Act on the Protection of Personal Information

The Commission may require a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, a business handling information related to personal information (hereinafter referred to as a "business handling personal or other related information" in this Subsection), or other concerned person to submit necessary information or material relating to the handling of personal information, pseudonymized personal information, anonymized personal information, or information related to personal information (hereinafter referred to as "personal or other related information" in this Subsection and Subsection 3), or have its officials enter a business office or other necessary place of a business handling personal or other related information or other concerned person, inquire about the handling of personal or other related information, or inspect a book, document, or other item, to the extent necessary to implement the provisions of Chapter IV (excluding Section 5; the same applies in the following Article and Article 151).

An official who conducts an on-site inspection pursuant to the provisions of the preceding paragraph must carry a certificate for identification, and present it when requested by a person concerned.

An on-site inspection authority under paragraph (1) must not be construed as granted for a criminal investigation.

The Commission may provide a business handling personal or other related information with necessary guidance and advice on the handling of personal or other related information, to the extent necessary to implement the provisions of Chapter IV.

The Commission may recommend a business handling personal or other related information to stop committing the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need for protecting individual rights and interests in cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Article 21 (including the cases in which the provisions of paragraphs (1), (3) and (4) are applied pursuant to the Article 41, paragraph (4) following the deemed replacement of terms), Articles 23 through 26, Article 27 (excluding paragraph (4), and including the cases in which the provisions of paragraphs (5) and (6) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 28, Article 29 (including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 30 (excluding paragraph (2), and including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 32, Article 33 (excluding paragraph (1) (including as applied mutatis mutandis pursuant to paragraph (5))), Article 34, paragraph (2) or paragraph (3), Article 35 (excluding paragraphs (1), (3) and (5)), Article 38, paragraph (2), Article 41 (excluding paragraphs (4) and (5)) or Article 43 (excluding paragraph (6)); in cases in which a business handling information related to personal information has violated the provisions of Article 31, paragraph (1), has violated the provisions of Article 28, paragraph (3) as applied mutatis mutandis pursuant to Article 31, paragraph (2) following the deemed replacement of terms, or has violated the provisions of Article 30, paragraph (3) or paragraph (4) as applied mutatis mutandis pursuant to Article 31, paragraph (3) following the deemed replacement of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of Article 42, paragraph (1), has violated Article 27, paragraph (5) or paragraph (6) as applied mutatis mutandis pursuant to Article 42, paragraph (2) following the deemed replacement of terms, or has violated the provisions of Articles 23 through 25 or Article 41, paragraph (7) or paragraph (8) as applied mutatis mutandis pursuant to Article 42, paragraph (3) following the deemed replacement of terms; or in cases in which a business handling anonymized personal information has violated the provisions of Article 44 or Article 45.

If a business handling personal or other related information has received a recommendation under the preceding paragraph but has not taken measures in line with the recommendation without legitimate grounds, and the Commission finds that a serious infringement of individual rights and interests is impending, the Commission may order the business handling personal or other related information to take measures in line with the recommendation.

Notwithstanding the provisions of the preceding two paragraphs, the Commission may order a business handling personal or other related information to stop the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need to take urgent measures because there is a fact that seriously prejudices individual rights and interests in cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Articles 23 through 26, Article 27, paragraph (1), Article 28, paragraph (1) or paragraph (3), Article 41, paragraphs (1) through (3), or paragraphs (6) through (8), or Article 43, paragraph (1), paragraph (2) or paragraph (5); in cases in which a business handling information related to personal information has violated the provisions of Article 31, paragraph (1), or has violated the provisions of Article 28, paragraph (3) as applied mutatis mutandis pursuant to Article 31, paragraph (2) following the deemed replacement of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of Article 42, paragraph (1), or has violated the provisions of Articles 23 through 25 or Article 41, paragraph (7) or paragraph (8) as applied mutatis mutandis pursuant to Article 42, paragraph (3) following the deemed replacement of terms; or in cases in which a business handling anonymized personal information has violated the provisions of Article 45.

If the Commission has issued an order under the preceding two paragraphs and the business handling personal or other related information that has received the order has violated the order, the Commission may make public announcement to that effect.

When requiring a business handling personal or other related information to submit a report or material, conducting its on-site inspection, or giving a guidance, advice, recommendation or order to it, pursuant to the provisions of the preceding three Articles, the Commission must not preclude the freedom of expression, freedom of academia, freedom of religion, and freedom of political activity.

In light of the purport of the provisions of the preceding paragraph, the Commission is not to exercise its authority when a business handling personal or other related information provides personal or other related information to a person set forth in one of the items of Article 57, paragraph (1) (limited to cases in which the person handles personal or other related information for the purpose prescribed in those items).

If the Commission finds that there is a need for effectively giving a business handling personal or other related information a recommendation under Article 148, paragraph (1) or order under Article 148, paragraph (2) or paragraph (3) because there is a need to urgently and intensively ensure the proper handling of personal or other related information or similar other circumstances prescribed by Cabinet Order, the Commission may delegate an authority under Article 26, paragraph (1); under Article 146, paragraph (1); under Article 100, paragraph (1), Article 101, Article 102-2, Article 103, Article 105, Article 106 or Article 108 of the Code of Civil Procedure (Act No. 109 of 1996) as applied mutatis mutandis pursuant to the provisions of Article 162 following the deemed replacement of terms; under Article 163; and under Article 164 to the competent minister for the business, as prescribed by Cabinet Order.

When having exercised an authority delegated pursuant to the provisions of the preceding paragraph, the competent minister for the business is to report its results to the Commission as prescribed by Cabinet Order.

The competent minister for the business may delegate all or part of an authority delegated pursuant to the provisions of paragraph (1) or all or part of an authority under the preceding paragraph to the head of a local branch bureau under Article 43 of the Act for Establishment of the Cabinet Office or other bureau or organ prescribed by Cabinet Order, pursuant to the provisions of Cabinet Order.

The Prime Minister delegates an authority delegated pursuant to the provisions of paragraph (1) and an authority under paragraph (2) (limited to those relating to the Financial Services Agency's jurisdiction and excluding those prescribed by Cabinet Order) to the Commissioner of the Financial Services Agency.

The Commissioner of the Financial Services Agency may delegate a part of an authority delegated pursuant to the provisions of the preceding paragraph to the Securities and Exchange Surveillance Commission, pursuant to the provisions of Cabinet Order.

The Commissioner of the Financial Services Agency may delegate a part of an authority delegated pursuant to the provisions of paragraph (4) (excluding those delegated to the Securities and Exchange Surveillance Commission pursuant to the provisions of the preceding paragraph) to the director-general of a local finance bureau or local finance branch bureau, pursuant to the provisions of Cabinet Order.

The Securities and Exchange Surveillance Commission may delegate a part of an authority delegated pursuant to the provisions of paragraph (5) to the director-general of a local finance bureau or local finance branch bureau, pursuant to the provisions of Cabinet Order.

As for administrative affairs relating to an authority delegated to the director-general of a local finance bureau or local finance branch bureau pursuant to the provisions of the preceding paragraph, the Securities and Exchange Surveillance Commission directs and supervises the director-general of a local finance bureau or local finance branch bureau.

In the case referred to in paragraph (5), an appeal for review concerning the Securities and Exchange Surveillance Commission's requiring the submission of a report or material (including cases in which the director-general of a local finance bureau or local finance branch bureau does so pursuant to the provisions of paragraph (7)) may only be filed against the Securities and Exchange Surveillance Commission.

If the competent minister for the business finds that a business handling personal or other related information has committed an act violating the provisions of Chapter IV, or there is a need for ensuring the proper handling of personal or other related information by a business handling personal or other related information, the minister may request that the Commission take appropriate measures in accordance with the provisions of this Act.

The competent minister for the business in the provisions of this Subsection is as follows:

the competent minister for the handling of personal or other related information by a business handling personal or other related information that is relating to employment management is: the Minister of Health, Labor and Welfare (or as for those relating to a mariner's employment management, the Minister of Land, Infrastructure, Transport and Tourism); and a minister having jurisdiction over the business conducted by the business handling personal or other related information, the National Public Safety Commission, or the Japan Casino Regulatory Commission (referred to collectively as the "minister or commission" in the following item);

the competent minister for the handling of personal or other related information by a business handling personal or other related information other than the ones set forth in the preceding item is: the minister or commission having jurisdiction over the business conducted by the business handling personal or other related information.