The Japanese government is reviewing the introduction of blocking that would forcibly cut off access to specific websites to prevent further spread of personal data leaked in cyber attacks. With personal data protection potentially clashing with the constitutionally protected secrecy of communications, establishing a legal basis has emerged as a key issue.

On Nov. 11, Japanese outlet ITmedia reported that the Ministry of Internal Affairs and Communications announced the previous day that it would create an expert working group to discuss measures to prevent secondary harm from cyber attacks.

The working group will review whether telecommunications carriers can be made to forcibly block access to specific websites, including personal data leak sites. It will also examine the risk of conflicts with existing laws, alongside technical effectiveness.

Blocking is a measure in which telecommunications carriers cut off connections so internet users cannot access certain sites. The goal is to curb the spread of information by restricting access to sites that post personal data stolen by hackers or that threaten victimised companies.

The talks come after a string of large-scale personal data leak incidents in Japan. The ministry last month requested that telecommunications carriers block access to personal data leak sites in relation to a hacking incident involving GMO Internet Group.

In its 'Cybersecurity Emergency Measures Package' announced on Nov. 6, the Japanese government included a policy to swiftly review carriers' access-blocking measures and related legal issues.

The working group will be set up under an expert panel launched last month to strengthen cybersecurity at telecommunications carriers. It will comprise 5 to 6 experts in the constitution, criminal law and telecommunications, and plans to hold its first meeting in late November.

It plans to release interim findings in early 2027 and prepare a final report within the same year. In addition to blocking, it will also discuss other responses such as deleting illegal content and halting website operations.

The biggest issue is whether it violates the secrecy of communications. To block access to websites, carriers would need to verify where users are trying to connect, which could conflict with protections under Japan's constitution and the Telecommunications Business Act.

Hisayuki Fujii (藤井比早之), Japan's internal affairs minister, said at a news conference on Nov. 10 that careful legal review was needed, but added that the government would move quickly to prepare measures to prevent secondary harm from personal data leaks.

The question of whether to implement blocking, and the specific scope of any application, have not yet been decided.