Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures

The Commission, in order to ensure the proper handling of Specific Personal Information, is to establish and make public the guidelines (in the following paragraph and paragraph (3) of the following Article, referred to simply as "guidelines") specifying measures that a person who intends to hold Specific Personal Information Files must take, such as conducting by themselves a Specific Personal Information Protection Assessment (meaning an assessment of the risk of occurrence and impact of leakage of Specific Personal Information and other situations), preventing the occurrence of these situations, and other measures to properly manage Specific Personal Information.

The Commission, considering the technological progress and international trends related to the protection of Personal Information, is to reexamine the guidelines at least every three years, and, if it is found to be necessary, to change the guidelines.

If the head of an administrative organ, etc. intends to hold Specific Personal Information Files (excluding those in which personnel affairs, remuneration, or welfare benefit of a person who is or was exclusively an official of said head of the administrative organ, etc. is recorded and others that are specified by Rules of the Personal Information Protection Commission; hereinafter the same applies in this Article), before holding said Specific Personal Information File, pursuant to the provisions of Rules of the Personal Information Protection Commission, the head is to make a public notification of the document stating the results of assessing the following items (hereinafter the document is referred to as "Assessment Report" in this Article) and to seek comments widely from the citizens. With regard to said Specific Personal Information File, if the head intends to make a material change specified by Rules of the Personal Information Protection Commission, the same applies:

the number of persons who are engaged in processes that use the Specific Personal Information File;

the amount of Specific Personal Information to be recorded in the Specific Personal Information File;

past situation of the handling of the Personal Information File by the head of an administrative organ, etc.;

outline of the processes that use the Specific Personal Information File;

the structure of the electronic data processing system used for handling the Specific Personal Information File and the method of computer processing, etc.;

measures to protect Specific Personal Information recorded in the Specific Personal Information File; and

in addition to those listed in the preceding items, matters specified by Rules of the Personal Information Protection Commission.

In the case set forth in the first sentence of the preceding paragraph, the head of an administrative organ, etc., as provided for by Rules of the Personal Information Protection Commission, after giving enough consideration to the opinions obtained pursuant to the provisions of the first sentence of the same paragraph and making the necessary reviews in the Assessment Report, is to obtain the approval of the Commission with regard to the handling of Specific Personal Information Files stated in said Assessment Report. With regard to said Specific Personal Information Files, if the head intends to make a material change specified by Rules of the Personal Information Protection Commission, the same applies.

The Commission must not give the approval set forth in the preceding paragraph unless it is found by judgment based on the content of the Assessment Report, the information obtained pursuant to the provisions of Article 35, paragraph (1) of this Act and other information that the handling of the Specific Personal Information Files stated in said Assessment Report is in conformance with the guidelines.

If the head of an administrative organ, etc. receives the approval concerning the Assessment Report pursuant to the provisions of paragraph (2), the head is to promptly make public said Assessment Report.

When an Assessment Report has been made public pursuant to the provisions of the preceding paragraph, the notification under the provisions of Article 74, paragraph (1) of the Personal Information Protection Act is deemed to have been made.

The head of an administrative organ, etc. must not provide information recorded in a Specific Personal Information File, for which the Assessment Report has not been made public, pursuant to the provisions of Article 19, item (viii) or (ix) of this Act or must not request for the provision of information to be recorded in said Specific Personal Information File pursuant to the provisions of those items.

A Person in Charge of a Process Using an Individual Number, etc. and other persons engaged in a Process Using an Individual Number, etc. must not create a Specific Personal Information File beyond the extent necessary for handling a Process Using an Individual Number, etc. except in cases falling under any of Article 19, items (xiii) through (xvii) of this Act where said persons can provide or be provided with Specific Personal Information.

When holding or intending to hold a Specific Personal Information File, the head of an administrative organ, etc. is to, pursuant to the provisions of Cabinet Order, provide the persons engaged in processes handling Specific Personal Information Files with training on matters concerning ensuring cybersecurity (meaning cybersecurity as set forth in Article 2 of the Basic Act on Cybersecurity (Act No. 104 of 2014); the same applies in Article 32) necessary to ensure the appropriate handling of Specific Personal Information, and on other matters.

Administrative organs, incorporated administrative agencies, etc. and the Agency that hold a Specific Personal Information File are to periodically undergo inspections by the Commission, pursuant to the provisions of Rules of the Personal Information Protection Commission, regarding the status of the handling of Specific Personal Information recorded in said Specific Personal Information File.

Local governments and local incorporated administrative agencies that hold a Specific Personal Information File are to periodically report to the Commission, pursuant to the provisions of Rules of the Personal Information Protection Commission, on the status of the handling of Specific Personal Information recorded in said Specific Personal Information File.

If a leakage, loss or damage of Specific Personal Information recorded in a Specific Personal Information File or any other situation concerning ensuring the security of Specific Personal Information that is specified by Rules of the Personal Information Protection Commission as being highly likely to harm the rights and interests of individuals has occurred, a Person in Charge of a Process Using an Individual Number, etc. must report to the Commission that the situation has occurred, pursuant to the provisions of Rules of the Personal Information Protection Commission. This does not apply, however, if said Person in Charge of a Process Using an Individual Number, etc. has been entrusted with all or part of said Process Using an Individual Number, etc. by another Person in Charge of a Process Using an Individual Number, etc. and has notified that other Person in Charge of a Process Using an Individual Number, etc. that the situation has occurred, pursuant to the provisions of Rules of the Personal Information Protection Commission.

In the case provided for in the preceding paragraph, a Person in Charge of a Process Using an Individual Number, etc. (excluding a person who has given notice under the proviso to that paragraph) must notify the person themselves that the situation has occurred, pursuant to the provisions of Rules of the Personal Information Protection Commission. This does not apply, however, if it is difficult to notify the person themselves and the Person in Charge of a Process Using an Individual Number, etc. takes alternative measures necessary to protect the rights and interests of the person themselves.