In April 2026, the Japanese government officially passed amendments to the Act on the Protection of Personal Information (APPI), significantly easing restrictions on how companies use personal data.
🌟 Japan – Development First
Under the new regulations, companies are “not required” to obtain prior user consent when processing certain types of personal data.
🔖 Scope: This includes highly sensitive information such as health records and facial scans.
🔖 Compulsory Nature: For biometric collection like facial scanning, companies are not even required to provide an “Opt-out” option.
This move is seen as a strategic push to accelerate AI research and big data applications.
🌟 Hong Kong – Privacy Centric
Currently, Hong Kong has not enacted specific legislation regarding the collection and use of biometric data. However, the Office of the Privacy Commissioner for Personal Data (PCPD) issued relevant guidelines as early as 2020, suggesting that data users (companies/organizations) should follow these principles:
🔖 Transparency: Organizations should formulate clear privacy policies outlining the rules for collecting and processing biometric data. They should proactively notify data subjects (employees/customers) and establish mechanisms for them to review these policies at any time.
🔖 Alternative Options: Data users should, as far as possible, allow individuals the freedom of choice by providing less privacy-intrusive alternatives (e.g., offering staff cards or passwords instead of mandatory facial recognition) as a substitute for collecting biometric data.
Reference:
Office of the Privacy Commissioner for Personal Data (PCPD) Link
Unwire.hk Link
日本政府於 2026 年 4 月正式通過修訂《個人資料保護法》，大幅放寬企業使用個人資料的限制。
🌟日本 – 發展優先
新條例下，企業在處理部分個人資料時，「無需」先取得用戶同意。
🔖涵蓋範圍： 包含健康資訊、人臉掃描等高度敏感的資料。
🔖強制性： 對於人臉掃描等生物辨識採集，企業毋須提供「退出（Opt-out）」選項。
這項舉措被視為旨在推動 AI 研發與大數據應用，
🌟香港 – 私隱為重
目前香港尚未針對收集及使用生物辨識資料專門立法，但個人資料私隱專員公署 (PCPD) 早於 2020 年就發布了相關指引，建議資料使用者（企業/機構）應遵循以下原則：
🔖資訊透明化：機構應制定清晰的私隱政策，列明收集、處理生物辨識資料的規則，並主動提醒資料當事人（僱員/顧客），設立機制讓資料當事人能隨時檢視。
🔖提供替代方案：資料使用者應盡量讓當事人擁有自由選擇權，提供侵犯私隱程度較低的方案（例如：除了人臉識別，也應提供員工證或密碼等選項）來代替收集生物辨識資料。