Act on the Protection of Personal Information

An administrative organ's head or administrative entity must not personally use or provide other persons with personal information the administrative entity holds for any purpose other than the purpose of use, except cases based on laws and regulations.

Notwithstanding the provisions of the preceding paragraph, when finding the case to fall under circumstances specified by any of the following items, an administrative organ's head or administrative entity may personally use or provide other persons with personal information the administrative entity holds for any purpose other than the purpose of use; provided, however, this does not apply if it is found that using that personal information personally or providing it to other persons for any purpose other than the purpose of use is likely to cause unjust prejudice to the rights or interests of the identifiable person or a third party:

if the personal information the administrative entity holds is used or provided with the identifiable person's consent, or if it is provided to the identifiable person;

if the administrative entity uses personal information it holds within the organ only to the extent necessary for managing processes or services under the jurisdiction provided by laws and regulations, and there are reasonable grounds for the use of that personal information;

if the personal information the administrative entity holds is provided to other administrative organ, incorporated administrative agency or other prescribed corporation, local government organ, or local incorporated administrative agency; the person that receives the information uses it only to the extent necessary for managing the processes or services under its jurisdiction provided by laws and regulations; and there are reasonable grounds for the use of that personal information;

beyond what is set forth in the preceding three items, if the personal information the administrative entity holds is provided exclusively for statistical purpose or academic research purpose; provision of the information to other persons is obviously beneficial to the identifiable person; or there are other special grounds for providing that personal information.

The provisions of the preceding paragraph do not preclude the application of the provisions of other laws and regulations which restrict the use or provision of personal information an administrative entity holds.

When finding it particularly necessary for protecting the individual rights and interests, an administrative organ's head or administrative entity is to allow only particular departments, agencies, or employees within the organ to use personal information the administrative entity holds for any purpose other than the purpose of use.

When an administrative organ's head or administrative entity finds it necessary in providing personal information the administrative entity holds for the purpose of use or pursuant to the provisions of paragraph (2), item (iii) or (iv) of the preceding Article, they are to impose restrictions on the purpose or method of use of the personal information they provide or any other restrictions considered necessary on a person that receives that personal information, or request the person take necessary measures to prevent the leaking of and for the proper management of that personal information.

Except in cases based on laws and regulations or set forth in Article 69, paragraph (2), item (iv), before an administrative organ's head or administrative entity provides personal information the administrative entity holds to a third party (excluding a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to the one that a business handling personal information prescribed in Article 16, paragraph (2) is to take concerning the handling of personal data prescribed in Article 16, paragraph (3) pursuant to the provisions of Section 2 of the preceding Chapter (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph and the following paragraph) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article) (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article) for any purpose other than the purpose of use, the administrative organ's head or administrative entity must acquire the identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country.

When intending to obtain an identifiable person's consent pursuant to the provisions of the preceding paragraph, an administrative organ's head or administrative entity must provide the person in advance with information on the personal information protection system of the foreign country, on the measures the third party takes for the protection of personal information, and other information that serves as a reference to the person, pursuant to Order of the Personal Information Protection Commission.

Except in those cases based on laws and regulations or set forth in Article 69, paragraph (2), item (iv), when an administrative organ's head or administrative entity has provided personal information the administrative entity holds to a third party in a foreign country (limited to a person that has established a system prescribed in paragraph (1)) for any purpose other than the purpose of use, the administrative organ's head or administrative entity must take necessary measures to ensure continuous implementation of the equivalent measures by the third party, and in response to the identifiable person's request, provide the person with information on the necessary measures, pursuant to Order of the Personal Information Protection Commission.

When finding it necessary in providing information related to personal information to a third party (limited to cases in which it is assumed that the third party acquires the information related to personal information as personal information), an administrative organ's head or administrative entity is to impose restrictions on the purpose or method of use of information related to personal information that they provide or any other restrictions considered necessary on the third party, or request the person take necessary measures to prevent the leaking of and for the proper management of the information.

Except in cases based on laws and regulations, an administrative organ's head or administrative entity must not provide pseudonymized personal information (excluding those that are personal information; hereinafter the same applies in this Article and Article 128) to a third party (excluding a person entrusted with the handling of the pseudonymized personal information).

An administrative organ's head or administrative entity must take necessary and appropriate measures for managing the security of personal data including preventing the leaking of pseudonymized personal information they handle.

Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must neither acquire deleted or other related information (meaning identifiers or their equivalent, individual identification codes, and information on the method of processing as performed under Article 41, paragraph (1) that have been deleted from the personal information used to prepare the pseudonymized personal information), nor collate the pseudonymized personal information with other information, in order to identify the person identifiable by personal information that was used to prepare that pseudonymized personal information.

Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must not utilize a contact address and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or a specified correspondence delivery operator prescribed in Article 2, paragraph (9) of that Act, for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

The provisions of each preceding paragraph apply mutatis mutandis to cases in which a person that has been entrusted (including entrustment via two or more layers) with the handling of pseudonymized personal information by an administrative organ's head or administrative entity conducts the entrusted business.

Before an administrative organ (excluding the Board of Audit; hereinafter the same applies in this Article) intends to hold personal information file, the head of the administrative organ must notify the Personal Information Protection Commission of the following matters. The same applies to cases in which an administrative organ intends to alter any matters for which notification has already been given:

the name of the personal information file;

the name of the organ and the name of the organizational section in charge of the processes for which the personal information file will be used;

the purpose of use of the personal information file;

particulars recorded in the personal information file (hereinafter referred to as the "recorded particulars" in this Section) and the scope of individuals that are recorded in the personal information file as an identifiable person (limited to those who can be identified through a search without another individual's name, date of birth, or other identifiers or their equivalent; the same applies in item (ix) of the following paragraph) (this scope is hereinafter referred to as the "scope of record" in this Section);

the means of acquiring the personal information recorded in the personal information file (hereinafter referred to as the "recorded information" in this Section);

if the recorded information contains sensitive personal information, an indication to that effect;

if the recorded information is routinely provided to a party outside that organ, the name of that party;

if a part of the recorded particulars or the matters set forth in item (v) or in the preceding item are not to be contained in the personal information file register, or the personal information file is not to be contained in the personal information file register pursuant to the provisions of paragraph (3) of the following Article, an indication to that effect;

the name and address of the organization that accepts the request prescribed in Article 76, paragraph (1), Article 90, paragraph (1), or Article 98, paragraph (1);

if the proviso of Article 90, paragraph (1) or the proviso of Article 98, paragraph (1) applies, an indication to that effect;

other matters prescribed by Cabinet Order.

The provisions of the preceding paragraph do not apply to the personal information files set forth in the following:

a personal information file that contains matters concerning the national security, diplomatic secrets, and other important interests of the State;

a personal information file prepared or acquired for criminal investigation, investigation of tax crimes based on the provisions of laws related to tax, or instituting or keeping a legal proceeding;

a personal information file for employees or former employees of that organ, which exclusively contains information concerning their personnel, wages, welfare benefits, or any equivalent matters (including a personal information file concerning an employee recruitment examination conducted by that organ);

a personal information file exclusively used for the purpose of experimental computer processing;

a personal information file which contains all or a part of the recorded information contained in another personal information file subject to the notification prescribed in the preceding paragraph, if its purpose of use, recorded particulars, and scope of record are within the scope of those subject to that notification;

a personal information file that contains only recorded information that will be erased within one year;

a personal information file containing recorded information to be used for sending materials or any goods or money or for making necessary business contacts, which only contain the names, addresses and other necessary details concerning the recipients;

a personal information file that an employee prepares or acquires based on that employee's initiative for academic research purpose, if the recorded information is used exclusively for those academic research purpose;

a personal information file for which the number of the identifiable persons is less than the number specified by Cabinet Order;

a personal information file specified by Cabinet Order as being equivalent to any of the personal information files set forth in item (iii) through the preceding item;

a personal information file in relation to Article 60, paragraph (2), item (ii).

If an administrative organ ceases to hold the personal information file for which notification of the matters prescribed in paragraph (1) has been made or that personal information file comes to fall under item (ix) of the preceding paragraph, the head of the administrative organ must notify the Personal Information Protection Commission to that effect without delay.