Act on the Protection of Personal Information

An administrative organ's head or administrative entity may prepare anonymized personal information the administrative entity holds (limited to information constituting anonymized personal information files the administrative entity holds; hereinafter the same applies in this Section) pursuant to the provisions of this Section.

Except cases that fall under any of the following items, an administrative organ's head or administrative entity must not provide other persons with anonymized personal information the administrative entity holds:

cases based on laws and regulations (including cases subject to the provisions of this Section);

cases in which the administrative organ's head or administrative entity is allowed to provide the personal information the administrative entity holds to a third party for a purpose of use, and the administrative organ's head or administrative entity seeks to provide the third party with anonymized personal information the administrative entity holds into which the personal information in question has been processed;

Notwithstanding the provisions of Article 69 and except cases based on laws and regulations, an administrative organ's head or administrative entity must not personally use or provide other persons with deleted information (limited to information constituting personal information the administrative entity holds) for any purpose other than the purpose of use.

The term "deleted information" in the preceding paragraph means an identifier or the equivalent or individual identification code deleted from personal information an administrative entity holds which was used to prepare anonymized personal information it holds.

If an administrative organ's head or administrative entity finds that a personal information file held by the administrative entity to which the head or entity in question belongs falls under all of the items in Article 60, paragraph (3), the following matters regarding that personal information file must be registered in the personal information file register; in applying the provisions in Article 75, paragraph (1) to that personal information file in this case, the term "item (x)" in that paragraph is deemed to be replaced with "item (x) and each item in Article 110":

an indication that the personal information file is the subject matter of proposals requested under Article 112, paragraph (1);

the name and address of the organization receiving a proposal under Article 112, paragraph (1).

As provided for by Order of the Personal Information Protection Commission, an administrative organ's head or administrative entity is to periodically request a proposal as specified in paragraph (1) of the following Article on a personal information file held by the administrative entity to which the head or entity in question belongs (limited to those for which matters listed in item (i) of the preceding Article are registered in the personal information file register; hereinafter the same applies in this Section).

In response to a request under the preceding Article, if a person intends to use, for their business, anonymized personal information an administrative entity holds into which personal information constituting a personal information file it holds has been processed, that person may submit a proposal on their business to the administrative organ's head or administrative entity.

A written document stating all of the following matters must be submitted to the administrative organ's head or administrative entity according to Order of the Personal Information Protection Commission for the proposal referred to in the preceding paragraph:

the name and address of the person submitting the proposal, and the name of the representative if the person is a corporation or any other organization;

the name of the personal information file relating to the proposal;

the number of persons identifiable by the anonymized personal information the administrative entity holds that is related to the proposal;

beyond what is set forth in the preceding item, matters sufficient to identify the method of processing under Article 116, paragraph (1) that is used for preparing the anonymized personal information the administrative entity holds that is related to the proposal;

the purpose and method of use of the anonymized personal information the administrative entity holds that is related to the proposal, and the description of the business in which the anonymized personal information the administrative entity holds is to be used;

the period during which the anonymized personal information the administrative entity holds that is related to the proposal is to be used for the business referred to in the preceding item;

measures to be taken for preventing the leaking and for other proper management of the anonymized personal information the administrative organ entity holds that is related to the proposal;

beyond what is set forth in each preceding item, matters prescribed by Order of the Personal Information Protection Commission.

The documents referred to in the preceding paragraph must be accompanied by the documents listed below and other documents specified by Order of the Personal Information Protection Commission:

a written pledge that the person making the proposal referred to in paragraph (1) does not fall under any of the items of the following Article;

a document making it clear that the business referred to in item (v) of the preceding paragraph contributes to the creation of new industries, the realization of a vibrant economic society, or enriching quality of life for the Japanese public.

A person falling under one of the following items may not make a proposal in paragraph (1) of the preceding Article:

a minor;

any person specified by Order of the Personal Information Protection Commission as being unable to properly conduct business which uses anonymized personal information an administrative entity holds that is related to the proposal under paragraph (1) of the preceding Article due to a mental or physical disorder;

a person subject to an order commencing bankruptcy proceedings that has not been released from bankruptcy restrictions;

a person that has been sentenced to imprisonment or a heavier punishment or sentenced under the provisions of this Act, if two years have not yet elapsed since the date on which the person finished serving the sentence or was not subject to its enforcement;

a person whose contract to use anonymized personal information that an administrative entity holds was canceled under Article 120, if two years have not yet elapsed since the date of the cancellation;

a person that is a corporation or any other organization, and has any of its officers falls under either of the condition referred to in one of the preceding items.

If a proposal referred to in Article 112, paragraph (1) is submitted, the administrative organ's head or administrative entity must examine whether it meets the following criteria:

the person making the proposal referred to in Article 112, paragraph (1) does not fall under any of the items in the preceding Article;

the number of persons identifiable by the anonymized personal information the administrative entity holds that is related to the proposal referred to in Article 112, paragraph (2), item (iii) is equal to or more than the number specified by Order of the Personal Information Protection Commission from the viewpoint of effective use of that anonymized personal information, and is less than or equal to the number of persons identifiable by the personal information the administrative entity holds that constitutes the personal information file related to the proposal;

the processing method specified under Article 112, paragraph (2), items (iii) and (iv) conforms to the criteria referred to in Article 116, paragraph (1);

the business referred to in Article 112, paragraph (2), item (v) contributes to the creation of new industries, or the realization of a vibrant economic society, or enriching quality of life for the Japanese public;

the period referred to in Article 112, paragraph (2), item (vi) does not exceed the period specified by Order of the Personal Information Protection Commission from the viewpoint of effective use of anonymized personal information the administrative entity holds;

the purpose and method of use of the anonymized personal information the administrative entity holds that is related to the proposal referred to in Article 112, paragraph (2), item (v), and the measures referred to in item (vii) of that paragraph are appropriate for protecting the rights and interests of persons identifiable by that anonymized personal information;

beyond what is set forth in each preceding item, the proposal conforms to the criteria prescribed by Order of the Personal Information Protection Commission.

If, as a result of the examination under the preceding paragraph, the administrative organ's head or administrative entity finds that the proposal referred to in Article 112, paragraph (1) conforms to all of the criteria listed in the items of the preceding paragraph, the administrative organ's head or administrative entity is to notify the person that has submitted the proposal of the following matters, pursuant to the provisions of the Order of the Personal Information Protection Commission:

an indication that the person may conclude a contract with the administrative organ's head or administrative entity for the use of the anonymized personal information the administrative entity holds, pursuant to the provisions of the following Article;

beyond what is set forth in the preceding item, matters prescribed by Order of the Personal Information Protection Commission.

If, as a result of the examination under paragraph (1), the administrative organ's head or administrative entity finds that the proposal referred to in Article 112, paragraph (1) does not conform to one of the criteria listed in the items of paragraph (1), the administrative organ's head or administrative entity is to notify the person that has submitted the proposal to that effect, and the grounds for it, pursuant to the provisions of the Order of the Personal Information Protection Commission.

A person that has received a notice under paragraph (2) of the preceding Article may conclude a contract with an administrative organ's head or administrative entity for the use of the anonymized personal information the administrative entity holds, pursuant to the provisions of the Order of the Personal Information Protection Commission.

If an administrative organ's head or administrative entity prepares anonymized personal information the administrative entity holds, the administrative organ's head or administrative entity must process the personal information the administrative entity holds, in accordance with the criteria specified by Order of the Personal Information Protection Commission as necessary for making it impossible to identify a specific individual or to restore that personal information to its original state

The provisions in the preceding paragraph apply mutatis mutandis if a person that an administrative entity has entrusted (including entrustment via two or more layers) with the preparation of the anonymized personal information it holds conducts that entrusted business.

If an administrative organ's head or administrative entity prepares the anonymized personal information the administrative entity holds, the administrative organ's head or administrative entity must register the following matters in the personal information file register, for a personal information file that contains the personal information the administrative entity holds that has been used to prepare that anonymized personal information; in applying Article 75, paragraph (1) as applied pursuant to the provisions of Article 110 following the deemed replacement of the terms to the personal information file in this case, the term "and each item in Article 110" in that paragraph is deemed to be replaced with "each item in Article 110 and each item in Article 117.":

matters to describe the outline of anonymized personal information the administrative entity holds, as specified by the Order of the Personal Information Protection Commission;

the name and address of the organization to which a proposal referred to in paragraph (1) of the following Article is given;

the period during which a proposal referred to in paragraph (1) of the following Article may be submitted.

If a person intends to use, for their business, anonymized personal information an administrative entity holds for which matters set forth in item (i) of the preceding Article are registered in the personal information file register pursuant to the provisions of that Article, the person may submit a proposal on that business to the administrative organ's head or administrative entity. The same applies if a person has concluded a contract for the use of the anonymized personal information the administrative entity holds, pursuant to the provisions of Article 115, and seeks to alter the business for which the person will use that information.

The provisions of Article 112, paragraphs (2) and (3), and Articles 113 through 115 apply mutatis mutandis to the proposal referred to in the preceding paragraph. In this case, the term "the following matters" in Article 112, paragraph (2) is deemed to be replaced with "matters prescribed in item (i), and items (iv) through (viii)"; the term "beyond what is set forth in the preceding item, matters" in item (iv) of that paragraph is deemed to be replaced with "matters" and the phrase "identify the processing method under Article 116, paragraph (1) that is used for preparing the anonymized personal information the administrative entity holds that is related to" is deemed to be replaced with "identify"; the phrase "in each preceding item" in item (viii) of that paragraph is deemed to be replaced with "in item (i) and items (iv) through (viii)"; the term "the following criteria" in Article 114, paragraph (1) is deemed to be replaced with "the criteria prescribed in item (i), and items (iv) through (vii)"; the term "each preceding item" in item (vii) of that paragraph is deemed to be replaced with "item (i) and the preceding three items"; the term "the items of the preceding paragraph" in paragraph (2) of that Article is deemed to be replaced with "item (i) and items (iv) through (vii) of the preceding paragraph"; the term "one of the criteria listed in the items of paragraph (1)" in paragraph (3) of that Article is deemed to be replaced with "one of the criteria listed in item (i) and items (iv) through (vii) of paragraph (1)".