Act on the Protection of Personal Information

"Administrative organContact-enabling information related to personal information" in this Act means information related to personal information that contains any of the following identifiers or the equivalent (including information that can be readily collated with other information and thereby enables any of the following identifiers or the equivalent to be identified):

organs within the Cabinet (excluding the address of a residence, place of work or any other place where a specific individual is or was located (limited to one that can be used for sending to a specific individual by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Cabinet Office Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) (referred to as "correspondence delivery" in Article 41, paragraph (8) and the Disaster Management Agency) Article 73, paragraph (4)) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or under the jurisdiction a specified correspondence delivery operator prescribed in paragraph (9) of the Cabinet which are established pursuantthat Article, for delivering a telegram to the provisions of lawsa specific individual, or for visiting a specific individual);

the Cabinet Office, the Imperial Household Agency, and organs prescribed in Article 49, paragraphs (1) and (2) of the Act for Establishment of the Cabinet Office (Act No. 89 of 1999) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (v) is established, that organ designated by Cabinet Order is excludeda telephone number (limited to one that can be used for telephoning a specific individual or for transmitting information to a specific individual using a facsimile machine);

an email address (meaning an email address prescribed in Article 2, item (iii) of the Disaster Management Agency (excluding facilities and other organs designated by Cabinet Order as Act on Regulation of Transmission of Specified Electronic Mail (Act No. 26 of 2002), limited to one that can be used for sending electronic mail prescribed in item (vi)i) of that Article to a specific individual);

organs a code assigned so as to enable the identification of a person using telecommunications facilities (meaning telecommunications facilities prescribed in Article 3, paragraph (22, item (ii) of the National Government OrganizationTelecommunications Business Act (Act No. 12086 of 1948) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (vii) is established, that organ designated 1984); the same applies hereinafter in this item) or of telecommunications facilities (limited to one that can be used for communicating information to a specific individual by Cabinet Order is excludedmeans of telecommunications (meaning telecommunications prescribed in item (i) of that Article));

organs referred to in Articles 39 and 55 of the Act for Establishment of the Cabinet Office andbeyond what is set forth in Article 16, paragraph (2) of the Imperial Household Agency Act (Act No. 70 of 1947), and extraordinary organs referred to in Articles 40 and 56preceding items, identifiers or the equivalent prescribed by Order of the Act for Establishment of the Cabinet Office (includingPersonal Information Protection Commission as applied mutatis mutandis pursuant to Article 18, paragraph (1) of the Imperial Household Agency Act), that are designated by Cabinet Order;those that can be used for contacting a specific individual or otherwise communicating information to a specific individual.

facilities and other organs referred to in Article 15 of the Act for Establishment of the Disaster Management Agency (Act No. 61 of 2026) that are designated by Cabinet Order;

facilities and other organs referred to in Article 8-2 of the National Government Organization Act, and extraordinary organs referred to in Article 8-3 of that Act, that are designated by Cabinet Order;

the Board of Audit.

"Incorporated administrative agency or other prescribed corporationorgan" in this Act means an incorporated administrative agency as prescribed in Article 2, paragraph (1) of the Act on General Rules for Incorporated Administrative Agency (Act No. 103 of 1999) and the corporation listed in the Appended Table 1.following:

organs within the Cabinet (excluding the Cabinet Office and the Disaster Management Agency) or under the jurisdiction of the Cabinet which are established pursuant to the provisions of laws;

the Cabinet Office, the Imperial Household Agency, and organs prescribed in Article 49, paragraphs (1) and (2) of the Act for Establishment of the Cabinet Office (Act No. 89 of 1999) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (v) is established, that organ designated by Cabinet Order is excluded);

the Disaster Management Agency (excluding facilities and other organs designated by Cabinet Order as prescribed in item (vi));

organs prescribed in Article 3, paragraph (2) of the National Government Organization Act (Act No. 120 of 1948) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (vii) is established, that organ designated by Cabinet Order is excluded);

organs referred to in Articles 39 and 55 of the Act for Establishment of the Cabinet Office and in Article 16, paragraph (2) of the Imperial Household Agency Act (Act No. 70 of 1947), and extraordinary organs referred to in Articles 40 and 56 of the Act for Establishment of the Cabinet Office (including as applied mutatis mutandis pursuant to Article 18, paragraph (1) of the Imperial Household Agency Act), that are designated by Cabinet Order;

facilities and other organs referred to in Article 15 of the Act for Establishment of the Disaster Management Agency (Act No. 61 of 2026) that are designated by Cabinet Order;

facilities and other organs referred to in Article 8-2 of the National Government Organization Act, and extraordinary organs referred to in Article 8-3 of that Act, that are designated by Cabinet Order;

the Board of Audit.

"Local incorporatedIncorporated administrative agency or other prescribed corporation" in this Act means a localan incorporated administrative agency as prescribed in Article 2, paragraph (1) of the Local Act on General Rules for Incorporated Administrative Agency ActAgencies (Act No. 118103 of 2003)1999) and the corporation listed in the Appended Table 1.

"Administrative entitylocal incorporated administrative agency" in this Act means a local incorporated administrative agency as prescribed in Article 2, paragraph (1) of the following organs:Local Independent Administrative Agency Act (Act No. 118 of 2003).

administrative organs;

local government organs (excluding assemblies; the same applies hereinafter except the following Chapter, Chapter III and Article 69, paragraph (2), item (iii));

incorporated administrative agencies or other prescribed corporations (excluding corporations listed in the Appended Table 2; the same applies in Article 16, paragraph (2), item (iii), Article 63, Article 78, paragraph (1), item (vii), (a) and (b), Article 89, paragraphs (4) through (6), Article 119, paragraphs (5) through (7), and Article 125, paragraph (2));

local incorporated administrative agencies (excluding those whose main purpose is providing the service listed in Article 21, item (i) of the Local Incorporated Administrative Agency Act, or those whose purpose is providing the service listed in item (ii) or (iii) of that Article (limited to the part relating to (h)); the same applies in Article 16, paragraph (2), item (iv), Article 63, Article 78, paragraph (1), item (vii), (a) and (b), Article 89, paragraphs (7) through (9), Article 119, paragraphs (8) through (10), and Article 125, paragraph (2)).

"administrative entity" in this Act means the following organs:

administrative organs;

local government organs (excluding assemblies; the same applies hereinafter except the following Chapter, Chapter III and Article 69, paragraph (2), item (iii));

incorporated administrative agencies or other prescribed corporations (excluding corporations listed in the Appended Table 2; the same applies in Article 16, paragraph (2), item (iii), Article 63, Article 78, paragraph (1), item (vii), (a) and (b), Article 89, paragraphs (4) through (6), Article 119, paragraphs (5) through (7), and Article 125, paragraph (2));

local incorporated administrative agencies (excluding those whose main purpose is providing the service listed in Article 21, item (i) of the Local Independent Administrative Agency Act, or those whose purpose is providing the service listed in item (ii) or (iii) of that Article (limited to the part relating to (h)); the same applies in Article 16, paragraph (2), item (iv), Article 63, Article 78, paragraph (1), item (vii), (a) and (b), Article 89, paragraphs (7) through (9), Article 119, paragraphs (8) through (10), and Article 125, paragraph (2)).

"Statistical compilation or similar analysis" in this Act means an act of compiling statistics or otherwise creating information on the trends or properties of a large amount of information (excluding such trend or property information that concerns individuals) by extracting information relating to the elements constituting that information from the large amount of information and conducting classification, comparison or other analysis, which is prescribed by Order of the Personal Information Protection Commission as being unlikely to harm individual rights and interests.

the basic details of the measures to protect personal information to be taken by businesses handling personal information prescribed in Article 16, paragraph (2), businesses handling pseudonymized personal information prescribed in paragraph (56) of that Article, businesses handling anonymized personal information prescribed in paragraph (67) of that Article, and certified personal information protection organizations prescribed in Article 51, paragraph (1);

"Businessbusiness handling personal information" in this Chapter and Chapters, Chapter VI throughand Chapter VIII means a person that uses a personal information database or the equivalent for business; provided, however, that this excludes persons set forth as follows:

"Business handling pseudonymizedSpecified biometric personal information" in this Chapter and Chapters VI and VII meansmeans personal information that includes a person that uses a collective body of information consisting of pseudonymized personal information for business, which specified biometric individual identification code (meaning an individual identification code falling under Article 2, paragraph (2), item (i) that has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular pseudonymized personal information (referred to as a "pseudonymized personal information database orconverted from information prescribed by Cabinet Order as information on a characteristic of a part of the body which can be acquired by a method that does not require special technology or a costly expenditure and whose acquisition the identifiable person cannot easily recognize; the equivalent" same applies in Article 4121-2, paragraph (1)); provided, however, that this excludes persons set forth in each item of, item (iv) and Article 35, paragraph (27)).

"Business handling anonymizedpseudonymized personal information" in this Chapter and ChaptersChapter VI and VII means a person that uses collective body of information consisting of anonymizedpseudonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular anonymizedpseudonymized personal information (referred to as an "anonymizeda "pseudonymized personal information database or the equivalent" in Article 4341, paragraph (1) and Article 42, paragraph (3)); provided, however, that this excludes persons set forth in each item of paragraph (2).

"Businessbusiness handling information related toanonymized personal information" in this Chapter and ChaptersChapter VI and VII means a person that uses a collective body of information consisting of information related toanonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular information related toanonymized personal information (referred to as an "database or the equivalent ofanonymized personal information related to personal informationdatabase or the equivalent" in Article 3143, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).

"Academic research institution or the equivalentBusiness handling information related to personal information" in this Chapter and Chapter VI means a university or other organization or group associated with academic studies, person that uses collective body of information consisting of information related to personal information for business, which has been systematically organized to be searchable using a computer or a person belonging is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular information related to personal information (referred to as a "database or the equivalent of information related to itpersonal information" in Article 31, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).

"academic research institution or the equivalent" in this Chapter means a university or other organization or group associated with academic studies (including a hospital prescribed in Article 1-5, paragraph (1) of the Medical Care Act (Act No. 205 of 1948) (referred to as a "hospital" in Article 58, paragraph (2)) and other organizations or groups for the purpose of providing medical care), or a person belonging to it.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling the personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal information, that handling it is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases of acquiring the sensitive personal information fromconducting academic research jointly with an academic research institution or the equivalent and it is necessary to acquire that the sensitive personal information from that academic research institution or the equivalent for academic research purposepurposes (including cases in which a part of the purpose of acquiring the sensitive personal information is for academic research purposes, excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the academic research institution or the equivalent jointly conduct academic research);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that acquiring the sensitive personal information is open to unavoidably necessary for the public by a person identifiable by that information, a national government organ, a local government, an academic research institution or performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the equivalent, a person set forth in each item of Article 57, paragraph (1), or other acquisition of the sensitive personal information, that acquiring it is not contrary to the intention of the identifiable person prescribed by Order of and therefore does not harm the Personal Information Protection Commissionperson's rights and interests;

other cases prescribed by Cabinet Order of receiving the provision pursuant to the main clause of Article 30-2, paragraph (5), or of acquiring, as equivalent sensitive personal information, information related to personal information provided pursuant to the cases set forth in each preceding item.main clause of Article 31-3, paragraph (1);

cases in which the sensitive personal information is open to the public by a person identifiable by that information, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

A business handling personal information must, when handling specified biometric personal information, notify the identifiable person of the following matters in advance, or put them in a state where the identifiable person can easily know them, as provided by Order of the Personal Information Protection Commission:

the name and address of that business handling personal information and, if it is a corporation, the name of its representative (or, for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; the same applies in Article 27, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));

the fact that specified biometric personal information will be handled;

the purpose of use of the specified biometric personal information;

the content of the information on the characteristic of a part of the body that is converted into the specified biometric individual identification code included in the specified biometric personal information;

the procedures for responding to a request for disclosure or other handling prescribed in Article 37, paragraph (1) (including the amount of the fee, if a fee is collected pursuant to the provisions of Article 38, paragraph (1));

other matters prescribed by Order of the Personal Information Protection Commission as those necessary to protect individual rights and interests.

The provisions of the preceding paragraph do not apply in the following cases:

taking the measures under the preceding paragraph is likely to harm the life, wellbeing, property, or other rights or interests of the identifiable person or a third party;

taking the measures under the preceding paragraph is likely to harm the rights or legitimate interests of the business handling personal information;

it is necessary for the business to cooperate with a national government organ or a local government in performing the functions prescribed by laws and regulations, and taking the measures under the preceding paragraph is likely to interfere with the performance of those functions;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in the preceding three items.

In cases prescribed in the preceding paragraph, businesses handling personal information (excluding those that have given a notice under the proviso of that paragraph) must notify the identifiable person of the occurrence of the situation, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply if it is difficult to notify the identifiable person of that occurrence, or in a case prescribed by Order of the Personal Information Protection Commission as one in which there is little risk of a failure to protect the identifiable person's rights and interests even if the identifiable person is not notified, and the necessary alternative measures are taken to protect that person's rights and interests.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which the business handling personal information that is an academic research institution or the equivalent conducts academic research jointly with a third party, and needs to provide the personal data to that third party for the academic research purpose (including cases in which a part of the purpose of providinghandling the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the third party jointly conduct academic research);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that providing the personal data is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal data, that providing it is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests.

Notwithstanding the provisions of the preceding paragraph, if a business handling personal information agrees to cease to provide a third party with any personal data which can be used to identify the identifiable person, at the request of that person; the business notifies that person of the following information in advance or makes that information readily accessible to that person in advance, as provided for by Order of the Personal Information Protection Commission; and the business files a notification of this to the Commission, the business may provide that personal data to a third party; provided, however, that this does not apply to cases in which personal data which is to be provided to a third party is sensitive personal information or specified biometric personal information, has been acquired in violation of the provisions of Article 20, paragraph (1), or has been provided by another business handling personal information pursuant to the provisions of the main clause of this paragraph (including personal data all or part of which has been reproduced or processed):

the name and address of a business handling personal information that provides personal information to a third party and, if it is a corporation, the name of its representative (or for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; hereinafter the same applies in this Article, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));

When providing personal data to a third party (excluding a person set forth in each item of Article 16, paragraph (2); hereinafter the same applies in this Article, Article 29, paragraph (1), and Article 30, paragraphs (1) and (2) (including as applied mutatis mutandis pursuant to Article 31, paragraph (3))) pursuant to the provisions of the main clause of paragraph (2), a business handling personal information must confirm the following matters in advance, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply in cases in which all of that personal data had been open to the public, at the time when that business handling personal information acquired that personal data, by the identifiable person, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission, or in cases prescribed by Order of the Personal Information Protection Commission as equivalent to those cases.

the name and address of the third party and, if the third party is a corporation, the name of its representative;

the purpose of use of the personal data by the third party.

A third party that has been asked by a business handling personal information to give confirmation under the preceding paragraph must not deceive that business handling personal information on a matter relating to the confirmation.

Except cases set forth in the items of paragraph (1) of the preceding Article, before businesses handling personal information provide personal data to a third party (excluding a person that establishes a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to those that a business handling personal information must take concerning the handling of personal data pursuant to the provisions of this Section (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph, the following paragraph and Article 31, paragraph (1), item (ii)) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)) () (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)Section), the businesses must obtain an identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country. In this case, the provisions of the preceding Article do not apply.

When having provided personal data to a third party (excluding a person set forth in each item of Article 16, paragraph (2); hereinafter the same applies in this Article and the following Article (including as applied mutatis mutandis pursuant to Article 31, paragraph (3) following the deemed replacement of terms)), , businesses handling personal information must prepare a record pursuant to Order of the Personal Information Protection Commission on the date of the provision of the personal data, the name of the third party, and other matters prescribed by Order of the Personal Information Protection Commission (or, in cases in which confirmation under Article 27, paragraph (7) has been given, those matters and the matters set forth in item (ii) of that paragraph); provided, however, that this does not apply to cases in which the provision of personal data falls under any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article).

Notwithstanding the provisions of Article 20, paragraph (2), if a business handling personal information needs to handle sensitive personal information that is currently open to the public for the purpose of conducting statistical compilation or similar analysis (hereinafter referred to as the "purpose of statistical compilation or similar analysis" in this paragraph, paragraph (5), and Article 31-3, paragraph (1)) or for the purpose of making a provision under the main clause of paragraph (5) (limited to cases in which the entire purpose of handling that sensitive personal information is the purpose of statistical compilation or similar analysis or the purpose of making that provision), and has disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the name of that business handling personal information, the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information it acquires or the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5), and other matters prescribed by Order of the Personal Information Protection Commission, the business may acquire that sensitive personal information currently open to the public without obtaining the consent of the identifiable person.

A business handling personal information that has acquired sensitive personal information pursuant to the provisions of the preceding paragraph (referred to as a "special-provision acquirer of sensitive personal information" in the following paragraph, paragraph (4), and Article 72-3, paragraph (1)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in the preceding paragraph, the matters prescribed in that paragraph (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in the proviso to the following paragraph, those matters as changed) for the period during which it handles that sensitive personal information or information relating to a living individual produced by reproducing or processing all or part of it.

When changing the matters it discloses to the public pursuant to the provisions of the preceding paragraph, a special-provision acquirer of sensitive personal information must disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), that fact and the content of the change; provided, however, that when changing the name of that special-provision acquirer of sensitive personal information or other matters prescribed by Order of the Personal Information Protection Commission, it is sufficient for it to disclose to the public that fact and the content of the change promptly after making the change, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1).

Notwithstanding the provisions of Article 18, a business handling personal information that handles sensitive personal information acquired pursuant to the provisions of paragraph (1) or information relating to a living individual produced by reproducing or processing all or part of it (excluding that which constitutes provided personal information, etc. for statistical compilation or similar analysis prescribed in paragraph (6); hereinafter referred to as "sensitive personal information, etc. for statistical compilation or similar analysis") must not handle that sensitive personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for performing the act specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations and in cases in which there is an urgent need to rescue human life, provide disaster relief, or respond to any other emergency situation (hereinafter referred to as "cases based on laws and regulations, etc." in this Chapter).

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates (excluding the case set forth in item (iii)): statistical compilation or similar analysis of the content so disclosed;

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the fact that it will handle the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates for the purpose of making a provision under the main clause of the following paragraph (excluding the case set forth in the following item): that provision;

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates and the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of the following paragraph: statistical compilation or similar analysis of the content so disclosed, and that provision.

Notwithstanding the provisions of Article 18 and Article 27, paragraph (1), if a third party (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity (meaning an administrative organ's head or administrative entity prescribed in Article 63; the same applies in paragraph (9), item (ii), paragraph (12), and Article 31-3, paragraph (5), item (ii) and paragraph (8)) (if that person is a person in a foreign country, limited to a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to those that a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, and a business handling information related to personal information (hereinafter referred to as a "business handling personal or other related information") must take concerning the handling of personal information, pseudonymized personal information, anonymized personal information, and information related to personal information (hereinafter referred to as "personal or other related information") pursuant to the provisions of this Chapter (those measures being referred to as "equivalent measures" in paragraph (13) and Article 31-3, paragraph (9)) (that system being referred to as a "system that conforms to standards" in paragraph (13) and Article 31-3, paragraph (9)); the same applies in paragraph (12) and Article 31-3, paragraph (8)); hereinafter the same applies in this paragraph, the following paragraph, and Article 31-3, paragraphs (1) and (2)) needs to handle personal information (including sensitive personal information, etc. for statistical compilation or similar analysis; hereinafter the same applies in this paragraph through paragraph (7), paragraph (13), and Article 72-3, paragraphs (2) and (3)) for the purpose of statistical compilation or similar analysis (limited to cases in which the entire purpose of handling that personal information is the purpose of statistical compilation or similar analysis), and the case falls under all of the following items, a business handling personal information may provide that personal information to that third party without obtaining the consent of the identifiable person; provided, however, that this does not apply if that personal information has been provided by another business handling personal information or by a business handling information related to personal information pursuant to the provisions of the main clause of this paragraph or the main clause of Article 31-3, paragraph (1) (including personal information all or part of which has been reproduced or processed).

that business handling personal information and that third party have disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the names of that business handling personal information and that third party, the content of the statistical compilation or similar analysis they intend to conduct, and other matters prescribed by Order of the Personal Information Protection Commission;

it is clearly specified by a written agreement (including an electronic or magnetic record) with that third party that the provision is made under the main clause of this paragraph.

A third party that has received a provision of personal information pursuant to the main clause of the preceding paragraph (limited to a person that is a business handling personal information; referred to as a "special-provision recipient of personal information" in this Article and Article 72-3, paragraph (5), item (i)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in item (i) of the preceding paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in paragraph (8), those matters as changed) for the period during which it handles that personal information or information relating to a living individual produced by reproducing or processing all or part of it (hereinafter referred to as "provided personal information, etc. for statistical compilation or similar analysis").

A special-provision recipient of personal information may change the matters disclosed to the public pursuant to the provisions of the preceding paragraph only if both that special-provision recipient of personal information and the business handling personal information that provided personal information to that special-provision recipient of personal information pursuant to the main clause of paragraph (5) disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (5), item (i), that those matters will be changed and the content of the change; provided, however, that this does not apply when changing the name of that special-provision recipient of personal information or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the special-provision recipient of personal information must, promptly after making the change, disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (5), item (i), that it has made the change and the content of the change.

Notwithstanding the provisions of Article 18, a business handling personal information that handles provided personal information, etc. for statistical compilation or similar analysis must not handle that provided personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations, etc.

if the provision under the main clause of paragraph (5) to which that provided personal information, etc. for statistical compilation or similar analysis relates was made to a special-provision recipient of personal information: statistical compilation or similar analysis of the content which that special-provision recipient of personal information discloses to the public pursuant to the provisions of paragraph (6);

if the provision under the main clause of paragraph (5) to which that provided personal information, etc. for statistical compilation or similar analysis relates was made to an administrative organ's head or administrative entity: statistical compilation or similar analysis of the content which that administrative organ's head or administrative entity discloses to the public pursuant to the provisions of Article 72-3, paragraph (2).

Notwithstanding the provisions of Article 27, paragraphs (1) and (2) and Article 28, paragraph (1), a business handling personal information that handles sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis must not provide personal data that constitutes that sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis to a third party, except in the following cases. In this case, the phrase "is not to fall under a third party regarding applying the provisions of each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "(limited to a person that is a business handling personal information or an administrative organ's head or administrative entity prescribed in Article 63 (limited, if such a person is a person in a foreign country prescribed in paragraph (1) of the following Article, to a person that has established a system that conforms to standards prescribed in Article 30-2, paragraph (5))) is not to fall under a third party regarding applying the provisions of Article 30-2, paragraph (10)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso to Article 29, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in Article 30-2, paragraph (4) or any of the items of Article 27, paragraph (5)"; and the phrase "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso to Article 30, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in paragraph (4) of the following Article or any of the items of Article 27, paragraph (5)".

cases based on laws and regulations, etc.;

cases in which that business handling personal information has acquired sensitive personal information pursuant to the provisions of paragraph (1) and has disclosed to the public, pursuant to the provisions of paragraph (2), the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5), and that business handling personal information provides the sensitive personal information, etc. for statistical compilation or similar analysis relating to that sensitive personal information pursuant to the main clause of paragraph (5).

Notwithstanding the provisions of Article 31, paragraph (1), a business handling personal information that handles sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis must not provide that sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (excluding those that constitute personal data; the same applies in the following paragraph) to a third party, except in the cases set forth in the items of the preceding paragraph.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving the provision of sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity). In this case, the phrase "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 30-2, paragraph (11)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; and the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public".

A business handling personal information that has provided personal information pursuant to the main clause of paragraph (5) to a third party in a foreign country that has established a system that conforms to standards, or has provided sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis to that third party, must take necessary measures to ensure continuous implementation of the equivalent measures by that third party, and disclose information on those necessary measures to the public, pursuant to Order of the Personal Information Protection Commission. In this case, the provisions of Article 28, paragraph (3) do not apply.

The provisions of Articles 23 through 25 apply mutatis mutandis to the handling of sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (excluding those that constitute personal data) by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling personal information provides sensitive personal information, etc. for statistical compilation or similar analysis (limited to that which constitutes information related to personal information prescribed in Article 31, paragraph (1)) to a special-provision recipient of personal information pursuant to the main clause of paragraph (5) (limited to cases in which it is assumed that the special-provision recipient of personal information acquires that sensitive personal information, etc. for statistical compilation or similar analysis as personal data). In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking".

A business handling personal information that has been entrusted by another business handling personal information or an administrative entity with all or part of the handling of personal information (including entrustment through two or more tiers) must not, except in cases based on laws and regulations, etc., handle the personal information whose handling it has been entrusted with (excluding that which constitutes information related to personal information for that business handling personal information) beyond the scope necessary for the performance of the entrusted services.

Except cases set forth in each item of Article 27, paragraph (1), if it is assumed that a third party acquires information related to personal information (limited to those compiled in a database or the equivalent of information related to personal information; hereinafter the same applies in this Chapterparagraph and Chapter VIthe following paragraph) as personal data, businesses handling information related to personal information must not provide the information related to personal information to the third party without confirming the matters set forth as follows pursuant to Order of the Personal Information Protection Commission:

The provisions of Article 30, paragraphs (2) through (4) of the preceding Article apply mutatis mutandis to cases in which a business handling information related to personal information conducts confirmation pursuant to the provisions of paragraph (1). In this case, the phrase "received" in paragraph (3) of the precedingthat Article is deemed to be replaced with "provided."

A business handling information related to personal information must not utilize contact-enabling information related to personal information in a way that there is a possibility of fomenting or inducing unlawful or unjust act.

A business handling information related to personal information must not acquire contact-enabling information related to personal information by deception or other wrongful means.

Notwithstanding the provisions of Article 31, paragraph (1) (limited to the part relating to item (i)), if a third party needs to handle information related to personal information for the purpose of statistical compilation or similar analysis (limited to cases in which the entire purpose of handling that information related to personal information is the purpose of statistical compilation or similar analysis), and the case falls under all of the following items, a business handling information related to personal information may provide that information related to personal information to that third party without confirming the matter set forth in Article 31, paragraph (1), item (i); provided, however, that this does not apply if that information related to personal information has been provided by a business handling personal information or by another business handling information related to personal information pursuant to the provisions of the main clause of Article 30-2, paragraph (5) or the main clause of this paragraph (including information all or part of which has been reproduced or processed).

that business handling information related to personal information and that third party have disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the names of that business handling information related to personal information and that third party, the content of the statistical compilation or similar analysis they intend to conduct, and other matters prescribed by Order of the Personal Information Protection Commission;

it is clearly specified by a written agreement (including an electronic or magnetic record) with that third party that the provision is made under the main clause of this paragraph.

A third party that has received a provision of information related to personal information pursuant to the main clause of the preceding paragraph and acquired it as personal data (limited to a person that is a business handling personal information; referred to as a "special-provision recipient of information related to personal information" in this Article and Article 72-3, paragraph (9), item (i)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in item (i) of the preceding paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in paragraph (4), those matters as changed) for the period during which it handles that information related to personal information or information relating to a living individual produced by reproducing or processing all or part of it (hereinafter referred to as "provided personal data, etc. for statistical compilation or similar analysis").

A special-provision recipient of information related to personal information may change the matters disclosed to the public pursuant to the provisions of the preceding paragraph only if both that special-provision recipient of information related to personal information and the business handling information related to personal information that provided information related to personal information to that special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1) disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that those matters will be changed and the content of the change; provided, however, that this does not apply when changing the name of that special-provision recipient of information related to personal information or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the special-provision recipient of information related to personal information must, promptly after making the change, disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that it has made the change and the content of the change.

Notwithstanding the provisions of Article 18, a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations, etc.

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to a special-provision recipient of information related to personal information: statistical compilation or similar analysis of the content which that special-provision recipient of information related to personal information discloses to the public pursuant to the provisions of paragraph (2);

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to an administrative organ's head or administrative entity: statistical compilation or similar analysis of the content which that administrative organ's head or administrative entity discloses to the public pursuant to the provisions of Article 72-3, paragraph (6).

Notwithstanding the provisions of Article 27, paragraphs (1) and (2) and Article 28, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide personal data that constitutes that provided personal data, etc. for statistical compilation or similar analysis to a third party, except in cases based on laws and regulations, etc. In this case, the phrase "is not to fall under a third party regarding applying the provisions of each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "(limited to a person that is a business handling personal information or an administrative organ's head or administrative entity prescribed in Article 63 (limited, if such a person is a person in a foreign country prescribed in paragraph (1) of the following Article, to a person that has established a system that conforms to standards prescribed in Article 30-2, paragraph (5))) is not to fall under a third party regarding applying the provisions of Article 31-3, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso to Article 29, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in Article 30-2, paragraph (4) or any of the items of Article 27, paragraph (5)"; and the phrase "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso to Article 30, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in paragraph (4) of the following Article or any of the items of Article 27, paragraph (5)".

Notwithstanding the provisions of Article 31, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide that provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data; the same applies in the following paragraph) to a third party, except in cases based on laws and regulations, etc.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving the provision of provided personal data, etc. for statistical compilation or similar analysis (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity). In this case, the phrase "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 31-3, paragraph (7)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; and the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public".

A business handling information related to personal information that has provided information related to personal information pursuant to the main clause of paragraph (1) to a third party in a foreign country that has established a system that conforms to standards, or a business handling personal information that has provided provided personal data, etc. for statistical compilation or similar analysis to that third party, must take necessary measures to ensure continuous implementation of the equivalent measures by that third party, and disclose information on those necessary measures to the public, pursuant to Order of the Personal Information Protection Commission. In this case, the provisions of Article 28, paragraph (3) do not apply.

The provisions of Articles 23 through 25 apply mutatis mutandis to the handling of provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data) by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information to a special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1). In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking".

the procedures for responding to a request under the following paragraph,for disclosure or to a request under paragraph (1) of the following Article (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (1); orother handling prescribed in Article 3537, paragraph (1), paragraph (3), or paragraph (5) ( (including the amount of the fee, if one a fee is setcollected pursuant to the provisions of Article 38, paragraph (21));

When having received a request under the preceding paragraph, a business handling personal information must disclose personal data the business holds to an identifiable person without delay by means that person requests pursuant to the provisions of that paragraph (or by paper-based document, in cases in which disclosing the data by that means would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances); provided, however, that in cases in which disclosing that data falls under any of each following, all or a part of it may not be disclosed:

Identifiable persons may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify that person (hereinafter referred to as a "ceasing to use or deleting personal data" in this Article), if the personal data the business holds is being handled in violation of the provisions of Article 18 or, Article 19, Article 30-2, paragraph (4) or (9), Article 30-3, or Article 31-3, paragraph (5), or has been obtained in violation of the provisions of Article 20.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds to the extent necessary to redress the violation without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person.

Identifiable persons may request that a business handling personal information cease to provide a third party with the personal data the business holds that can be used to identify the person, if the personal data the business holds is being provided to a third party in violation of the provisions of Article 27, paragraph (1) , Article 28, Article 30-2, paragraph (10), or Article 2831-3, paragraph (6).

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to provide a third party with the personal data the business holds without delay; provided, however, that this does not apply if ceasing to provide a third party with the personal data the business holds would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect an identifiable person's rights and interests.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds to the extent necessary to prevent an infringement of the identifiable person's rights and interests without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect the identifiable person's rights and interests.

If An identifiable person may request that a business handling personal information have ceasedcease to use or deleteddelete, or decided not to cease to use or delete all or part of personal data the business holds in connection withprovide a request under paragraph (1) or (5), or third party with, the business has ceased to provide a third party or decided not to ceasespecified biometric personal information that can be used to provide a third party with all or part ofidentify that person (limited to that included in the personal data the business holds in connection with a request under paragraph (3) or (5), the business must notify), if that specified biometric personal information is being handled, except in the identifiable person to that effect without delay.following cases:

cases in which the business handling personal information has created the specified biometric individual identification code included in that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information has acquired that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information handles that specified biometric personal information based on laws and regulations;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that specified biometric personal information in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that specified biometric personal information from that academic research institution or the equivalent, or in which a specified biometric individual identification code created by converting information that the business handling personal information conducting academic research jointly with an academic research institution or the equivalent has acquired from that academic research institution or the equivalent is included in that specified biometric personal information, and the business needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that specified biometric personal information by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the creation of the specified biometric individual identification code included in that specified biometric personal information or the circumstances of the acquisition of that specified biometric personal information, that handling it by the business handling personal information is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete that specified biometric personal information, or cease to provide it to a third party, without delay; provided, however, that this does not apply if ceasing to use or deleting that specified biometric personal information or ceasing to provide it to a third party would prove difficult because it would require a costly expenditure or due to other circumstances, and the business takes the necessary alternative measures to protect the identifiable person's rights and interests.

An identifiable person under 16 years of age may request that a business handling personal information cease to use or delete, or cease to provide a third party with, the personal data the business holds that can be used to identify that person, if that personal data the business holds is being handled, except in the following cases:

cases in which the business handling personal information has acquired that personal data the business holds with the consent of the legal representative of the identifiable person obtained in advance;

cases in which the business handling personal information handles that personal data the business holds based on laws and regulations;

cases in which the business handling personal information needs to handle that personal data the business holds in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that personal data the business holds in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that personal data the business holds in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that personal data the business holds from that academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that personal data the business holds by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal data the business holds, that handling it by the business handling personal information does not harm the rights and interests of the identifiable person under 16 years of age;

cases in which that personal data the business holds had been open to the public, at the time when the business handling personal information acquired it, by the legal representative of the identifiable person, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission;

cases in which the legal representative of the identifiable person had permitted the identifiable person to engage in business, and the business handling personal information acquired that personal data the business holds in connection with that business;

cases in which the identifiable person had used fraudulent means to make the business handling personal information believe that the identifiable person was 16 years of age or older;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or due to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person under 16 years of age.

If a business handling personal information have ceased to use or deleted, or decided not to cease to use or delete all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (1), (5), (7), or (9), or the business has ceased to provide a third party or decided not to cease to provide a third party with all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (3), (5), (7), or (9), the business must notify the identifiable person to that effect without delay.

If, pursuant to the provisions of Article 32, paragraph (3), Article 33, paragraph (3) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (3) or paragraph (711) of the preceding Article, a business handling personal information notifies an identifiable person that it will not take all or part of the measures which the person has requested the business take, or that it will take different measures, the business must endeavor to explain its reasons for this to the person.

As regards a request under Article 32, paragraph (2), or a request under Article 33, paragraph (1) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article; the same applies in paragraph (1) of the following Article and Article 39), Article 34, paragraph (1), Article 35, paragraph (1), (3), (5), (7), or (59) (hereinafter referred to as a "request for disclosure or other handling" in this Article and Article 54, paragraph (1)Chapter), a business handling personal information may decide on a method of receiving a request as prescribed by Cabinet Order. In such a case, an identifiable person must request disclosure or other handling in that way.

A business handling personal information may request an identifiable person requesting disclosure or other handling to present sufficient information to identify the personal data the business holds or the specified biometric personal information, or the record of provision to a third party, that would be subject to the disclosure or other handling. In such a case, the business handling personal information must provide information to help the person identify the relevant personal data the business holds or the relevant specified biometric personal information, or the relevant record of provision to a third party, or take other appropriate measures in consideration of the identifiable person's convenience, so as to allow the person to easily and accurately request disclosure or other handling.

A person may request disclosure legal representative of a minor or other handling throughadult ward, or an agent, as prescribed privately appointed by the identifiable person or any other agent specified by Cabinet Order may make a request for disclosure or other handling on behalf of the identifiable person.

When seeking to file a lawsuit in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), (5), (7), or (59), the identifiable person may not file the lawsuit unless the identifiable person had previously issued a request against a person who should become a defendant in the lawsuit and two weeks have elapsed since the arrival day of the issued request; provided, however, that this does not apply if the person who should become a defendant in the lawsuit has rejected the request.

The provisions of the preceding two paragraphs apply mutatis mutandis to a petition for a provisional disposition order in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), (5), (7), or (59).

A business handling personal information must endeavor to process complaints about the handling of personal information, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis appropriately and promptly.

With regard to applying the provisions of Article 18, Article 20, paragraph (2), Article 21, Article 21-2, paragraph (1), Article 26, paragraph (2), Article 27, Article 28, Article 30-2, paragraphs (1) and (5), Article 32, paragraph (1), and Article 35, paragraph (7) to personal information of a person under 16 years of age when a business handling personal information handles that personal information (excluding the following cases), the phrase "the identifiable person" in those provisions (excluding the provisions of Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i), the proviso to Article 26, paragraph (2), Article 27, paragraph (1), item (viii) and paragraph (2), Article 28, paragraph (3), and the part of Article 35, paragraph (7) other than its items, and item (ix) of that paragraph) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests" in Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 27, paragraph (1), item (viii), and Article 35, paragraph (7), item (ix) is deemed to be replaced with "does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively; the phrase "the identifiable person" in the proviso to Article 26, paragraph (2) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "at the request of that person" in Article 27, paragraph (2) is deemed to be replaced with "at the request of that person or that person's legal representative", the phrase "the business notifies that person" in that paragraph is deemed to be replaced with "the business notifies the legal representative of that person", and the phrase "or makes that information readily accessible to that person" in that paragraph is deemed to be replaced with "or makes that information readily accessible to the legal representative of that person"; and the phrase "to the identifiable person at the request of that person" in Article 28, paragraph (3) is deemed to be replaced with "to the identifiable person or that person's legal representative at the request of the identifiable person or that person's legal representative".

cases in which there is a legitimate reason for the business handling personal information not knowing that the personal information is that of a person under 16 years of age;

cases in which the legal representative of the identifiable person has permitted the identifiable person to engage in business, and the business handling personal information has acquired the personal information in connection with that business;

cases in which the identifiable person has no legal representative, or the business handling personal information has reasonable grounds to believe that the identifiable person has no legal representative.

With regard to applying the provisions of Article 31, paragraph (1) to information related to personal information when a business handling information related to personal information handles information related to personal information concerning a person under 16 years of age (excluding the following cases), the phrase "the identifiable person's consent" in item (i) of that paragraph is deemed to be replaced with "the consent of the legal representative of the identifiable person", and the phrases "the identifiable person's consent", "serves as a reference to the person" and "provided in advance to the person" in item (ii) of that paragraph are deemed to be replaced with "the consent of the legal representative of the identifiable person", "serves as a reference to the legal representative of the identifiable person" and "provided in advance to the legal representative of the identifiable person" respectively.

cases in which there is a legitimate reason for the business handling information related to personal information not knowing that the information related to personal information concerns a person under 16 years of age;

cases in which the legal representative of the person to whom the information related to personal information relates has permitted that person to engage in business, and the business handling information related to personal information has acquired the information related to personal information in connection with that business;

cases in which the person to whom the information related to personal information relates has no legal representative, or the business handling information related to personal information has reasonable grounds to believe that the person to whom the information related to personal information relates has no legal representative.

When preparing pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent; hereinafter the same applies in this Chapter (excluding paragraphs (3) and Chapter VI(4) of the following Article, Article 54, paragraph (1), and Article 58, paragraph (2))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual unless collated with other information.

With regard to applying the provisions of Article 21 and paragraph (1) of the preceding Article related to pseudonymized personal information, the phrase "notify the identifiable person of that purpose of use or disclose this to the public" in Article 21, paragraphs (1) and (3) of that Article is deemed to be replaced with "disclose that purpose of use"; the phrase "notifying the identifiable person of the purpose of use or disclosing this to the public" in the provisions of items (i) through (iii) of paragraph (4) of that Article is deemed to be replaced with "disclosing the purpose of use"; the phrase "Article 20, paragraph (2), Article 21" in paragraph (1) of the preceding Article is deemed to be replaced with "Article 20, paragraph (2)"; the phrase "Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i)" in that paragraph is deemed to be replaced with "Article 20, paragraph (2), item (vii)"; and the phrase '"does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively' in that paragraph is deemed to be replaced with '"does not harm the identifiable person's rights and interests"'.

Notwithstanding the provisions of Article 27, paragraphs (1) and (2), and Article 28, paragraph (1), and except cases based on laws and regulations, businesses handling pseudonymized personal information must not provide a third party with personal data that constitutes pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 41, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" in Article 27, paragraph (6) is deemed to be replaced with "disclose this without delay"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso of Article 29, paragraph (1), is deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)"; and the term "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso of Article 30, paragraph (1) areis deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)".

Businesses handling pseudonymized personal information, in handling that information, must not use contact addresses and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) or a specified correspondence delivery operator prescribed in Article 2, paragraph (9), for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

Except in cases based on laws and regulations, businesses handling pseudonymized personal information must not provide pseudonymized personal information (excluding those that constitute personal information; hereinafter the same applies in the following paragraph and paragraph (3)this Article) to a third party.

The provisions of Articles 23 through 25, Article 40, and paragraphs (7) and (8) of the preceding Article apply mutatis mutandis to the handling of pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent) by a business handling pseudonymized personal information, and the provisions of Article 40 apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information, respectively. In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking"; and the term "not" in Article 41, paragraph (7) is replaced with "neither acquire deleted or other related information, nor".

The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling pseudonymized personal information, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

When preparing anonymized personal information (limited to those compiled in an anonymized personal information database or the equivalent; hereinafter the same applies in this Chapter (excluding paragraph (6) of this Article, Article 46, Article 46-2, and Chapter VIArticle 54, paragraph (1))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual and restore the information to its original state.

Businesses handling anonymized personal information, before providing anonymized personal information (excluding those into which they have processed personal information themselves; hereinafter the same applies in this SectionArticle through Article 46) to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information it will provide to the third party, and the means of providing this, and state to the third party explicitly that the information it will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling anonymized personal information, of anonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

A corporation (or an organization without legal personality that has made provisions for a representative or manager; the same applies in item (iii), (b) of the following Article) seeking to perform services as set forth in one of the following items with the aim of ensuring that a business handling personal or other related information, pseudonymized personal (excluding a business handling information, or anonymized related to personal information (; hereinafter referred to as "the same applies in this Section) handles the personal or other related information" in this Chapter) ( (limited, in the business in question is hereinafter referred case of information related to personal information, to as a "business handlingthat which constitutes sensitive personal information, etc. for statistical compilation or other related similar analysis, provided personal information" in this Chapter) handles the , etc. for statistical compilation or similar analysis, and provided personal informationdata, etc. for statistical compilation or similar analysis; hereinafter the same applies in this Section) properly may receive certification from the Personal Information Protection Commission:

In order to ensure the proper handling of personal or other related information by its covered businesses, a certified personal information protection organization must endeavor to create guidelines which follow the spirit of this Act (hereinafter referred to as "personal information protection guidelines" in this Section and Chapter VI), for how to specify the purpose of use of personal information, for measures to ensure its secure management, for procedures to deal with requests for disclosure or other handling, for other such matters, how to conduct statistical compilation or similar analysis concerning sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, and the security measures for that information and other such matters, as well as how to produce pseudonymized processedpersonal information or anonymized personal information, and its security measures and other such matters, by listening to the opinions of representatives of customers or other relevant persons.

The provisions of this the preceding Chapter do not apply to a business handling personal or other related information or business handling information related to personal information as set forth in one of the following items if all or part of the purpose for which it handles the information in question is the purpose prescribed in that item:

A business handling personal or other related information (excluding a business handling information related to personal information) as set forth in one of the items of paragraph (1) must, itself, endeavor to take the necessary and appropriate measures for managing the security of personal data, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, provided personal data, etc. for statistical compilation or similar analysis, pseudonymized personal information or anonymized personal information, and the necessary measures for processing complaints about the handling of personal or other related information (limited, in the case of information related to personal information, to that which constitutes sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis; hereinafter the same applies in this paragraph) and for otherwise ensuring the proper handling of personal or other related information and must also endeavor to disclose the content of those measures.

(Exception to Application) for Corporations, etc. Set Forth in Appended Table 2

a local government organ: operation of a hospital , a clinic prescribed in Article 1-5, paragraph (12) of the Medical Care Act (Act No. 205 of 1948) (referred to as a "hospital" in the following item), a clinic prescribed in paragraph (2) of that Article, , and aan university prescribed in Article 1 of the School Education Act (Act No. 26 of 1947);

With regard to the handling of personal or other related information (referred to as "entrusted personal or other related information" in items (i) and (ii)) by a business handling personal or other related information that has been entrusted with all or part of the handling of the personal or other related information by another business handling personal or other related information or by an administrative entity (hereinafter referred to as an "entrusted business handling personal or other related information" in this Article), if the matters set forth in the following items are stipulated, pursuant to Order of the Personal Information Protection Commission, in the contract for the entrustment between that other business handling personal or other related information or administrative entity (referred to as the "entrustor" in item (ii)) and the entrusted business handling personal or other related information, and the handling is carried out in accordance with the provisions of the contract concerning the matters set forth in item (i) within the scope necessary for managing the entrusted services, the provisions of Sections 2 through 4 (excluding Articles 23 through 26, Article 30-2, paragraph (14), Article 30-3, Article 31-3, paragraph (10), Article 40-2, paragraph (1), Article 41, paragraphs (2) and (9), Article 42, paragraph (3), Article 43, paragraphs (2) and (6), and Article 46) and paragraph (1) of the following Article do not apply; and for the purpose of applying the provisions of Article 30-2, paragraph (14), Article 31-3, paragraph (10), Article 41, paragraph (9), Article 42, paragraph (3), Article 43, paragraph (6), and Article 46, the phrase "までの規定は" (the provisions of Articles 23 through 25) in Article 30-2, paragraph (14) and Article 31-3, paragraph (10) is deemed to be replaced with "までの規定は、" (the provisions of Articles 23 through 25, followed by a reading comma); the phrase "by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling personal information provides sensitive personal information, etc. for statistical compilation or similar analysis (limited to that which constitutes information related to personal information prescribed in Article 31, paragraph (1)) to a special-provision recipient of personal information pursuant to the main clause of paragraph (5) (limited to cases in which the special-provision recipient of personal information is expected to acquire the sensitive personal information, etc. for statistical compilation or similar analysis as personal data), respectively" in Article 30-2, paragraph (14) and the phrase "by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information to a special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1), respectively" in Article 31-3, paragraph (10) are deemed to be replaced with "by a business handling personal information"; the phrase "pseudonymized personal information, personal data that constitutes pseudonymized personal information, and personal data the business holds that constitutes pseudonymized personal information" in Article 41, paragraph (9) is deemed to be replaced with "personal data that constitutes pseudonymized personal information", and the phrase "Article 17, paragraph (2), Article 26 and Articles 32 through 39" in that paragraph is deemed to be replaced with "Article 26"; the phrase "and paragraphs (7) and (8) of the preceding Article apply" in Article 42, paragraph (3) is deemed to be replaced with "apply", the phrase "by a business handling pseudonymized personal information, and the provisions of Article 40 apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information, respectively" in that paragraph is deemed to be replaced with "by a business handling pseudonymized personal information", and the phrase "'leaking'; and the term 'not' in Article 41, paragraph (7) is replaced with 'neither acquire deleted or other related information, nor'" in that paragraph is deemed to be replaced with "'leaking'"; and the phrase "measures for managing the security of the anonymized personal information, and the necessary measures for processing complaints about the preparation or other handling of the anonymized personal information, or for otherwise ensuring the proper handling of the anonymized personal information" in Article 43, paragraph (6) and the phrase "measures for managing the security of anonymized personal information and the necessary measures to ensure the proper handling of anonymized personal information such as processing complaints about the handling of anonymized personal information" in Article 46 are deemed to be replaced with "measures for managing the security of the anonymized personal information" and "measures for managing the security of anonymized personal information", respectively.

matters prescribed by Order of the Personal Information Protection Commission as the method of handling entrusted personal or other related information (excluding matters concerning measures for the secure management of entrusted personal or other related information and matters that are not likely to hinder the protection of individual rights and interests);

if the entrusted business handling personal or other related information learns that a situation prescribed in Article 26, paragraph (1) has arisen with regard to entrusted personal or other related information, or that entrusted personal or other related information has been handled beyond the scope necessary for managing the entrusted services or in violation of the provisions of the contract concerning the matters set forth in the preceding item, promptly reporting this to the entrustor;

other matters prescribed by Order of the Personal Information Protection Commission.

A business handling personal or other related information must, with regard to the handling of personal or other related information concerning minors, comply with the provisions of this Act, and also endeavor to take necessary measures so as not to harm the rights or interests of minors, after giving primary consideration to their best interests in accordance with their age and degree of development.

When making a request for disclosure or other handling (or, for the legal representative of the identifiable person under 16 years of age, when making a request for disclosure or other handling or giving the consent under Article 35, paragraph (9), item (i); under Article 18, paragraph (1) or (2), the part of Article 20, paragraph (2) other than the items, the part of Article 27, paragraph (1) other than the items, or Article 28, paragraph (1), as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1); or under Article 31, paragraph (1), item (i), as applied following the deemed replacement of terms pursuant to Article 35, paragraph (7), item (i) or (ii) or Article 40-2, paragraph (2)), the legal representative of the identifiable person who is a minor must give primary consideration to the best interests of that identifiable person.

"Anonymizedanonymized personal information the administrative entity holds" in this Chapter means any anonymized personal information that can be prepared in a way that processes all or a part of personal information the administrative entity holds (excluding that which constitutes sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis; the same applies in items (ii) and (iii) and Section 5) that constitutes a personal information file that falls under all of the following items (if a part of that personal information the administrative entity holds contains non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article; hereinafter the same applies in this paragraph), non-disclosure information prescribed in Article 5 of the Incorporated Administrative Agencies Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article), or non-disclosure information prescribed in the information disclosure ordinance of local government (meaning a local government's ordinance which provides for the resident's or other equivalent person's right to request the disclosure of information the local government organ or local incorporated administrative agency holds; hereinafter the same applies in this Chapter) (that non-disclosure information means information equivalent to non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act), the part containing the above-mentioned non-disclosure information is excluded):

The head of an administrative organ (for any organ designated by Cabinet Order referred to in Article 2, paragraph (89), items (v) through (vii), the head is designated for each respective organ by Cabinet Order; hereinafter the same applies in this Chapter and Article 174), a local government organ, an incorporated administrative agency or other prescribed corporation, and a local incorporated administrative agency (hereinafter referred to as an "administrative organ's head or administrative entity" in this Chapter and the following Chapter) must not utilize personal information using a method that has the possibility of fomenting or inducing unlawful or unjust act.

cases in which it is difficult to give a notification to the identifiable person, or cases prescribed by Order of the Personal Information Protection Commission as those in which there is little risk of the protection of the rights and interests of the identifiable person being impaired even if no notification is given to the identifiable person, and necessary alternative measures are taken to protect the person's rights and interests;

beyond what is set forth in the preceding three items, if the personal information the administrative entity holds is provided exclusively for statisticalthe purpose orof statistical compilation or similar analysis or for academic research purpose; provision of the information to other persons is obviously beneficial to the identifiable person; or there are other special grounds for providing that personal information.

Except in cases based on laws and regulations or set forth in Article 69, paragraph (2), item (iv), before an administrative organ's organ 's head or administrative entity provides personal information the administrative entity holds to a third party (excluding a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to the one that a business handling personal information (meaning a business handling personal information prescribed in Article 16, paragraph (2) ; the same applies in the following Article and Article 72-3, paragraphs (3) and (10)) is to take concerning the handling of personal data (meaning personal data prescribed in Article 16, paragraph (3) ; the same applies in Article 72-3, paragraph (6)) pursuant to the provisions of Section 2 of the preceding Chapter (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph and the following paragraph) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article) (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article) for any purpose other than the purpose of use, the administrative organ's head or administrative entity must acquire the identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country.

An administrative entity that has been entrusted with all or part of the handling of personal information (including entrustment via two or more layers) by a business handling personal information or by another administrative entity must not, except in cases based on laws and regulations and cases in which there is an urgent need to respond to the rescue of human life, disaster relief, or other emergency situations (referred to as "cases based on laws and regulations, etc." in Article 72-3), handle the personal information whose handling has been entrusted to it (excluding that which becomes information related to personal information for that administrative entity) beyond the scope necessary for managing the entrusted services.

With regard to the application of the provisions of Article 62, Article 68, paragraph (2), Article 69, paragraph (2), and Article 71 to the personal information of a person under 16 years of age in cases in which an administrative entity handles that personal information (excluding the cases set forth in the following items), the phrase "to that person" in Article 62 and the phrase "notify an identifiable person" in Article 68, paragraph (2) are deemed to be replaced with "to the legal representative of that person" and "notify the legal representative of the identifiable person", respectively; the phrase "to the identifiable person" in item (i) of Article 68, paragraph (2) is deemed to be replaced with "to the legal representative of the identifiable person"; in Article 69, paragraph (2), item (i), the phrase "the identifiable person's consent" is deemed to be replaced with "the consent of the legal representative of the identifiable person", and the phrase "provided to the identifiable person" is deemed to be replaced with "provided to the identifiable person or the legal representative of the identifiable person"; the term "identifiable person" in Article 71, paragraphs (1) and (2) is deemed to be replaced with "legal representative of the identifiable person"; and the term "identifiable person" in paragraph (3) of that Article is deemed to be replaced with "identifiable person or the legal representative of the identifiable person".

cases in which the administrative organ's head or administrative entity has a legitimate reason for not knowing that the personal information is that of a person under 16 years of age;

cases in which the legal representative of the identifiable person has permitted the identifiable person to carry on a business, and the administrative entity has acquired the personal information in connection with that business;

cases in which the identifiable person has no legal representative, or in which the administrative organ's head or administrative entity has reasonable grounds to believe that the identifiable person has no legal representative.

An administrative organ's head or administrative entity must not utilize contact-enabling information related to personal information using a method that has the possibility of fomenting or inducing unlawful or unjust act.

An administrative organ's head or administrative entity must not acquire contact-enabling information related to personal information by deception or other wrongful means.

An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis provided to it (including provision via two or more layers) by a special-provision acquirer of sensitive personal information must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that sensitive personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for performing the act specified in the following items in accordance with the categories of cases set forth in those items:

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates (excluding the case set forth in item (iii)): the statistical compilation or similar analysis of the disclosed content;

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), that it handles the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates for the purpose of making a provision under the main clause of paragraph (5) of that Article (excluding the case set forth in the following item): that provision;

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates, and that it handles that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5) of that Article: the statistical compilation or similar analysis of the disclosed content and that provision.

An administrative organ's head or administrative entity that has been provided with personal information pursuant to the main clause of Article 30-2, paragraph (5) must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (4), those matters after the change) for the period during which it handles the provided personal information, etc. for statistical compilation or similar analysis relating to that personal information.

The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling personal information that provided the personal information pursuant to the main clause of Article 30-2, paragraph (5) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (2) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 30-2, paragraph (5), item (i).

An administrative organ's head or administrative entity that handles provided personal information, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:

if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to a special-provision recipient of personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of personal information discloses pursuant to the provisions of paragraph (6) of that Article;

if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (2).

An administrative organ's head or administrative entity that has been provided with information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) and has acquired it as personal data must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (8), those matters after the change) for the period during which it handles the provided personal data, etc. for statistical compilation or similar analysis relating to that information related to personal information.

The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling information related to personal information prescribed in Article 16, paragraph (8) that provided the information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (6) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 31-3, paragraph (1), item (i).

An administrative organ's head or administrative entity that handles provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:

if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to a special-provision recipient of information related to personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of information related to personal information discloses pursuant to the provisions of paragraph (2) of that Article;

if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (6).

An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., provide that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis to a third party (excluding a business handling personal information, or an administrative organ's head or administrative entity, that has been entrusted with the handling of that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis).

An administrative organ's head or administrative entity must take the necessary and appropriate measures for the secure management of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, including preventing the leaking of the sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis it handles (excluding those that constitute personal information the administrative entity holds; hereinafter the same applies in this paragraph).

The provisions of paragraphs (1) and (5) and the preceding three paragraphs apply mutatis mutandis to cases in which a person that has been entrusted (including entrustment via two or more layers) with the handling of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis by an administrative organ's head or administrative entity conducts the entrusted business, and the provisions of Article 70 apply mutatis mutandis to cases in which an administrative organ's head or administrative entity provides sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis (excluding those that constitute personal information the administrative entity holds), respectively.

Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must not utilize a contact address and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or a specified correspondence delivery operator prescribed in Article 2, paragraph (9) of that Act, for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

A legal representative of a minor or adult ward, or an agent privately appointed by the identifiable person or any other agent specified by Cabinet Order (hereinafter collectively referred to as an "agent" in this Section) may make a request for disclosure (hereinafter referred to as a "request for disclosure" in this Section, Article 125-2, paragraph (2), and Article 127) provided in the preceding paragraph on behalf of that person.

An agent may make a request for correction (hereinafter referred to as a "request for correction" in this Section, Article 125-2, paragraph (2), and Article 127) as prescribed in the preceding paragraph on behalf of the identifiable person.

if the personal information the administrative entity holds is held in violation of Article 61, paragraph (2), is handled in violation of Article 63, Article 71-2, or Article 72-3, paragraph (1), (5), or (9), is acquired in violation of Article 64, or is used in violation of Article 69, paragraphs (1) and (2): ceasing to use or deleting that personal information;

if the personal information the administrative entity holds is provided in violation of Article 69, paragraphs (1) and (2) or, Article 71, paragraph (1):, Article 71-2, or Article 72-3, paragraph (10): ceasing to provide that personal information.

An agent may make a request for ceasing to use personal information (hereinafter referred to as a "request for ceasing to use personal information" in this Section, Article 125-2, paragraph (2), and Article 127) prescribed in the preceding paragraph on behalf of the identifiable person.

An administrative organ's head or administrative entity may prepare anonymized personal information the administrative entity holds (limited to information constituting anonymized personal information files the administrative entity holds; hereinafter the same applies in this Section (excluding Article 121-2)) pursuant to the provisions of this Section.

An administrative organ's head or administrative entity must take necessary measures for proper management of the anonymized personal information the administrative entity holds, deleted information prescribed in Article 109, paragraph (4), and information on the method of the processing as performed under Article 116, paragraph (1) (hereinafter referred to as "anonymized personal information and other related information of an administrative entity" in this Article and the following Article 122), in accordance with the criteria specified by Order of the Personal Information Protection Commission as necessary for preventing the leaking of anonymized personal information and other related information of an administrative entity.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of anonymized personal information the administrative entity holds that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified), and to the handling of that anonymized personal information the administrative entity holds in cases in which a person that has been entrusted (including entrustment via two or more layers) by an administrative entity with the handling of that anonymized personal information the administrative entity holds conducts the entrusted business.

An employee or former employee of an administrative entity handling anonymized personal information and other related information of the administrative entity, a person engaged in or formerly engaged in the entrusted activities referred to in Article 121, paragraph (3) of the preceding Article, or a staffing agencydispatched worker or former staffing agency worker that handlesthat is or was engaged in handling anonymized personal information and other related information of an administrative entity must not disclose anonymized personal information and other related information of an administrative entity acquired in the course of that person's work to other persons without reason, or use that information for an unjust purpose.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of anonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

To apply the provisions of Article 98 to a person set forth in one of the items of paragraph (1) and (2) of Article 58 (limited to cases in which business prescribed in one of the items of that paragraph is conducted), the phrase "is held in violation of Article 61, paragraph (2), is handled in violation of Article 63, Article 71-2, or Article 72-3, paragraph (1), (5), or (9), is acquired in violation of Article 64, or is used in violation of Article 69, paragraphs (1) and (2)" in paragraph (1), item (i) of that Article is deemed to be replaced with "is held in violation of Article 18 , Article 19, Article 30-2, paragraph (4) or (9), Article 1930-3, or Article 31-3, paragraph (5), or is obtained in violation of Article 20"; and the term "Article 69, paragraphparagraphs (1) and (2) or, Article 71, paragraph (1), Article 71-2, or Article 72-3, paragraph (10)" in item (ii) of that paragraph is deemed to be replaced with "Article 27, paragraph (1) , Article 28, Article 30-2, paragraph (10) or (11), or Article 2831-3, paragraph (6) or (7)".

When handling personal or other related information concerning minors, an administrative organ's head or administrative entity must endeavor to take necessary measures so as not to harm the rights or interests of minors, after giving primary consideration to their best interests in accordance with their age and degree of development.

When making a request for disclosure, a request for correction, or a request for ceasing to use personal information (or, for the legal representative of the identifiable person under 16 years of age, when making a request for disclosure, a request for correction, or a request for ceasing to use personal information, or giving the consent under Article 69, paragraph (2), item (i) or Article 71, paragraph (1), as applied following the deemed replacement of terms pursuant to Article 71-3), the legal representative of the identifiable person who is a minor must give primary consideration to the best interests of that identifiable person.

An administrative organ's head or administrative entity must endeavor to properly and expeditiously process a complaint on the handling of personal information, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, provided personal data, etc. for statistical compilation or similar analysis, pseudonymized personal information or anonymized personal information in that administrative entity.

affairs (excluding those set forth in item (iv)) related to supervision of the handling of personal information , sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis by a business handling personal information, the handling of pseudonymized personal information by a business handling personal information or a business handling pseudonymized personal information, the handling of anonymized personal information by a business handling personal information or a business handling anonymized personal information, the handling of information related to personal information by a business handling information related to personal information; affairs related to monitoring over the handling of personal information, pseudonymized personal information, anonymized personal information and informationor other related to personal information by an administrative entity; affairs related to necessary mediation on a lodged complaint related to the handling of personal information, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, provided personal data, etc. for statistical compilation or similar analysis, pseudonymized personal information and anonymized personal information; and affairs related to cooperation with a business that deals with that complaint;

Division 1 Reports and On-Site Inspections

(Reports and On-Site Inspections)

No English for the amended wording yet.

The Commission may require a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, a business handling information related to personal information (hereinafter referred to as a "business handling personal or other related information" in this Subsection), or other concerned person to submit necessary information or material relating to the handling of personal information, pseudonymized personal information, anonymized personal information, or informationother related to personal information (hereinafter referred to as "personal or other related information" in this Subsection and Subsection 3)necessary matters, or have its officials enter a business office or other necessary place of a business handling personal or other related information or other concerned person, inquire about the handling of personal or other related information or other necessary matters, or inspect a book, document, or other item, to the extent necessary to implement the provisions of Chapter IV (excluding Section 5; the same applies in the following Article and Article 151) and this Subsection.

Division 2 Orders for Measures, etc.

(Recommendations and Orders) for Measures

The Commission may recommendIf a business handling personal or other related information to stop committing the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need for protecting individual rights and interests in cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Article 21 (including the cases in which the provisions of paragraphs (1), (3) and (4) are applied pursuant to the Article 41, paragraph (4) following the deemed replacement of terms), Articles 23Chapter IV, Sections 2 through 26, Article 27 (excluding paragraph (4), and including the cases in which the provisions of paragraphs (5) and (6) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms),4 (excluding Article 2817, Article 29 (including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 4127, paragraph (6) following the deemed replacement of terms8), Article 30 (excluding, paragraph (2), and (including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 32, Article 33 (excluding paragraph (1) (including asit is applied mutatis mutandis pursuant to paragraph (5))), Article 3431, paragraph (2) or paragraph (3), Article 35 (excluding paragraphs (13)), (3) and (5)), Article 38, paragraph (237), Article 41 (excluding paragraphs (4) and (5)) or Article 43 (excluding paragraph (6)); in cases in whichthe Commission finds that there is a business handling information related to personal information has violated the provisions of Article 31, paragraph (1), has violated need for protecting individual rights and interests, the provisions of Article 28, paragraph (3) as applied mutatis mutandis pursuantCommission may recommend the business handling personal or other related information to Article 31, paragraph (2) followingtake measures necessary to stop the deemed replacement of terms,violation or has violatedotherwise rectify the provisions of Article 30, paragraph (3) violation, or paragraph (4) as applied mutatis mutandis pursuant to Article 31, paragraph (3) followingmeasures necessary to protect individual rights and interests, such as notifying the deemed replacementidentifiable person of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of Article 42, paragraph (1), has violated Article 27, paragraph (5)fact pertaining to the violation or paragraph (6) as applied mutatis mutandis pursuant to Article 42, paragraph (2) following the deemed replacement of terms, or has violatedmaking it public (hereinafter referred to as "rectification measures, etc." in the provisions of Articles 23 through 25 or Article 41, paragraph (7) orfollowing paragraph (8) as applied mutatis mutandis pursuant to Article 42,and paragraph (3) following the deemed replacement of terms; or in cases in which a business handling anonymized personal information has violated the provisions of Article 44 or Article 45).

If a business handling personal or other related information has received a recommendation under the preceding paragraph but has not taken the rectification measures , etc. in line with the recommendation without legitimate grounds, and the Commission finds that a serious infringement ofthere is a risk that serious individual rights and interests is impendingwill be harmed, the Commission may order the business handling personal or other related information to take the rectification measures, etc. in line with the recommendation.

Notwithstanding the provisions of the preceding two paragraphs, the Commission may orderif a business handling personal or other related information to stophas violated the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need to take urgent measures because there is a fact that seriously prejudices individual rights and interests inprovisions of Chapter IV, Sections 2 through 4 (excluding Article 17, Article 21, Article 21-2, Article 27, paragraph (3), paragraph (6) (including the cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Articles 23 through 26,it is applied mutatis mutandis pursuant to Article 30-2, paragraph (12), Article 31-3, paragraph (8) or Article 2742, paragraph (1), Article 282)), paragraph (1) or7) and paragraph (38), Article 41, paragraphs (1) through (3), or paragraphs (6) through (8), or Article 43, paragraph (1), 28, paragraph (2), Article 29 (including the cases in which the provisions of the main clause of paragraph (2) or1) and paragraph (5); in cases in which a business handling information related2) are applied mutatis mutandis pursuant to personal information has violated the provisions ofArticle 30-2, paragraph (14) or Article 3131-3, paragraph (1), or has violated10)), Article 30 (including the cases in which the provisions of Article 28, paragraph (3) asparagraphs (2) through (4) are applied mutatis mutandis pursuant to Article 31, paragraph (2) following the deemed replacement of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of3)), Article 30-2, paragraph (2), paragraph (3) and paragraphs (6) through (8), Article 31-3, paragraphs (2) through (4), Articles 32 through 35, Article 37, Article 38, Article 4243, paragraph (1), or has violated 3) and paragraph (4), and Article 44), and the provisions of Articles 23 through 25 or Article 41, paragraph (7) or paragraph (8) as applied mutatis mutandis pursuant to Article 42, paragraph (3) following the deemed replacementCommission finds that there is a need to take urgent measures because there is a fact that seriously prejudices individual rights and interests or because a serious infringement of terms; or in cases in which a individual rights and interests is impending, the Commission may order the business handling anonymized personal information has violated the provisions of Article 45or other related information to take rectification measures, etc.

If the Commission has issued an order under the preceding two paragraphs (hereinafter referred to as an "order for measures") and the business handling personal or other related information that has received the order for measures has violated the order for measures, the Commission may make public announcement to that effect.

If a business handling personal or other related information that has received an order for measures does not comply with that order for measures, and there is a handling-related service supplier (meaning a person that has been entrusted by a business handling personal or other related information with all or part of the handling of personal or other related information, or any other person that, under a contract with a business handling personal or other related information, supplies a service that the business handling personal or other related information uses for the handling of its personal or other related information; the same applies hereinafter in this paragraph and the following paragraph) that supplies a service the business handling personal or other related information uses for the handling of personal or other related information pertaining to the violation pertaining to the order for measures, the Commission may request that handling-related service supplier to take measures necessary to stop the violation, such as suspending the handling of the personal or other related information pertaining to the violation or suspending the supply of that service.

A handling-related service supplier that, upon receiving a request under the preceding paragraph, has taken the measures pertaining to that request is not liable to compensate for damage incurred by the business handling personal or other related information that has received the order for measures.

If the Commission has issued an order for measures and the violation is the transmission of information including personal or other related information by means of specified telecommunications (meaning specified telecommunications prescribed in Article 2, item (i) of the Act on Measures against Infringement of Rights, etc. Arising from the Distribution of Information through Specified Telecommunications (Act No. 137 of 2001); the same applies hereinafter in this paragraph), the Commission may request a specified telecommunications service provider (meaning a specified telecommunications service provider prescribed in Article 2, item (iv) of that Act; the same applies in the following paragraph) that provides the specified telecommunications service prescribed in item (iii) of that Article pertaining to the distribution of information through those specified telecommunications to take measures to prevent the distribution of that information through specified telecommunications.

A specified telecommunications service provider that, upon receiving a request under the preceding paragraph, has taken the measures pertaining to that request is not liable to compensate for damage incurred by the business handling personal or other related information that has received the order for measures.

Division 3 Payment Orders for Administrative Monetary Penalty, etc.

If a business handling personal information has committed any of the following acts (hereinafter referred to as a "violation" in this paragraph) (excluding the case where the business handling personal information is found not to be a person that failed to exercise reasonable care to prevent the violation throughout the period in which the violation was committed), and has obtained a monetary or other proprietary benefit (hereinafter referred to as "monies, etc." in this Article) as consideration for the violation or for ceasing the violation, regardless of the name given, such as price, remuneration, usage fee, or fee, the Commission must order the business handling personal information to pay to the national treasury an administrative monetary penalty in an amount equivalent to the amount calculated by the method specified by Cabinet Order as an amount equivalent to those monies, etc. (referred to as the "amount of consideration under paragraph (1)" in the following Article); provided, however, that the Commission may not order payment if the number of identifiable persons of the personal information or personal data (meaning personal data prescribed in Article 16, paragraph (3); the same applies in item (iii)) pertaining to the violation does not exceed 1,000, or in other cases specified by Cabinet Order as cases where the degree of harm to individual rights and interests is not great.

provision of personal information to a third party that is in a situation where it is anticipated that the third party will use that personal information to commit an unlawful act or unjustly discriminatory treatment;

use of personal information at the request of a third party, carried out where the third party is in a situation where it is anticipated that the third party will commit an unlawful act or unjustly discriminatory treatment through the use of that personal information;

provision of personal data in violation of the provisions of Article 27, paragraph (1) (including the cases in which it is applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1));

handling of personal information in violation of the provisions of Article 30-2, paragraph (4) or paragraph (9), or Article 31-3, paragraph (5);

provision of personal information in violation of the provisions of Article 30-2, paragraph (10) or paragraph (11), or Article 31-3, paragraph (6) or paragraph (7).

If a business handling personal information has acquired personal information in violation of Article 20, paragraph (1) and used that personal information (excluding the case where the business handling personal information is found not to be a person that failed to exercise reasonable care to prevent the acquisition and use throughout the period in which the acquisition and use were carried out), and has obtained monies, etc. as consideration for that use or for ceasing that use, the Commission must order the business handling personal information to pay to the national treasury an administrative monetary penalty in an amount equivalent to the amount calculated by the method specified by Cabinet Order as an amount equivalent to those monies, etc. (referred to as the "amount of consideration under paragraph (2)" in the following Article); provided, however, that the Commission may not order payment if the number of identifiable persons of the personal information pertaining to that use does not exceed 1,000, or in other cases specified by Cabinet Order as cases where the degree of harm to individual rights and interests is not great.

If the Commission is to issue an order under the paragraphs of the preceding Article (hereinafter referred to as a "payment order for administrative monetary penalty") and the business handling personal information has not complied with a requirement to submit a report or material under Article 146, paragraph (1) concerning the facts that are to form the basis for calculating the administrative monetary penalty pertaining to that payment order for administrative monetary penalty, the Commission may issue a payment order for administrative monetary penalty by estimating, by a reasonable method specified by Order of the Personal Information Protection Commission, the amount of consideration under paragraph (1) or the amount of consideration under paragraph (2) for the period in which the report or material on those facts has not been submitted and the Commission is unable to ascertain the facts that are to form the basis for calculating the administrative monetary penalty, using material obtained from the business handling personal information or another business that transacts with it, or from another business that conducts the same kind of business as the business pertaining to the act subject to administrative monetary penalty (meaning the violation prescribed in paragraph (1) of the preceding Article or the acquisition and use prescribed in paragraph (2) of that Article; the same applies hereinafter) pertaining to that payment order for administrative monetary penalty or another business that transacts with it, or other material.

If the Commission is to issue a payment order for administrative monetary penalty pursuant to the paragraphs of Article 148-3, and the business handling personal information is a person that has, within 10 years going back from the date on which collection of reports, etc. (meaning the requirement to submit a report or material or the on-site inspection under Article 146, paragraph (1); the same applies hereinafter in this Article, Article 148-7, paragraph (4) and Article 149, paragraph (1)) was first conducted regarding the case pertaining to the act subject to administrative monetary penalty pertaining to that payment order for administrative monetary penalty (or, if that collection of reports, etc. was not conducted, the date on which the business handling personal information received the notice under Article 148-10, paragraph (1) regarding that case), received a payment order for administrative monetary penalty under those paragraphs (limited to where that payment order for administrative monetary penalty has become final), and has committed that act subject to administrative monetary penalty on or after the date of that payment order for administrative monetary penalty, the Commission must order the person, in lieu of the amount under those paragraphs, to pay to the national treasury an administrative monetary penalty in an amount equivalent to 1.5 times that amount.

If the Commission is to issue a payment order for administrative monetary penalty pursuant to the paragraphs of Article 148-3, and the business handling personal information has reported to the Commission, as provided for by Order of the Personal Information Protection Commission, the facts constituting the act subject to administrative monetary penalty pertaining to that payment order for administrative monetary penalty, the Commission is to reduce from the amount of the administrative monetary penalty the amount obtained by multiplying the amount of the administrative monetary penalty calculated under those paragraphs (for a person prescribed in the preceding Article, the amount of the administrative monetary penalty calculated under that Article) by 50 percent; provided, however, that this does not apply if the report was made in anticipation that a payment order for administrative monetary penalty would be issued for the act subject to administrative monetary penalty as a result of an investigation of that act subject to administrative monetary penalty.

A person that has received a payment order for administrative monetary penalty must pay the administrative monetary penalty calculated under the provisions of Article 148-3 through the preceding Article.

If the amount of the administrative monetary penalty calculated under the provisions of Article 148-3 through the preceding Article includes a fraction of less than 10,000 yen, that fraction is to be discarded.

If the business handling personal information that has committed an act subject to administrative monetary penalty is a corporation and that corporation has ceased to exist as a result of a merger, the provisions of Article 148-3 through this Article apply by deeming the act subject to administrative monetary penalty committed by that corporation to be an act subject to administrative monetary penalty committed by the corporation surviving the merger or the corporation established through the merger.

If a business handling personal information that has committed an act subject to administrative monetary penalty is a corporation, and that corporation has, on or after the date on which collection of reports, etc. was first conducted regarding the case pertaining to that act subject to administrative monetary penalty (or, if that collection of reports, etc. was not conducted, the date on which that corporation received the notice under Article 148-10, paragraph (1) regarding that act subject to administrative monetary penalty; hereinafter referred to as the "starting date" in this paragraph), transferred all of the business pertaining to that act subject to administrative monetary penalty to one or more of its subsidiaries, etc. (meaning a subsidiary or parent company (meaning another company that has a company as its subsidiary; the same applies hereinafter in this paragraph) of a business handling personal information, or another company whose parent company is the same as that of the business handling personal information; the same applies hereinafter in this paragraph), or that corporation (limited to a company) has, on or after the starting date for the case pertaining to that act subject to administrative monetary penalty, caused one or more of its subsidiaries, etc. to succeed to all of the business pertaining to that act subject to administrative monetary penalty through a company split, and that corporation has ceased to exist due to a reason other than a merger, the act subject to administrative monetary penalty committed by that corporation is deemed to be an act subject to administrative monetary penalty committed by the subsidiary, etc. that has acquired all or part of that business by transfer or has succeeded to all or part of that business through a company split (hereinafter referred to as a "subsidiary, etc. that has succeeded to the specified business" in this paragraph), and the provisions of Article 148-3 through this Article apply. In this case, if there are two or more subsidiaries, etc. that have succeeded to the specified business, the phrase "order the business handling personal information" in Article 148-3, paragraph (1) is deemed to be replaced with "order the subsidiary, etc. that has succeeded to the specified business (meaning a subsidiary, etc. that has succeeded to the specified business prescribed in Article 148-7, paragraph (4); the same applies hereinafter in this Article and Article 148-7, paragraph (1)), jointly and severally with any other subsidiary, etc. that has succeeded to the specified business that has received an order under this paragraph,"; the phrase "order the business handling personal information" in paragraph (2) of Article 148-3 is deemed to be replaced with "order the subsidiary, etc. that has succeeded to the specified business, jointly and severally with any other subsidiary, etc. that has succeeded to the specified business that has received an order under this paragraph,"; and the phrase "A person that has received a payment order for administrative monetary penalty must pay" in paragraph (1) of this Article is deemed to be replaced with "A subsidiary, etc. that has succeeded to the specified business that has received a payment order for administrative monetary penalty must, jointly and severally with any other subsidiary, etc. that has succeeded to the specified business that has received a payment order for administrative monetary penalty, pay".

The term "subsidiary" prescribed in the preceding paragraph means another company in which a company holds a majority of the voting rights (excluding voting rights for shares that do not entitle the holder to exercise voting rights on any of the matters that may be resolved at a shareholders meeting, and including voting rights for shares for which the holder is deemed to have voting rights under Article 879, paragraph (3) of the Companies Act (Act No. 86 of 2005); the same applies hereinafter in this paragraph) of all shareholders (including all members; the same applies hereinafter in this paragraph). In this case, another company in which a company and one or more of its subsidiaries, or one or more subsidiaries of a company, hold a majority of the voting rights of all shareholders is deemed to be a subsidiary of that company.

In the cases referred to in paragraphs (3) and (4), necessary matters concerning the application of the provisions of Article 148-4 through the preceding Article are specified by Cabinet Order.

If seven years have passed since the day on which an act subject to administrative monetary penalty ceased, the Commission may not order the payment of an administrative monetary penalty pertaining to that act subject to administrative monetary penalty.

When the Commission intends to issue a payment order for administrative monetary penalty, the Commission must grant the person that is to be the addressee of that payment order for administrative monetary penalty an opportunity for explanation.

An explanation is to be made by submitting a document stating the explanation (referred to as a "written explanation" in paragraph (1) of the following Article), except where the Commission has permitted the explanation to be made orally.

When making an explanation, documentary evidence or articles of evidence may be submitted.

The Commission must notify the person that is to be the addressee of a payment order for administrative monetary penalty of the following matters in writing, allowing a reasonable period before the deadline for submitting the written explanation (or, if an opportunity for oral explanation is to be granted, before the date and time of that explanation):

the amount of the administrative monetary penalty that the Commission intends to order to be paid;

the basis for calculating the administrative monetary penalty and the act subject to administrative monetary penalty pertaining to that administrative monetary penalty;

the place to which and the deadline by which the written explanation is to be submitted (or, if an opportunity for oral explanation is to be granted, a statement to that effect and the date, time and place at which the person is to appear).

If the whereabouts of the person that is to be the addressee of a payment order for administrative monetary penalty are unknown, the Commission may give the notice under the preceding paragraph by taking measures to make the name of that person (or, for a corporation, its name and the name of its representative), the matters set forth in item (iii) of that paragraph, and a statement to the effect that the Commission will deliver to that person at any time a document stating the matters set forth in the items of that paragraph (hereinafter referred to as the "particulars of the public notice" in this paragraph) available for inspection by many and unspecified persons by a method specified by Order of the Personal Information Protection Commission, and also to post a document stating the particulars of the public notice on the notice board of the Commission or make the particulars of the public notice, as displayed on the screen of a computer installed in the office of the Commission, available for inspection. In this case, the notice is deemed to have reached that person when two weeks have passed from the day on which those measures were taken.

A person that has received the notice under paragraph (1) of the preceding Article (referred to as a "party" in the following paragraph and paragraph (4)) may appoint an agent.

Each agent may perform any and all acts relating to the explanation on behalf of the party.

The qualifications of an agent must be proved in writing.

When an agent loses their qualifications, the party that appointed that agent must notify the Commission to that effect in writing.

A payment order for administrative monetary penalty is to be issued in writing, and the written payment order for administrative monetary penalty must state the amount of the administrative monetary penalty to be paid, the basis for calculating the administrative monetary penalty and the act subject to administrative monetary penalty pertaining to that administrative monetary penalty, and the payment deadline.

A payment order for administrative monetary penalty takes effect when a certified copy of the written payment order for administrative monetary penalty is served on its addressee.

The payment deadline for the administrative monetary penalty referred to in paragraph (1) is the day on which seven months have passed from the date on which the certified copy of the written payment order for administrative monetary penalty is sent.

If a person fails to pay an administrative monetary penalty by its payment deadline, the Commission must demand payment by a letter of demand, specifying a time limit.

If the Commission has made a demand under the preceding paragraph, the Commission may collect a delinquent charge calculated at a rate of 14.5 percent per annum on the amount of the administrative monetary penalty pertaining to that demand, according to the number of days from the day following the payment deadline to the date of payment; provided, however, that this does not apply if the amount of the delinquent charge is less than 1,000 yen.

If the amount of the delinquent charge calculated under the preceding paragraph includes a fraction of less than 100 yen, that fraction is rounded down.

If a person that has received a demand under paragraph (1) of the preceding Article fails to pay the amount to be paid by the time limit specified in that demand, the payment order for administrative monetary penalty is executed by order of the Commission. This order has the same effect as an enforceable title of obligation.

A payment order for administrative monetary penalty is executed in accordance with the provisions of the Civil Enforcement Act (Act No. 4 of 1979) and other laws and regulations concerning compulsory execution procedures.

If the Commission finds it necessary in connection with the execution of a payment order for administrative monetary penalty, the Commission may make inquiries to public offices or public or private organizations and request them to report necessary matters.

In the application of the provisions of the Bankruptcy Act (Act No. 75 of 2004), the Civil Rehabilitation Act (Act No. 225 of 1999), the Corporate Reorganization Act (Act No. 154 of 2002) and the Act on Special Measures for the Reorganization Proceedings of Financial Institutions (Act No. 95 of 1996), the right to claim an administrative monetary penalty pertaining to a payment order for administrative monetary penalty and the right to claim a delinquent charge under Article 148-13, paragraph (2) are deemed to be rights to claim a civil fine.

The provisions of Chapter III of the Administrative Procedure Act (Act No. 88 of 1993) do not apply to a payment order for administrative monetary penalty or any other disposition under the provisions of this Division issued by the Commission.

Beyond what is provided for in this Division, necessary matters concerning payment orders for administrative monetary penalty are specified by Order of the Personal Information Protection Commission.

Division 4 Miscellaneous Provisions

When requiring a business handling personal or other related information to submit a report or material, conducting its on-site inspectionconducting collection of reports, etc., or giving a guidance, advice, recommendation , order for measures, request or payment order to itfor administrative monetary penalty, pursuant to the provisions of the preceding three ArticlesArticles 146 through 148-3, the Commission must not preclude the freedom of expression, freedom of academia, freedom of religion, and freedom of political activity.

If the Commission finds that there is a need for effectively giving a business handling personal or other related information a recommendation under Article 148, paragraph (1) or, an order for measures, a request under Article 148148-2, paragraph (21) or paragraph (3), or a payment order for administrative monetary penalty because there is a need to urgently and intensively ensure the proper handling of personal or other related information or similar other circumstances prescribed by Cabinet Order, the Commission may delegate an authority under Article 26, paragraph (1); under Article 146, paragraph (1); under Article 100, paragraph (1), Article 101, Article 102-2, Article 103, Article 105, Article 106 or Article 108 of the Code of Civil Procedure (Act No. 109 of 1996) as applied mutatis mutandis pursuant to the provisions of Article 162 following the deemed replacement of terms; under Article 163; and under Article 164 to the competent minister for the business, as prescribed by Cabinet Order.

For a requirement to submit a report or material under Article 146, paragraph (1), a recommendation under Article 148, paragraph (1), an order under paragraph (2) or paragraph (3) of that Articlefor measures, a call for a report under Article 153, an order under Article 154, or a rescission under Article 155, paragraph (1), a document specified by Order of the Personal Information Protection Commission must be served.

For an order under Article 148, paragraph (2)for measures or paragraph (3), oran order under Article 154, or a notice under Article 15, paragraph (1) or Article 30 of the Administrative Procedure Act (Act No. 88 of 1993) relating to a rescission under Article 155, paragraph (1), a document referred to in Article 15, paragraphs (1) and (2) or Article 30 of that Act must be served. In this case, the provisions of Article 15, paragraph (3) of that Act (including as applied mutatis mutandis pursuant to Article 31 of that Act following the deemed replacement of terms) do not apply.

The provisions of Article 100, paragraph (1), Article 101, Article 102-2, Article 103, Article 105, Article 106, and Article 108 of the Code of Civil Procedure apply mutatis mutandis to the service under the preceding provisions of this Act (including Cabinet Orders or Orders of the Personal Information Protection Commission based on this Act; the same applies in Article 164). In this case, the term "court" in Article 100, paragraph (1) of the Code and the term "presiding judge" in Article 108 of the Code are deemed to be replaced by "Personal Information Protection Commission", and the term "court execution officer" in Article 101, paragraph (1) of the Code is deemed to be replaced by "official of the Personal Information Protection Commission".

in cases of service that would be effected in a foreign country (meaning a country or region located outside the territory of Japan; the same applies hereinafter), the Commission finds that it is impossible to follow the provisions of Article 108 of the Code of Civil Procedure as applied mutatis mutandis pursuant to the preceding Article following the deemed replacement of terms, or it is impossible to effect service even if the Commission follows those provisions;

When an official of the Commission has, pursuant to Article 7, paragraph (1) of the Act on the Advancement of Government Administration Processes That Utilize Information and Communications Technology (Act No. 151 of 2002), used the electronic data processing system prescribed in Article 6, paragraph (1) of that Act for administrating affairs related to a disposition notice, etc. prescribed in Article 3, item (ix) of that Act for which a document under Article 161the provisions of this Act is to be served, the official must use that electronic data processing system to record the particulars of the service under Article 100, paragraph (1) of the Code of Civil Procedure as applied mutatis mutandis pursuant to Article 162 following the deemed replacement of terms, in a file that is stored on a computer (including input or output device) used by the Commission, instead of preparing and submitting a document that states those particulars.

This Act also applies in those cases in which, in relation to supplying a good or service to a person in Japan, a business handling personal or other related information, a business handling pseudonymized handles the personal information by which that person in Japan is identifiable, sensitive personal information, a business handling anonymized etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or a business handling information related similar analysis or provided personal data, etc. for statistical compilation or similar analysis pertaining to that personal information handles the, pseudonymized personal information by which or anonymized personal information that person in Japan is identifiablehas been prepared by using that personal information, information related to personal information that is to be acquired as that personal information, or pseudonymized personalcontact-enabling information or anonymizedrelated to personal information that has been prepared by using that personal can be used for contacting or otherwise transmitting information to a specific individual in Japan, in a foreign country.