With the evolution of machine learning, the facial recognition technology has already been used in different kinds of situations. In a field where such technological developments have a significant impact on society and the people who live in it, rulemaking is carried out by a variety of actors. Therefore, the METI suggests that what is most important is how quickly rules can be changed in line with technological innovations and the changes in business settings resulting from such innovations and how we can build a mechanism for such changes. This paper introduces how the Japanese government and the private sector analyze the risks posed by using the face recognition technology. Then, the issues of these analyses are discussed. Generally, businesses are at the heart of using personal data to drive innovation and create value for society. As a result, they are expected to play a central role in the design of governance. Also, given the nature of face recognition, which fosters discrimination and surveillance, this paper introduces some ideas that can be used as a reference point for businesses to consider when establishing governance in the use of the face recognition technology.