In many countries, individuals are identified by a unique number issued by the government. Probably the most ubiquitous example is the Social Security Number in the United States, which is generally necessary to obtain employment, open a bank account or obtain a driver’s license, and is used for credit monitoring and other private sector purposes.

Japan managed to avoid this trend until very recently, but in January 2016, the Japanese government rolled out its first national identification number system. The individual numbers issued under this system quickly became colloquially and even officially known as “My Number” (Mai Nambā). With few exceptions, every citizen and legal resident of Japan is now identified by a 12 digit “My Number.” Employers must now collect this number from each employee and independent contractor in Japan in order to conduct tax withholding and make payments into mandatory insurance schemes.

Unlike the Social Security Number, the “My Number” is neither intended nor permitted to be used for unofficial purposes: its use is limited to the official purposes of social insurance, taxation and disaster response. The collection and use of the “My Number” is strictly regulated under Article 19 of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, which sets forth rules far more restrictive than those applicable to other types of personal data in Japan. Whether or not the holder of the My Number consents, it is prohibited for any person to provide “specific personal information” (any information relating to a living individual that contains a name, date of birth, or other descriptions whereby a specific individual can be identified, together with their My Number) to any other person, except:

• in prescribed cases to facilitate Japanese government processes that use the My Number (primarily related to tax withholding and collection and government benefits tracking);
• between Japanese national/local government agencies;
• as part of a merger or business succession;
• pursuant to Japanese resident registration law;
• in the course of certain Japanese court proceedings, criminal/administrative investigations, and legislative examinations/investigations;
• if necessary for protecting the life, body or property of humans, and either the affected person consents or it is difficult to obtain their consent; or
• as permitted by rules of the Specific Personal Information Protection Commission.

An individual violator of these rules can be subject to imprisonment with labor for up to four years; fines for individual and corporate violations may be up to 2 million yen (approx. 20,000 USD).

The special restrictions surrounding the use of “My Number” have forced employers to institute special policies and procedures with regard to handling the numbers. Under the best practices that have emerged, the numbers are typically handled separately from other employee data, and are not printed or duplicated except to the minimum extent necessary for tax and social insurance procedures.

To add more potential pitfalls, the Japanese government issues “My Number Cards,” ID cards with the “My Number” printed on the back, which are meant to be used for general identity verification purposes and contain an public key authentication chip that can be used as an e-signature. However, the actual “My Number” printed on the back of the card cannot be collected or photocopied except as provided in Article 19 of the My Number Act, which means that any companies using “My Number Cards” for identification purposes need to be careful only to capture and use the front of the card.