REGULATION OF DNA DATA STORAGE TECHNOLOGIES IN JAPAN

1. INTRODUCTION

DNA data storage technologies involve the collection, preservation, processing, and storage of genetic information in biological samples or digital formats. In Japan, these technologies are used in medical research, genomic medicine, forensic investigations, biotechnology, biobanking, and hereditary disease research.

The regulation of DNA data storage is not governed by one comprehensive DNA-storage statute. Instead, Japan applies a combination of personal information protection legislation, forensic identification rules, medical research regulations, bioethics guidelines, and institutional data-security requirements.

The central legal objectives are protecting genetic privacy, preventing unauthorised access, ensuring informed consent, maintaining data integrity, and regulating the secondary use and transfer of genetic information.

2. PRINCIPAL LEGAL FRAMEWORK

A. Act on the Protection of Personal Information (APPI), 2003, as amended

The APPI is the principal legislation governing personal information, including identifiable genetic and medical information.

Its important requirements include:

Appropriate acquisition and use of personal information.

Security-control measures against leakage, loss, and damage.

Restrictions on providing personal data to third parties.

Appropriate supervision of employees and entrusted service providers.

Compliance with applicable rules governing overseas transfers.

Genetic information can constitute personal information where it identifies, or can be linked to, an individual. Certain genetic characteristics also fall within the statutory category of personal identification codes.

B. Act on the Promotion of Genome Medicine (2023)

This legislation establishes a framework for promoting genome-based medical services while addressing the appropriate handling of genomic information.

It is particularly relevant to genomic databases, medical research repositories, and the management of information generated through genome analysis.

C. Forensic DNA Database Regulations

DNA information used for criminal investigations is subject to the Police Duties Execution Act, criminal investigation procedures, police regulations, and applicable rules concerning forensic identification.

The National Police Agency maintains forensic DNA information systems for criminal identification purposes. Such information must be distinguished from medical genomic databases because their purposes, legal foundations, and access arrangements differ.

D. Medical Research and Ethical Guidelines

The Ethical Guidelines for Medical and Biological Research Involving Human Subjects establish requirements for research involving human biological materials and personal information.

Researchers and institutions must address informed consent, ethical review, confidentiality, data management, and appropriate secondary use.

3. REGULATORY REQUIREMENTS FOR DNA DATA STORAGE

A. Informed Consent

Institutions collecting DNA samples should explain the purpose of collection, storage duration, research objectives, potential secondary use, data-sharing arrangements, and withdrawal procedures.

Consent must be appropriate to the nature of the research and applicable legal requirements.

B. Data Security

Institutions must establish reasonable security measures, including:

Access restrictions and authentication.

Encryption and secure storage.

Audit trails and access monitoring.

Backup and recovery arrangements.

Incident-response procedures.

Appropriate destruction or anonymisation when retention is no longer justified.

C. DNA Sample Preservation

Physical DNA samples require appropriate laboratory storage, sample identification, contamination prevention, inventory management, and documented chain of custody where forensic evidence is involved.

D. Cross-Border Transfers

Transfers of identifiable genetic information outside Japan must comply with applicable APPI requirements, including the rules governing provision of personal data to foreign third parties.

E. Commercial DNA Storage

Private genetic testing companies and biotechnology businesses must comply with applicable personal information protection obligations, contractual requirements, consumer protection rules, and relevant medical or research regulations.

4. JUDICIAL PRECEDENTS AND CASE LAW

Japan has relatively limited reported case law directly addressing modern DNA-storage technologies. The following decisions provide relevant constitutional, privacy, and forensic principles. The distinction between direct and analogous authority is important.

1. Supreme Court Judgment, 29 February 2000 — Jehovah's Witness Blood Transfusion Case (Analogous Authority)

The Supreme Court recognised the importance of respecting an individual's personal medical decisions and the obligation to provide appropriate explanations. Its reasoning is relevant to consent before collecting and storing genetic material for medical purposes.

2. Supreme Court Judgment, 24 December 1969 — Kyoto Prefectural Gakuren Police Photograph Case (Analogous Authority)

This judgment recognised constitutional protection against unjustified intrusion into personal privacy. It provides an important foundation for examining the collection and retention of identifying biological information.

5. IMPORTANT JUDICIAL PRECEDENTS

1. Nagoya District Court, 18 January 2022 — DNA Profile Data Deletion Case (Direct Authority)

This is an important Japanese judgment concerning the retention of DNA information by police authorities. The claimant had been arrested and prosecuted but was subsequently acquitted. The court ordered the government to delete the claimant's fingerprints, DNA profile, and photograph because continued retention was not justified by a sufficiently specific investigative necessity.

The court recognised that individuals possess a protected interest under Article 13 of the Constitution against arbitrary collection and continued retention of DNA identification information.

Legal significance: DNA database operators cannot justify indefinite retention merely by invoking general investigative usefulness.

2. Nagoya High Court, 30 August 2024 — Appeal in the DNA Data Deletion Case (Direct Authority)

The High Court upheld the relevant deletion order made by the Nagoya District Court. It confirmed the importance of assessing whether continued retention of DNA identification information remains necessary after acquittal.

Legal significance: Government authorities must respect personality rights and justify continued retention of identifying information.

3. Tokyo High Court, 23 August 2016 — Unauthorised DNA Collection Case (Direct Authority)

Police officers secretly collected saliva from a suspect's discarded drinking cup to obtain DNA identification information. The court held that the conduct constituted an unlawful compulsory investigative measure because it infringed an important personal interest without the required judicial warrant.

Legal significance: DNA collection methods must respect privacy, individual autonomy, and criminal procedural safeguards.

4. Supreme Court of Japan, 15 December 1995 — Fingerprint Refusal Case (Analogous Authority)

The Supreme Court recognised the constitutional protection against being compelled arbitrarily to provide fingerprints. It explained that fingerprint information has permanent identifying characteristics and that its misuse can threaten privacy.

Legal significance: The reasoning provides an important analogy for protecting DNA identification information stored in databases.

5. Supreme Court of Japan, 24 December 1969 — Kyoto Prefectural Gakuren Case (Analogous Authority)

The Supreme Court recognised the freedom not to have one's appearance photographed arbitrarily under Article 13 of the Constitution.

Legal significance: This decision supports the broader constitutional principle that the collection of identifying information by public authorities requires legitimate justification.

6. Supreme Court of Japan, 14 April 1981 — Kyoto City Criminal Record Disclosure Case (Analogous Authority)

The Supreme Court held that individuals have a legally protected interest in preventing the unjustified disclosure of criminal records. Unjustified disclosure by a public authority could constitute unlawful governmental conduct.

Legal significance: The decision provides an analogy for protecting confidential DNA records and restricting unauthorised disclosure.

6. SPECIAL RULES FOR DNA STORAGE AND BIOBANKING

Japan's Ministry of Health, Labour and Welfare issued guidance on the collection of genomic samples and handling of genomic data on 18 January 2018.

The guidance addresses:

Appropriate preservation conditions for biological samples.

Avoidance of contamination and repeated freeze-thaw cycles.

Sample inventories and traceability.

Secure storage of genomic information.

Access restrictions and coded identification.

Documented retention periods and disposal procedures.

Compliance with consent arrangements.

The guidance also recommends retaining appropriate raw genomic data and analytical records to preserve research integrity.

These requirements are particularly relevant to pharmaceutical companies, clinical research organisations, hospitals, and genomic research institutions.

7. DNA DATA STORAGE AND INSTITUTIONAL LIABILITY

Institutions may face legal consequences when DNA information is mishandled.

Potential liabilities include:

Civil damages under Article 709 of the Civil Code for unlawful infringement of protected interests.

Compensation for non-economic damage under Article 710.

Regulatory consequences under the APPI.

Criminal procedural consequences where DNA evidence is obtained unlawfully.

Contractual liability for breaches of confidentiality and data-management obligations.

A particularly important distinction concerns physical DNA samples and digital genomic records. Destroying a biological sample does not automatically eliminate previously generated genomic information. Similarly, deleting a digital record does not necessarily destroy the corresponding physical sample.

8. PRACTICAL COMPLIANCE REQUIREMENTS

DNA storage institutions in Japan should implement the following safeguards:

Obtain appropriate informed consent.

Identify the lawful purpose of DNA collection and storage.

Maintain secure physical and digital repositories.

Establish authorised-access procedures.

Maintain accurate sample inventories and audit records.

Establish clear retention and destruction policies.

Conduct ethical review where required.

Regulate external research access and international transfers.

Establish procedures for responding to data breaches.

Review the continuing necessity of retaining forensic DNA profiles.

9. CONCLUSION

Japan regulates DNA data storage through the APPI, genome medicine legislation, criminal investigation procedures, and medical research ethics guidelines. These rules establish important safeguards for genetic privacy, informed consent, data security, and responsible retention.

The Nagoya District Court judgment of 18 January 2022 and the Nagoya High Court judgment of 30 August 2024 are particularly significant because they address the continued retention and deletion of forensic DNA information. Together with the Tokyo High Court judgment of 23 August 2016, they demonstrate the growing judicial importance of protecting DNA identification information.

Ultimately, Japan's regulatory approach requires DNA storage institutions to balance scientific research, public security, medical development, and individual privacy. The continued development of DNA-based storage technologies will make clear consent, accountable data management, and effective legal safeguards increasingly important.