Act on the Protection of Personal Information

If a business handling personal information receives a request for a notification of the purpose of use under Article 32, paragraph (2) or a request for disclosure under Article 33, paragraph (1), it may collect a fee for taking the relevant measures.

If a business handling personal information collects a fee pursuant to the provisions of the preceding paragraph, it must fix the amount of that fee within a scope that can be considered reasonable in consideration of actual costs.

When seeking to file a lawsuit in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), or (5), the identifiable person may not file the lawsuit unless the identifiable person had previously issued a request against a person who should become a defendant in the lawsuit and two weeks have elapsed since the arrival day of the issued request; provided, however, that this does not apply if the person who should become a defendant in the lawsuit has rejected the request.

A request under the preceding paragraph is deemed as having been arrived at the time when it should have normally been arrived.

The provisions of the preceding two paragraphs apply mutatis mutandis to a petition for a provisional disposition order in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), or (5).

A business handling personal information must endeavor to process complaints about the handling of personal information appropriately and promptly.

A business handling personal information must endeavor to establish the necessary systems for achieving the purpose referred to in the preceding paragraph.

When preparing pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent; hereinafter the same applies in this Chapter and Chapter VI), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual unless collated with other information.

When having prepared pseudonymized personal information or having acquired pseudonymized personal information and deleted or other related information (meaning information related to identifiers or their equivalent and individual identification codes that were deleted from personal information used to prepare the pseudonymized personal information, and the means of processing carried out pursuant to the provisions of the preceding paragraph; hereinafter the same applies in this Article and paragraph (7) as applied mutatis mutandis pursuant to paragraph (3) of the following Article following the deemed replacement of terms) related to the pseudonymized information, businesses handling personal information must take measures for the management of the security of deleted or other related information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to prevent the leaking of deleted or other related information.

Notwithstanding the provision of Article 18 and except cases based on laws and regulations, a business handling pseudonymized personal information (limited to a business handling personal information; hereinafter the same applies in this Article) must not handle pseudonymized personal information (limited to personal information; hereinafter the same applies in this Article) beyond the necessary scope to achieve the purpose of use specified pursuant to the provisions of Article 17, paragraph (1).

With regard to applying the provisions of Article 21 related to pseudonymized personal information, the phrase "notify the identifiable person of that purpose of use or disclose this to the public" in paragraphs (1) and (3) of that Article is deemed to be replaced with "disclose that purpose of use"; the phrase "notifying the identifiable person of the purpose of use or disclosing this to the public" in the provisions of items (i) through (iii) of paragraph (4) of that Article is deemed to be replaced with "disclosing the purpose of use".

Businesses handling pseudonymized personal information must endeavor to erase personal data that constitutes pseudonymized personal information and deleted or other related information without delay when utilization of the personal data and the deleted or other related information has become unnecessary. In this case, the provisions of Article 22 do not apply.

Notwithstanding the provisions of Article 27, paragraphs (1) and (2), and Article 28, paragraph (1), and except cases based on laws and regulations, businesses handling pseudonymized personal information must not provide a third party with personal data that constitutes pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 41, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" in Article 27, paragraph (6) is deemed to be replaced with "disclose this without delay"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso of Article 29, paragraph (1), and the term "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso of Article 30, paragraph (1) are deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)".

Businesses handling pseudonymized personal information, in handling that information, must not collate the pseudonymized personal information with other information in order to identify a person identifiable by personal information that was used to prepare the pseudonymized personal information.

Businesses handling pseudonymized personal information, in handling that information, must not use contact addresses and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) or a specified correspondence delivery operator prescribed in Article 2, paragraph (9), for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

The provisions of Article 17, paragraph (2), Article 26 and Articles 32 through 39 do not apply regarding pseudonymized personal information, personal data that constitutes pseudonymized personal information, and personal data the business holds that constitutes pseudonymized personal information.

Except in cases based on laws and regulations, businesses handling pseudonymized personal information must not provide pseudonymized personal information (excluding those that constitute personal information; the same applies in the following paragraph and paragraph (3)) to a third party.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 42, paragraph (1)"; the term "business handling personal information" in item (i) of the paragraph is deemed to be replaced with "business handling pseudonymized personal information"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of the paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the term "business handling personal information" in Article 27, paragraph (6) is deemed to be replaced with "businesses handling pseudonymized personal information", and the phrase " notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" is deemed to be replaced with "disclose this without delay" in Article 27, paragraph (6).

The provisions of Articles 23 through 25, Article 40, and paragraphs (7) and (8) of the preceding Article apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information. In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking"; and the term "not" in Article 41, paragraph (7) is replaced with "neither acquire deleted or other related information, nor".

When preparing anonymized personal information (limited to those compiled in an anonymized personal information database or the equivalent; hereinafter the same applies in this Chapter and Chapter VI), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual and restore the information to its original state.

When having prepared anonymized personal information, businesses handling personal information must take measures for the management of the security of information relating to identifiers or their equivalent and individual identification codes that were deleted from personal information used to prepare the anonymized personal information, and information on the means of processing carried out pursuant to the provisions of the preceding paragraph, in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to prevent the leaking of that information.

When having prepared anonymized personal information, businesses handling personal information must disclose the categories of information on an individual that is contained in the anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

Businesses handling personal information, before providing anonymized personal information it prepared to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information the business will provide to the third party, and the means of providing this, and state to the third party explicitly that the information the business will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

Businesses handling personal information, when handling anonymized personal information it prepared by itself, must not collate the anonymized personal information with other information in order to identify a person identifiable by personal information that was used to prepare that anonymized personal information.

When having prepared anonymized personal information, businesses handling personal information must endeavor to take the necessary and appropriate measures for managing the security of the anonymized personal information, and the necessary measures for processing complaints about the preparation or other handling of the anonymized personal information, or for otherwise ensuring the proper handling of the anonymized personal information; and endeavor to disclose the content of those measures.

Businesses handling anonymized personal information, before providing anonymized personal information (excluding those into which they have processed personal information themselves; hereinafter the same applies in this Section) to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information it will provide to the third party, and the means of providing this, and state to the third party explicitly that the information it will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

Businesses handling anonymized personal information, when handling anonymized personal information, must neither acquire information relating to identifiers or their equivalent or individual identification codes deleted from the personal information and information relating to methods of processing carried out pursuant to the provisions of Article 43, paragraph (1) or Article 116, paragraph (1) (including cases in which it is applied mutatis mutandis pursuant to Article 116, paragraph (2)), nor collate the anonymized personal information with other information in order to identify a person identifiable by personal information that was used to prepare that anonymized personal information.

Businesses handling anonymized personal information must endeavor to take the necessary and appropriate measures for managing the security of anonymized personal information and the necessary measures to ensure the proper handling of anonymized personal information such as processing complaints about the handling of anonymized personal information, and must endeavor to disclose the content of those measures.