personal damages were not sufficiently standardised. However, on deciding the above case on remand, the Osaka High Court proposed a standard valuation for mental suffering by comprehensively considering:
- the contents of the leaked personal information;
- the extent of the leak;
- the existence of actual damage; and
- any recovery measures taken by the company in charge of personal information management.
On considering the numerous facts of the case, the Osaka High Court increased the amount of compensation for mental suffering to Y1,000 per victim (in addition to the Y500 that the company had already paid).
On the other hand, other courts have granted different levels of compensation in almost identical cases. One such judgment is the Tokyo High Court's judgment of 27 June 2019, wherein it granted Y2,000 per victim (in addition to the Y500 that the company had already paid). However, no clear reasoning for the valuation was provided in the judgment.
The Tokyo High Court's 25 March 2020 judgment is the most recent on compensation for personal damages owed to victims of a personal information leak. This judgment granted Y3,300 per victim (in addition to the Y500 that the company had already paid). This is likely the highest amount granted for a leak of consumers' personal information by a business operator handling personal information. The case involves 35 million potential victims, so the total amount of potential compensation is approximately Y133 billion. The plaintiffs are still seeking more compensation, so it is possible that a higher amount may be granted in the future. As such, this judgment increases the risk for business operators which handle personal information.
