Personal Information Protection Commission

The commission the Act on the Protection of Personal Information sets up under Article 49, paragraph (3) of the Act for Establishment of the Cabinet Office (内閣府設置法), under the Prime Minister's jurisdiction (Act on the Protection of Personal Information, Article 130). It is made up of a chairperson and eight commissioners, four of them part-time, whom the Prime Minister appoints with the consent of both Houses of the Diet, and they exercise their authority independently (Articles 133 and 134). Its work includes supervising how businesses handle personal information and the related kinds of information (pseudonymized personal information, anonymized personal information and information related to personal information), monitoring how administrative organs and other public bodies (行政機関等) handle them, matters concerning certified personal information protection organizations (認定個人情報保護団体), and monitoring or supervising how specific personal information (特定個人情報) is handled (Article 132) — personal information that contains an individual number (個人番号), or a code used in its place other than a resident record code (Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, Article 2, paragraph (9)). Over businesses that handle personal information and the related kinds of information it may, as far as is needed to enforce the Act's rules for them, require reports and material, have its officials enter their offices, ask questions and inspect, and give guidance and advice (Articles 146 and 147). Where a business breaks certain of those rules and the Commission finds it necessary to protect individuals, it may recommend that the business stop or correct the breach; where the business, without a legitimate reason, does not take the recommended measures and the Commission finds that a serious infringement of an individual's rights and interests is imminent, it may order it to take them; and where certain breaches seriously harm an individual's rights and interests and call for urgent action, it may order the business to stop or correct them without a recommendation first. It may make public that a business has disobeyed an order (Article 148). It may make Rules of the Personal Information Protection Commission (個人情報保護委員会規則) on the matters in its charge, to carry out an Act or a Cabinet Order (政令) or under a special delegation from one (Article 145).