Tasuku Mizuno: Legal Design for DX

In preparation for the establishment of the Digital Agency (provisional name), several digital reform-related bills were approved by the Cabinet in February 2021, and are scheduled to be passed during the 204th ordinary session of the Diet convened in January. In this article, I will first provide an overview of the contents of these recently approved digital reform-related bills, and then offer my personal views on the remaining challenges and the essence of legal design for DX (Digital Transformation).

First is the Basic Act on the Formation of a Digital Society (hereinafter the "Basic Act on Formation"). The Basic Act on Formation defines the "digital society" to be aimed for (Article 2) and, as the name "Basic Act" suggests, stipulates ten basic principles and defines the responsibilities of the State, local governments, and business operators in accordance with those basic principles. It is characteristic in that it also stipulates the responsibilities of business operators, based on the principle that the private sector should play a leading role (Article 9). Furthermore, it serves as the enabling legislation for the Digital Agency Establishment Act (draft), which was approved by the Cabinet at the same time as this Act. Digitalization is a means, and if the vision of the society to be realized through digitalization is vague, it may end up as a mere pipe dream. The fact that the vision of the "digital society" (Article 2) that the government aims for in the future has been codified by the Basic Act on the Formation of a Digital Society is a significant achievement. Going forward, it is expected that the Act will not be allowed to become a dead letter as an abstract law of principles, but will be utilized in policy as the enabling legislation for subordinate laws and independent ordinances.

While the importance of the Basic Act on Formation as a basic law goes without saying, the Act on the Development of Relevant Acts for the Formation of a Digital Society (hereinafter the "Relevant Acts for Development") has a greater practical impact. In order to implement measures related to the formation of a digital society based on the aforementioned Basic Act on Formation, it includes: (1) a review of the personal information protection system, (2) streamlining the My Number system and fundamentally improving the convenience of My Number cards, and (3) a review of various procedures requiring seals and the delivery of documents. Regarding (1) above, the issue where regulations for personal information protection were fragmented among companies, the State, local governments, and independent administrative agencies under three different laws—the Act on the Protection of Personal Information, the Act on the Protection of Personal Information Held by Administrative Organs, and the Act on the Protection of Personal Information Held by Independent Administrative Agencies, etc. (the so-called "2,000-item problem")—will be integrated into a single law to provide common rules. Regarding (3) above, there are transactions where seals and documentation are legally required in situations where cautious transactions are necessary, such as in the real estate field. These had been hurdles for the introduction of electronic contracts such as CloudSign, but the obligation to use seals will be abolished, and the obligation for documentation will be relaxed.

While some view DX as mere digitalization, as the Basic Act on Formation clearly states that a requirement for a "digital society" is to "obtain, share, or transmit diverse information or knowledge on a global scale freely and safely through the Internet and other advanced information and telecommunications networks" (Article 2), the biggest key to DX is how to smoothly share and utilize digitalized information—that is, the realization of advanced data sharing. However, as a legal system, there are still major hurdles to the realization of advanced data sharing. Specifically, because data contains or is mixed with personal information, privacy, copyrighted works, trade secrets, etc., it is subject to the regulations of the Act on the Protection of Personal Information, the Copyright Act, the Unfair Competition Prevention Act, or tort law, and these must be examined one by one. It is no exaggeration to say that whether these information laws can be adjusted toward advanced data sharing without undermining the values cultivated by democratic societies directly relates to the feasibility of realizing a data-sharing society. Such legal challenges are not unique to Japan; the US and EU face similar issues. However, the conflict is intensifying due to the growing influence of China, which prioritizes the convenience and economic efficiency of data sharing over the protection of personal information and privacy, as well as public health requirements during the COVID-19 pandemic. While it might be said that the aforementioned digital reform-related bills have eliminated most of Japan's unique legal obstacles regarding data sharing, the core of the problem remains unchanged.

Of course, the government is also aware of the aforementioned legal issues, and each law has been making efforts to realize data sharing. For example, in the Act on the Protection of Personal Information, the 2020 amendment established a new pseudonymized information system to contribute to internal analysis for the purpose of promoting innovation, and the operation of the Act on Anonymized Medical Data to Contribute to the Development of New Medical Technologies and Services, aimed at promoting advanced R&D and the creation of new industries related to health and medical care, has also begun.

In the Copyright Act, the introduction of flexible rights limitation provisions in the 2018 amendment to respond to the progress of digitalization and networking has made the use of new works utilizing new technologies easier compared to other countries, and it is being utilized in practice. Additionally, the compensation system for public transmission for educational purposes, also established by the same amendment, was implemented in April 2020, earlier than originally planned, to urgently respond to needs such as remote classes accompanying the spread of COVID-19. Furthermore, the Agency for Cultural Affairs is discussing legal amendments to facilitate rights clearance for simultaneous internet streaming of broadcast programs, and the Intellectual Property Strategy Headquarters is also discussing the promotion of centralized management of works and a Japanese version of the Extended Collective Licensing system (*1) to facilitate the use of works.

There are likely two major radical approaches to realizing a data-sharing society. One is the approach of amending each law individually. However, the Ministry of Internal Affairs and Communications is in charge of personal information protection laws, the Agency for Cultural Affairs for copyright, and the Ministry of Economy, Trade and Industry for the Unfair Competition Prevention Act, meaning there is no "control tower" for the rules of data sharing as a whole. The Digital Agency is expected to serve as this control tower, but since each law has a different history, human rights origins, and justifications, it remains to be seen whether coordination can be achieved across these ministerial silos to promote data sharing.

The other approach is to enact a general law regarding data sharing, such as a "Data Act," separately from the aforementioned laws. For example, the EU has set out a plan to enact a "Data Act" in 2021 as a comprehensive legal framework for data, based on the "European Strategy for Data" announced by the European Commission in February 2020. However, even in the EU, it must be said that it remains unclear whether a logic can be constructed and adjustments made to truly "overwrite" or "add to" fundamental legal systems such as the personal information protection system like the GDPR enacted in 2016 or the copyright system including the DSM Copyright Directive enacted in 2019.

When considering what legal design for DX is, the ultimate destination is the fundamental challenge of how to shape the interaction and symbiotic relationship between technology and law. The words of President Kersti Kaljulaid of Estonia, a country hailed as a digital nation—"A digital state is not technology, but the carefully crafted legal system around it"—express this essence beautifully.

To conclude this article, I would like to list three key perspectives and initiatives.

The first is how to link the review of regulations and legal systems through experiments and demonstrations based on new technologies, and how to create a cycle between rule-hacking and rule-making (*2, 3). From that perspective, it is noteworthy that the Cabinet also decided in February 2021 to transfer the "Regulatory Sandbox System," which was a temporary measure, from the Act on Special Measures for Productivity Improvement to the Act on Strengthening Industrial Competitiveness and make it permanent.

The second is ELSI/RRI, which re-examines the interaction between technology and law from a long-term and fundamental perspective (*4). ELSI/RRI refers to initiatives to research and address ethical, legal, and social issues arising from the development of science and technology in advance. It intends to promote science and technology in a way that aligns with social needs and expectations through the participation of diverse stakeholders throughout the entire process from research to innovation. Moving forward, it will likely be necessary to integrate a wide range of ELSI/RRI initiatives with R&D and innovation efforts from the perspective of the symbiotic relationship between technology and law.

The third is institutional design to secure data commons. Despite the enforcement of the Basic Act on the Advancement of Public and Private Sector Data Utilization in 2016, which mandated the State and local governments to work on open data, the enrichment of open data lags significantly behind other countries. To realize DX, it is necessary to bolster this point as well. As symbolized by the phrase "Data is the crude oil of the 21st century," as the value of data is emphasized, the demand for data ownership will likely increase further. However, essentially, ownership cannot be conceived for intangible data and information; only usage and access rights are established. A legal system that grants exclusive monopoly rights over data to specific individuals would be a major obstacle to data sharing. Furthermore, to compete against giant US IT companies that already have access to massive amounts of data, it is necessary to enrich data that anyone can access freely. Not only public open data that can be utilized freely, but also data acquired by companies should be turned into data commons under certain conditions. This will become increasingly important from the perspective of international competitiveness, as well as from the perspective of the technological sovereignty of Japan and each of its citizens.

*2 My article "Circulate Rule-making and Hacking" (WIRED)

*3 Regarding this point, the Ministry of Economy, Trade and Industry has summarized a model in a report where companies become the central players, moving away from the traditional model where the State handles everything from rule design to monitoring and enforcement. "GOVERNANCE INNOVATION: Redesigning Law and Architecture for the Realization of Society 5.0" Report