Lycorp

The policy shifts to data sharing with a broader set of partners, expands the list of countries for data transfer and subprocessing, adds a new broad data-provision provision, and changes the controller identity and contact details.

• New broad data-provision to partners (5.e. Provision, etc. of Our Services): A new clause permits providing personal data to third parties, including partners, without consent for service provision, improvement, advertising, new service consideration, and fraud prevention, after deleting directly identifiable information. This adds a permission not present before, replacing a narrower regime that required consent or specific legal basis.
• Changes to data sharing with group companies (5.c. Sharing of Personal Data among group companies): The policy now states "We share…the Personal Data" which makes sharing the default practice, whereas the prior version said "we may share…" and limited it to users in certain countries. It also adds a requirement to comply with local personal information protection systems of the recipient's country.
• Expansion of sub-processor countries (5.b. Subcontracting): The list of countries where subcontractors may be located grew from 8 countries (Japan, Korea, Vietnam, Thailand, Taiwan, Indonesia, United States, Philippines) to 14 countries/regions, adding Canada, Australia, Singapore, Switzerland, United Kingdom, and the European Economic Area.
• Change of controller identity and contact details (1. Introduction and 9.b. Inquiries): The controller changes from "LINE Corporation" to "LY Corporation," and the mailing address changes from Yotsuya Tower to Kioi Tower, Tokyo Garden Terrace Kioicho. The responsible officer changed from Chief Privacy Officer to Chief Data Officer, and the EU Representative's street address changed from Neuer Wall 54 to Jungfernstieg 1.
• New minor age restriction for Indonesia (9.a. Privacy of children): The policy adds Indonesia (under 18) to the list of countries where minors' personal data is not knowingly collected, alongside the U.S., Europe, and Thailand.
• Broadened permission to transfer data to more countries (5. Provision of Personal Data): The prior version listed specific destination countries for data transfer; the new version categorizes recipients into groups (UK/EEA, EU-recognized adequate countries, APEC CBPR members, and other countries like Thailand, Indonesia, Vietnam), creating a more open-ended permission. The data center locations now explicitly include the European Economic Area and CBPR member countries.

9 further changes refine data collection examples, purpose descriptions, user rights features (adding a function to view, delete, and download service use history), and cross-reference updates; none alter the core obligations or rights.