Act on the Protection of Personal Information

(Recommendations and Orders) for Measures

The Commission may recommendIf a business handling personal or other related information to stop committing the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need for protecting individual rights and interests in cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Article 21 (including the cases in which the provisions of paragraphs (1), (3) and (4) are applied pursuant to the Article 41, paragraph (4) following the deemed replacement of terms), Articles 23 through 26, Article 27 (excluding paragraph (4), and including the cases in which the provisions of paragraphs (5) and (6) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 28, Article 29 (including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms)has violated the provisions of Chapter IV, Sections 2 through 4 (excluding Article 17, Article 27, paragraph (8), Article 30 (excluding, paragraph (2), and (including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 32, Article 33 (excluding paragraph (1) (including asit is applied mutatis mutandis pursuant to paragraph (5))), Article 3431, paragraph (2) or paragraph (3), Article 35 (excluding paragraphs (1), (3) and (5)), Article 38, paragraph (2), Article 41 (excluding paragraphs (4) and (5)) or Article 43 (excluding paragraph (6)); in cases in which a business handling information related to personal information has violated the provisions of Article 31, paragraph (1), has violated the provisions of Article 28, paragraph (3) as applied mutatis mutandis pursuant to Article 31, paragraph (2) following the deemed replacement of terms, or has violated the provisions of Article 30, paragraph (3) or paragraph (4) as applied mutatis mutandis pursuant to Article 31, paragraph (3) following the deemed replacement of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of Article 42, paragraph (1), has violated Article 27, paragraph (5) or paragraph (6) as applied mutatis mutandis pursuant to Article 42, paragraph (2) following the deemed replacement of terms, or has violated the provisions of Articles 23 through 25 or Article 41, paragraph (7) or paragraph (8) as applied mutatis mutandis pursuant to Article 42, paragraph (3) following the deemed replacement of terms; or in cases in which a business handling anonymized personal information has violated the provisions of Article 44 or Article 45(3)), and Article 37), and the Commission finds that there is a need for protecting individual rights and interests, the Commission may recommend the business handling personal or other related information to take measures necessary to stop the violation or otherwise rectify the violation, or measures necessary to protect individual rights and interests, such as notifying the identifiable person of the fact pertaining to the violation or making it public (hereinafter referred to as "rectification measures, etc." in the following paragraph and paragraph (3)).

If a business handling personal or other related information has received a recommendation under the preceding paragraph but has not taken the rectification measures , etc. in line with the recommendation without legitimate grounds, and the Commission finds that a serious infringement ofthere is a risk that serious individual rights and interests is impendingwill be harmed, the Commission may order the business handling personal or other related information to take the rectification measures, etc. in line with the recommendation.

Notwithstanding the provisions of the preceding two paragraphs, the Commission may orderif a business handling personal or other related information to stop the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need to take urgent measures because there is a fact that seriously prejudices individual rights and interests in cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Articles 23 through 26,has violated the provisions of Chapter IV, Sections 2 through 4 (excluding Article 17, Article 21, Article 21-2, Article 27, paragraph (3), paragraph (6) (including the cases in which it is applied mutatis mutandis pursuant to Article 30-2, paragraph (12), Article 31-3, paragraph (8) or Article 2742, paragraph (1), Article 28(2)), paragraph (1) or(7) and paragraph (3)(8), Article 41, paragraphs (1) through (3), or paragraphs (6) through (8), or Article 43, paragraph (1), paragraph (2) or paragraph (5); in cases in which a business handling information related to personal information has violated the provisions of28, paragraph (2), Article 29 (including the cases in which the provisions of the main clause of paragraph (1) and paragraph (2) are applied mutatis mutandis pursuant to Article 30-2, paragraph (14) or Article 3131-3, paragraph (1), or has violated the provisions of Article 28, paragraph (3) as applied mutatis mutandis pursuant to Article 31, paragraph (2) following the deemed replacement of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of(10)), Article 30 (including the cases in which the provisions of paragraphs (2) through (4) are applied mutatis mutandis pursuant to Article 31, paragraph (3)), Article 30-2, paragraph (2), paragraph (3) and paragraphs (6) through (8), Article 31-3, paragraphs (2) through (4), Articles 32 through 35, Article 37, Article 38, Article 4243, paragraph (1), or has violated the provisions of Articles 23 through 25 or Article 41, paragraph (7) or paragraph (8) as applied mutatis mutandis pursuant to Article 42, paragraph (3) following the deemed replacement of terms; or in cases in which a business handling anonymized personal information has violated the provisions of Article 45(3) and paragraph (4), and Article 44), and the Commission finds that there is a need to take urgent measures because there is a fact that seriously prejudices individual rights and interests or because a serious infringement of individual rights and interests is impending, the Commission may order the business handling personal or other related information to take rectification measures, etc.

If the Commission has issued an order under the preceding two paragraphs (hereinafter referred to as an "order for measures") and the business handling personal or other related information that has received the order for measures has violated the order for measures, the Commission may make public announcement to that effect.

If a business handling personal or other related information that has received an order for measures does not comply with that order for measures, and there is a handling-related service supplier (meaning a person that has been entrusted by a business handling personal or other related information with all or part of the handling of personal or other related information, or any other person that, under a contract with a business handling personal or other related information, supplies a service that the business handling personal or other related information uses for the handling of its personal or other related information; the same applies hereinafter in this paragraph and the following paragraph) that supplies a service the business handling personal or other related information uses for the handling of personal or other related information pertaining to the violation pertaining to the order for measures, the Commission may request that handling-related service supplier to take measures necessary to stop the violation, such as suspending the handling of the personal or other related information pertaining to the violation or suspending the supply of that service.

A handling-related service supplier that, upon receiving a request under the preceding paragraph, has taken the measures pertaining to that request is not liable to compensate for damage incurred by the business handling personal or other related information that has received the order for measures.

If the Commission has issued an order for measures and the violation is the transmission of information including personal or other related information by means of specified telecommunications (meaning specified telecommunications prescribed in Article 2, item (i) of the Act on Measures against Infringement of Rights, etc. Arising from the Distribution of Information through Specified Telecommunications (Act No. 137 of 2001); the same applies hereinafter in this paragraph), the Commission may request a specified telecommunications service provider (meaning a specified telecommunications service provider prescribed in Article 2, item (iv) of that Act; the same applies in the following paragraph) that provides the specified telecommunications service prescribed in item (iii) of that Article pertaining to the distribution of information through those specified telecommunications to take measures to prevent the distribution of that information through specified telecommunications.

A specified telecommunications service provider that, upon receiving a request under the preceding paragraph, has taken the measures pertaining to that request is not liable to compensate for damage incurred by the business handling personal or other related information that has received the order for measures.

Division 3 Payment Orders for Administrative Monetary Penalty, etc.

If a business handling personal information has committed any of the following acts (hereinafter referred to as a "violation" in this paragraph) (excluding the case where the business handling personal information is found not to be a person that failed to exercise reasonable care to prevent the violation throughout the period in which the violation was committed), and has obtained a monetary or other proprietary benefit (hereinafter referred to as "monies, etc." in this Article) as consideration for the violation or for ceasing the violation, regardless of the name given, such as price, remuneration, usage fee, or fee, the Commission must order the business handling personal information to pay to the national treasury an administrative monetary penalty in an amount equivalent to the amount calculated by the method specified by Cabinet Order as an amount equivalent to those monies, etc. (referred to as the "amount of consideration under paragraph (1)" in the following Article); provided, however, that the Commission may not order payment if the number of identifiable persons of the personal information or personal data (meaning personal data prescribed in Article 16, paragraph (3); the same applies in item (iii)) pertaining to the violation does not exceed 1,000, or in other cases specified by Cabinet Order as cases where the degree of harm to individual rights and interests is not great.

provision of personal information to a third party that is in a situation where it is anticipated that the third party will use that personal information to commit an unlawful act or unjustly discriminatory treatment;

use of personal information at the request of a third party, carried out where the third party is in a situation where it is anticipated that the third party will commit an unlawful act or unjustly discriminatory treatment through the use of that personal information;

provision of personal data in violation of the provisions of Article 27, paragraph (1) (including the cases in which it is applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1));

handling of personal information in violation of the provisions of Article 30-2, paragraph (4) or paragraph (9), or Article 31-3, paragraph (5);

provision of personal information in violation of the provisions of Article 30-2, paragraph (10) or paragraph (11), or Article 31-3, paragraph (6) or paragraph (7).

If a business handling personal information has acquired personal information in violation of Article 20, paragraph (1) and used that personal information (excluding the case where the business handling personal information is found not to be a person that failed to exercise reasonable care to prevent the acquisition and use throughout the period in which the acquisition and use were carried out), and has obtained monies, etc. as consideration for that use or for ceasing that use, the Commission must order the business handling personal information to pay to the national treasury an administrative monetary penalty in an amount equivalent to the amount calculated by the method specified by Cabinet Order as an amount equivalent to those monies, etc. (referred to as the "amount of consideration under paragraph (2)" in the following Article); provided, however, that the Commission may not order payment if the number of identifiable persons of the personal information pertaining to that use does not exceed 1,000, or in other cases specified by Cabinet Order as cases where the degree of harm to individual rights and interests is not great.

If the Commission is to issue an order under the paragraphs of the preceding Article (hereinafter referred to as a "payment order for administrative monetary penalty") and the business handling personal information has not complied with a requirement to submit a report or material under Article 146, paragraph (1) concerning the facts that are to form the basis for calculating the administrative monetary penalty pertaining to that payment order for administrative monetary penalty, the Commission may issue a payment order for administrative monetary penalty by estimating, by a reasonable method specified by Order of the Personal Information Protection Commission, the amount of consideration under paragraph (1) or the amount of consideration under paragraph (2) for the period in which the report or material on those facts has not been submitted and the Commission is unable to ascertain the facts that are to form the basis for calculating the administrative monetary penalty, using material obtained from the business handling personal information or another business that transacts with it, or from another business that conducts the same kind of business as the business pertaining to the act subject to administrative monetary penalty (meaning the violation prescribed in paragraph (1) of the preceding Article or the acquisition and use prescribed in paragraph (2) of that Article; the same applies hereinafter) pertaining to that payment order for administrative monetary penalty or another business that transacts with it, or other material.

If the Commission is to issue a payment order for administrative monetary penalty pursuant to the paragraphs of Article 148-3, and the business handling personal information is a person that has, within 10 years going back from the date on which collection of reports, etc. (meaning the requirement to submit a report or material or the on-site inspection under Article 146, paragraph (1); the same applies hereinafter in this Article, Article 148-7, paragraph (4) and Article 149, paragraph (1)) was first conducted regarding the case pertaining to the act subject to administrative monetary penalty pertaining to that payment order for administrative monetary penalty (or, if that collection of reports, etc. was not conducted, the date on which the business handling personal information received the notice under Article 148-10, paragraph (1) regarding that case), received a payment order for administrative monetary penalty under those paragraphs (limited to where that payment order for administrative monetary penalty has become final), and has committed that act subject to administrative monetary penalty on or after the date of that payment order for administrative monetary penalty, the Commission must order the person, in lieu of the amount under those paragraphs, to pay to the national treasury an administrative monetary penalty in an amount equivalent to 1.5 times that amount.

If the Commission is to issue a payment order for administrative monetary penalty pursuant to the paragraphs of Article 148-3, and the business handling personal information has reported to the Commission, as provided for by Order of the Personal Information Protection Commission, the facts constituting the act subject to administrative monetary penalty pertaining to that payment order for administrative monetary penalty, the Commission is to reduce from the amount of the administrative monetary penalty the amount obtained by multiplying the amount of the administrative monetary penalty calculated under those paragraphs (for a person prescribed in the preceding Article, the amount of the administrative monetary penalty calculated under that Article) by 50 percent; provided, however, that this does not apply if the report was made in anticipation that a payment order for administrative monetary penalty would be issued for the act subject to administrative monetary penalty as a result of an investigation of that act subject to administrative monetary penalty.

A person that has received a payment order for administrative monetary penalty must pay the administrative monetary penalty calculated under the provisions of Article 148-3 through the preceding Article.

If the amount of the administrative monetary penalty calculated under the provisions of Article 148-3 through the preceding Article includes a fraction of less than 10,000 yen, that fraction is to be discarded.

If the business handling personal information that has committed an act subject to administrative monetary penalty is a corporation and that corporation has ceased to exist as a result of a merger, the provisions of Article 148-3 through this Article apply by deeming the act subject to administrative monetary penalty committed by that corporation to be an act subject to administrative monetary penalty committed by the corporation surviving the merger or the corporation established through the merger.

If a business handling personal information that has committed an act subject to administrative monetary penalty is a corporation, and that corporation has, on or after the date on which collection of reports, etc. was first conducted regarding the case pertaining to that act subject to administrative monetary penalty (or, if that collection of reports, etc. was not conducted, the date on which that corporation received the notice under Article 148-10, paragraph (1) regarding that act subject to administrative monetary penalty; hereinafter referred to as the "starting date" in this paragraph), transferred all of the business pertaining to that act subject to administrative monetary penalty to one or more of its subsidiaries, etc. (meaning a subsidiary or parent company (meaning another company that has a company as its subsidiary; the same applies hereinafter in this paragraph) of a business handling personal information, or another company whose parent company is the same as that of the business handling personal information; the same applies hereinafter in this paragraph), or that corporation (limited to a company) has, on or after the starting date for the case pertaining to that act subject to administrative monetary penalty, caused one or more of its subsidiaries, etc. to succeed to all of the business pertaining to that act subject to administrative monetary penalty through a company split, and that corporation has ceased to exist due to a reason other than a merger, the act subject to administrative monetary penalty committed by that corporation is deemed to be an act subject to administrative monetary penalty committed by the subsidiary, etc. that has acquired all or part of that business by transfer or has succeeded to all or part of that business through a company split (hereinafter referred to as a "subsidiary, etc. that has succeeded to the specified business" in this paragraph), and the provisions of Article 148-3 through this Article apply. In this case, if there are two or more subsidiaries, etc. that have succeeded to the specified business, the phrase "order the business handling personal information" in Article 148-3, paragraph (1) is deemed to be replaced with "order the subsidiary, etc. that has succeeded to the specified business (meaning a subsidiary, etc. that has succeeded to the specified business prescribed in Article 148-7, paragraph (4); the same applies hereinafter in this Article and Article 148-7, paragraph (1)), jointly and severally with any other subsidiary, etc. that has succeeded to the specified business that has received an order under this paragraph,"; the phrase "order the business handling personal information" in paragraph (2) of Article 148-3 is deemed to be replaced with "order the subsidiary, etc. that has succeeded to the specified business, jointly and severally with any other subsidiary, etc. that has succeeded to the specified business that has received an order under this paragraph,"; and the phrase "A person that has received a payment order for administrative monetary penalty must pay" in paragraph (1) of this Article is deemed to be replaced with "A subsidiary, etc. that has succeeded to the specified business that has received a payment order for administrative monetary penalty must, jointly and severally with any other subsidiary, etc. that has succeeded to the specified business that has received a payment order for administrative monetary penalty, pay".

The term "subsidiary" prescribed in the preceding paragraph means another company in which a company holds a majority of the voting rights (excluding voting rights for shares that do not entitle the holder to exercise voting rights on any of the matters that may be resolved at a shareholders meeting, and including voting rights for shares for which the holder is deemed to have voting rights under Article 879, paragraph (3) of the Companies Act (Act No. 86 of 2005); the same applies hereinafter in this paragraph) of all shareholders (including all members; the same applies hereinafter in this paragraph). In this case, another company in which a company and one or more of its subsidiaries, or one or more subsidiaries of a company, hold a majority of the voting rights of all shareholders is deemed to be a subsidiary of that company.

In the cases referred to in paragraphs (3) and (4), necessary matters concerning the application of the provisions of Article 148-4 through the preceding Article are specified by Cabinet Order.

If seven years have passed since the day on which an act subject to administrative monetary penalty ceased, the Commission may not order the payment of an administrative monetary penalty pertaining to that act subject to administrative monetary penalty.

When the Commission intends to issue a payment order for administrative monetary penalty, the Commission must grant the person that is to be the addressee of that payment order for administrative monetary penalty an opportunity for explanation.

An explanation is to be made by submitting a document stating the explanation (referred to as a "written explanation" in paragraph (1) of the following Article), except where the Commission has permitted the explanation to be made orally.

When making an explanation, documentary evidence or articles of evidence may be submitted.

The Commission must notify the person that is to be the addressee of a payment order for administrative monetary penalty of the following matters in writing, allowing a reasonable period before the deadline for submitting the written explanation (or, if an opportunity for oral explanation is to be granted, before the date and time of that explanation):

the amount of the administrative monetary penalty that the Commission intends to order to be paid;

the basis for calculating the administrative monetary penalty and the act subject to administrative monetary penalty pertaining to that administrative monetary penalty;

the place to which and the deadline by which the written explanation is to be submitted (or, if an opportunity for oral explanation is to be granted, a statement to that effect and the date, time and place at which the person is to appear).

If the whereabouts of the person that is to be the addressee of a payment order for administrative monetary penalty are unknown, the Commission may give the notice under the preceding paragraph by taking measures to make the name of that person (or, for a corporation, its name and the name of its representative), the matters set forth in item (iii) of that paragraph, and a statement to the effect that the Commission will deliver to that person at any time a document stating the matters set forth in the items of that paragraph (hereinafter referred to as the "particulars of the public notice" in this paragraph) available for inspection by many and unspecified persons by a method specified by Order of the Personal Information Protection Commission, and also to post a document stating the particulars of the public notice on the notice board of the Commission or make the particulars of the public notice, as displayed on the screen of a computer installed in the office of the Commission, available for inspection. In this case, the notice is deemed to have reached that person when two weeks have passed from the day on which those measures were taken.

A person that has received the notice under paragraph (1) of the preceding Article (referred to as a "party" in the following paragraph and paragraph (4)) may appoint an agent.

Each agent may perform any and all acts relating to the explanation on behalf of the party.

The qualifications of an agent must be proved in writing.

When an agent loses their qualifications, the party that appointed that agent must notify the Commission to that effect in writing.

A payment order for administrative monetary penalty is to be issued in writing, and the written payment order for administrative monetary penalty must state the amount of the administrative monetary penalty to be paid, the basis for calculating the administrative monetary penalty and the act subject to administrative monetary penalty pertaining to that administrative monetary penalty, and the payment deadline.

A payment order for administrative monetary penalty takes effect when a certified copy of the written payment order for administrative monetary penalty is served on its addressee.

The payment deadline for the administrative monetary penalty referred to in paragraph (1) is the day on which seven months have passed from the date on which the certified copy of the written payment order for administrative monetary penalty is sent.

If a person fails to pay an administrative monetary penalty by its payment deadline, the Commission must demand payment by a letter of demand, specifying a time limit.

If the Commission has made a demand under the preceding paragraph, the Commission may collect a delinquent charge calculated at a rate of 14.5 percent per annum on the amount of the administrative monetary penalty pertaining to that demand, according to the number of days from the day following the payment deadline to the date of payment; provided, however, that this does not apply if the amount of the delinquent charge is less than 1,000 yen.

If the amount of the delinquent charge calculated under the preceding paragraph includes a fraction of less than 100 yen, that fraction is rounded down.

If a person that has received a demand under paragraph (1) of the preceding Article fails to pay the amount to be paid by the time limit specified in that demand, the payment order for administrative monetary penalty is executed by order of the Commission. This order has the same effect as an enforceable title of obligation.

A payment order for administrative monetary penalty is executed in accordance with the provisions of the Civil Enforcement Act (Act No. 4 of 1979) and other laws and regulations concerning compulsory execution procedures.

If the Commission finds it necessary in connection with the execution of a payment order for administrative monetary penalty, the Commission may make inquiries to public offices or public or private organizations and request them to report necessary matters.

In the application of the provisions of the Bankruptcy Act (Act No. 75 of 2004), the Civil Rehabilitation Act (Act No. 225 of 1999), the Corporate Reorganization Act (Act No. 154 of 2002) and the Act on Special Measures for the Reorganization Proceedings of Financial Institutions (Act No. 95 of 1996), the right to claim an administrative monetary penalty pertaining to a payment order for administrative monetary penalty and the right to claim a delinquent charge under Article 148-13, paragraph (2) are deemed to be rights to claim a civil fine.

The provisions of Chapter III of the Administrative Procedure Act (Act No. 88 of 1993) do not apply to a payment order for administrative monetary penalty or any other disposition under the provisions of this Division issued by the Commission.

Beyond what is provided for in this Division, necessary matters concerning payment orders for administrative monetary penalty are specified by Order of the Personal Information Protection Commission.

Division 4 Miscellaneous Provisions

When requiring a business handling personal or other related information to submit a report or material, conducting its on-site inspection, or giving a guidance, advice, recommendation or order to itconducting collection of reports, etc., or giving a guidance, advice, recommendation, order for measures, request or payment order for administrative monetary penalty, pursuant to the provisions of the preceding three ArticlesArticles 146 through 148-3, the Commission must not preclude the freedom of expression, freedom of academia, freedom of religion, and freedom of political activity.

If the Commission finds that there is a need for effectively giving a business handling personal or other related information a recommendation under Article 148, paragraph (1) or, an order for measures, a request under Article 148148-2, paragraph (2)(1) or paragraph (3), or a payment order for administrative monetary penalty because there is a need to urgently and intensively ensure the proper handling of personal or other related information or similar other circumstances prescribed by Cabinet Order, the Commission may delegate an authority under Article 26, paragraph (1); under Article 146, paragraph (1); under Article 100, paragraph (1), Article 101, Article 102-2, Article 103, Article 105, Article 106 or Article 108 of the Code of Civil Procedure (Act No. 109 of 1996) as applied mutatis mutandis pursuant to the provisions of Article 162 following the deemed replacement of terms; under Article 163; and under Article 164 to the competent minister for the business, as prescribed by Cabinet Order.

For a requirement to submit a report or material under Article 146, paragraph (1), a recommendation under Article 148, paragraph (1), an order under paragraph (2) or paragraph (3) of that Articlefor measures, a call for a report under Article 153, an order under Article 154, or a rescission under Article 155, paragraph (1), a document specified by Order of the Personal Information Protection Commission must be served.

For an order under Article 148, paragraph (2) or paragraph (3), orfor measures or an order under Article 154, or a notice under Article 15, paragraph (1) or Article 30 of the Administrative Procedure Act (Act No. 88 of 1993) relating to a rescission under Article 155, paragraph (1), a document referred to in Article 15, paragraphs (1) and (2) or Article 30 of that Act must be served. In this case, the provisions of Article 15, paragraph (3) of that Act (including as applied mutatis mutandis pursuant to Article 31 of that Act following the deemed replacement of terms) do not apply.

The provisions of Article 100, paragraph (1), Article 101, Article 102-2, Article 103, Article 105, Article 106, and Article 108 of the Code of Civil Procedure apply mutatis mutandis to the service under the preceding provisions of this Act (including Cabinet Orders or Orders of the Personal Information Protection Commission based on this Act; the same applies in Article 164). In this case, the term "court" in Article 100, paragraph (1) of the Code and the term "presiding judge" in Article 108 of the Code are deemed to be replaced by "Personal Information Protection Commission", and the term "court execution officer" in Article 101, paragraph (1) of the Code is deemed to be replaced by "official of the Personal Information Protection Commission".

in cases of service that would be effected in a foreign country (meaning a country or region located outside the territory of Japan; the same applies hereinafter), the Commission finds that it is impossible to follow the provisions of Article 108 of the Code of Civil Procedure as applied mutatis mutandis pursuant to the preceding Article following the deemed replacement of terms, or it is impossible to effect service even if the Commission follows those provisions;

When an official of the Commission has, pursuant to Article 7, paragraph (1) of the Act on the Advancement of Government Administration Processes That Utilize Information and Communications Technology (Act No. 151 of 2002), used the electronic data processing system prescribed in Article 6, paragraph (1) of that Act for administrating affairs related to a disposition notice, etc. prescribed in Article 3, item (ix) of that Act for which a document under Article 161the provisions of this Act is to be served, the official must use that electronic data processing system to record the particulars of the service under Article 100, paragraph (1) of the Code of Civil Procedure as applied mutatis mutandis pursuant to Article 162 following the deemed replacement of terms, in a file that is stored on a computer (including input or output device) used by the Commission, instead of preparing and submitting a document that states those particulars.

This Act also applies in those cases in which, in relation to supplying a good or service to a person in Japan, a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, or a business handling information related to or other related information handles the personal information by which that person in Japan is identifiable, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis or provided personal data, etc. for statistical compilation or similar analysis pertaining to that personal information handles the, pseudonymized personal information by which that person in Japan is identifiableor anonymized personal information that has been prepared by using that personal information, information related to personal information that is to be acquired as that personal information, or pseudonymized personal information or anonymized personal information that has been prepared by using that personal informationcontact-enabling information related to personal information that can be used for contacting or otherwise transmitting information to a specific individual in Japan, in a foreign country.