Act on the Protection of Personal Information

A corporation (or an organization without legal personality that has made provisions for a representative or manager; the same applies in item (iii), (b) of the following Article) seeking to perform services as set forth in one of the following items with the aim of ensuring that a business handling personal information, pseudonymized personal information, or anonymized personal information (hereinafter referred to as "personal or other related information" in this Chapter) (the business in question is hereinafter referred to as a "business handling personal or other related information" in this Chapter) handles the personal information properly may receive certification from the Personal Information Protection Commission:

complaint processing under Article 53 regarding the handling of personal or other related information by businesses handling personal or other related information which are covered by the corporation's services (hereinafter each such business is referred to as a "covered business");

providing covered businesses with information about things that contribute to ensuring the proper handling of personal or other related information;

services beyond what is set forth in the preceding two items which are necessary for ensuring the proper handling of personal or other related information by covered businesses.

The certification set forth in the preceding paragraph may be limited in respect of the type or scope of services of businesses handling personal or other related information that are covered.

A person seeking the certification referred to in paragraph (1) must apply to the Personal Information Protection Commission as prescribed by Cabinet Order.

After granting a certification under paragraph (1), the Personal Information Protection Commission must make a public notice to that effect (including the scope of services concerning the certification, in cases of the certification limiting the scope of services pursuant to the provisions of paragraph (2)).

A person falling under one of the following items may not be certified as referred to in paragraph (1) of the preceding Article:

a person that has been sentenced pursuant to any provision of this Act, if two years have not yet passed since the person finished serving the sentence or ceased to be subject to its enforcement;

a person whose certification has been revoked pursuant to the provisions of Article 155, paragraph (1), if two years have not yet passed since the revocation;

a person with an executive officer (or with a representative or manager, in an organization without legal personality that has made provisions for a representative or manager; hereinafter the same applies in this Article) that falls under one of the following categories:

a person that has been sentenced to imprisonment or a heavier punishment or that has been sentenced pursuant to any provision of this Act, if two years have not yet passed since the person finished serving the sentence or ceased to be subject to its enforcement;

a person that, during the 30 days before the revocation, was the officer of a corporation whose certification has been revoked pursuant to the provisions of Article 155, paragraph (1), if two years have not yet passed since the revocation.

The Personal Information Protection Commission must not grant a certification unless it finds the application for certification referred to in Article 47, paragraph (1) to conform to all of the following requirements:

the applicant has established the necessary methods of business implementation to allow it to perform the services set forth in the items of Article 47, paragraph (1) properly and reliably;

the applicant's knowledge, capabilities, and financial base are sufficient to allow it to perform the services set forth in the items of Article 47, paragraph (1) properly and reliably;

if the applicant engages in business other than the services set forth in the items of Article 47, paragraph (1), its engagement in that business is unlikely to give rise to unfairness in the services set forth in the items of that paragraph.

If a person that has received certification under Article 47, paragraph (1) (including that limiting the scope of services pursuant to the provisions of paragraph (2) of that Article; the same applies in paragraph (1) of the following Article and Article 155, paragraph (1), item (v)) seeks to alter the scope of services concerning the certification, the person must receive certification from the Personal Information Protection Commission; provided, however, that this does not apply to a minor alteration as prescribed by Order of the Personal Information Protection Commission.

The provisions of Article 47, paragraphs (3) and (4) and the preceding Article apply mutatis mutandis to the certification of alteration referred to in the preceding paragraph.

Before intending to discontinue the services subject to certification (hereinafter referred to as "certified services" in this Section and Chapter VI), a person that has received certification under Article 47, paragraph (1) (including the certification of alteration under paragraph (1) of the preceding Article) (the person in question is hereinafter referred to as a "certified personal information protection organization" in this Section and Chapter VI) must notify the Personal Information Protection Commission to that effect as prescribed by Cabinet Order.

Upon receiving notification under the preceding paragraph, the Personal Information Protection Commission must issue public notice indicating this.

A certified personal information protection organization's covered businesses must be comprised of businesses handling personal or other related information that have agreed to be covered by its certified services. In this case, if a covered business does not comply with the personal information protection guidelines prescribed in Article 54, paragraph (1) even though measures pursuant to Article 54, paragraph (4) were taken, the covered business may be excluded from being covered by the certified services.

A certified personal information protection organization must disclose the names of its covered businesses.

If an identifiable person or other party files for a certified personal information protection organization to resolve a complaint about the handling of personal or other related information by a covered business, in addition to complying with any request for a consultation about this, providing the identifiable person or other party with the necessary advice, and investigating the circumstances to which the complaint pertains, the organization must notify the covered business of the substance and content of the complaint and request that it resolve the complaint expeditiously.

If a certified personal information protection organization finds that it is necessary in connection with the resolution of a complaint under a filing referred to in the preceding paragraph, the organization may request that the covered business provide a written or oral explanation or submit materials.

If a covered business has received a request under the preceding paragraph from a certified personal information protection organization, it must not refuse this request without a legitimate reason for doing so.

In order to ensure the proper handling of personal or other related information by its covered businesses, a certified personal information protection organization must endeavor to create guidelines which follow the spirit of this Act (hereinafter referred to as "personal information protection guidelines" in this Section and Chapter VI), for how to specify the purpose of use of personal information, for measures to ensure its secure management, for procedures to deal with requests for disclosure or other handling, for other such matters, as well as how to produce pseudonymized processed information or anonymized personal information, and its security measures and other such matters, by listening to the opinions of representatives of customers or other relevant persons.

When having developed personal information protection guidelines pursuant to the provisions of the preceding paragraph, certified personal information protection organizations must notify the Personal Information Protection Commission of the personal information protection guidelines without delay pursuant to Order of the Personal Information Protection Commission. The same applies if the guidelines are modified.

When having been notified of personal information protection guidelines under the preceding paragraph, the Personal Information Protection Commission must disclose the personal information protection guidelines pursuant to Order of the Personal Information Protection Commission.

When personal information protection guidelines have been disclosed pursuant to the provisions of the preceding paragraph, certified personal information protection organizations must take measures against a covered business such as providing guidance or recommendations necessary to make the covered business comply with the personal information protection guidelines.

A certified personal information protection organization must not use information acquired in the course of certified services for purposes other than the certified services use for which the information is provided.

A person that is not a certified personal information protection organization must not use a name that refers to that person as a certified personal information protection organization, and must not use any other name that is confusingly similar to this.

The provisions of this Chapter do not apply to a business handling personal or other related information or business handling information related to personal information as set forth in one of the following items if all or part of the purpose for which it handles the information in question is the purpose prescribed in that item:

broadcasting organizations, newspapers, news services, and other journalistic organizations (this includes individuals who work in news reporting):use in news reporting;

a person in the business of creating literary works:use in the creation of literary works;

a religious organization:use in a religious activity (this includes activities incidental to it);

a political organization:use in a political activity (this includes activities incidental to it).

The "news reporting" prescribed in item (i) of the preceding paragraph means informing the general public of objective facts by presenting them as the truth (this includes stating an opinion or position based on those facts).

A business handling personal or other related information as set forth in one of the items of paragraph (1) must, itself, endeavor to take the necessary and appropriate measures for managing the security of personal data, pseudonymized personal information or anonymized personal information, and the necessary measures for processing complaints about the handling of personal or other related information and for otherwise ensuring the proper handling of personal or other related information and must also endeavor to disclose the content of those measures.

The provisions of Articles 32 through 39 and Section 4 do not apply to a business handling personal information or a business handling anonymized personal information set forth as follows:

a corporation listed in Appended Table 2;

a local incorporated administrative agency whose main purpose is providing the service listed in Article 21, item (i) of the Local Incorporated Administrative Agency Act, or whose purpose is providing the service listed in item (ii) or item (iii) of that Article (limited to the part relating to (h)).

The handling of personal information, pseudonymized personal information, or information related to personal information conducted by a person set forth in each following items in the business prescribed in each item is deemed to be the handling of personal information by a business handling personal information, the handling of pseudonymized personal information by a business handling pseudonymized personal information, or the handling of information related to personal information by a business handling information related to personal information; and the provisions in this Chapter (excluding Articles 32 through 39 and Section 4) and Chapters VI through VIII apply to it:

a local government organ: operation of a hospital prescribed in Article 1-5, paragraph (1) of the Medical Care Act (Act No. 205 of 1948) (referred to as a "hospital" in the following item), a clinic prescribed in paragraph (2) of that Article, and a university prescribed in Article 1 of the School Education Act (Act No. 26 of 1947);

Japan Organization of Occupational Health and Safety:operation of a hospital.

Academic research organizations or the equivalent which are businesses handling personal information must endeavor to comply with the provisions of this Act as well as personally take necessary measures for ensuring the appropriate handling of personal information for academic research purposes, and endeavor to the public the content of those measures.