Act on the Protection of Personal Information

"Contact-enabling information related to personal information" in this Act means information related to personal information that contains any of the following identifiers or the equivalent (including information that can be readily collated with other information and thereby enables any of the following identifiers or the equivalent to be identified):

the address of a residence, place of work or any other place where a specific individual is or was located (limited to one that can be used for sending to a specific individual by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) (referred to as "correspondence delivery" in Article 41, paragraph (8) and Article 73, paragraph (4)) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or a specified correspondence delivery operator prescribed in paragraph (9) of that Article, for delivering a telegram to a specific individual, or for visiting a specific individual);

a telephone number (limited to one that can be used for telephoning a specific individual or for transmitting information to a specific individual using a facsimile machine);

an email address (meaning an email address prescribed in Article 2, item (iii) of the Act on Regulation of Transmission of Specified Electronic Mail (Act No. 26 of 2002), limited to one that can be used for sending electronic mail prescribed in item (i) of that Article to a specific individual);

a code assigned so as to enable the identification of a person using telecommunications facilities (meaning telecommunications facilities prescribed in Article 2, item (ii) of the Telecommunications Business Act (Act No. 86 of 1984); the same applies hereinafter in this item) or of telecommunications facilities (limited to one that can be used for communicating information to a specific individual by means of telecommunications (meaning telecommunications prescribed in item (i) of that Article));

beyond what is set forth in the preceding items, identifiers or the equivalent prescribed by Order of the Personal Information Protection Commission as those that can be used for contacting a specific individual or otherwise communicating information to a specific individual.

"Statistical compilation or similar analysis" in this Act means an act of compiling statistics or otherwise creating information on the trends or properties of a large amount of information (excluding such trend or property information that concerns individuals) by extracting information relating to the elements constituting that information from the large amount of information and conducting classification, comparison or other analysis, which is prescribed by Order of the Personal Information Protection Commission as being unlikely to harm individual rights and interests.

the basic details of the measures to protect personal information to be taken by businesses handling personal information prescribed in Article 16, paragraph (2), businesses handling pseudonymized personal information prescribed in paragraph (5)(6) of that Article, businesses handling anonymized personal information prescribed in paragraph (6)(7) of that Article, and certified personal information protection organizations prescribed in Article 51, paragraph (1);

"Businessbusiness handling personal information" in this Chapter and Chapters VI through, Chapter VI and Chapter VIII means a person that uses a personal information database or the equivalent for business; provided, however, that this excludes persons set forth as follows:

"Specified biometric personal information" in this Chapter means personal information that includes a specified biometric individual identification code (meaning an individual identification code falling under Article 2, paragraph (2), item (i) that has been converted from information prescribed by Cabinet Order as information on a characteristic of a part of the body which can be acquired by a method that does not require special technology or a costly expenditure and whose acquisition the identifiable person cannot easily recognize; the same applies in Article 21-2, paragraph (1), item (iv) and Article 35, paragraph (7)).

"Business handling pseudonymized personal information" in this Chapter and Chapters VI and VII Chapter VI means a person that uses a collective body of information consisting of pseudonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular pseudonymized personal information (referred to as a "pseudonymized personal information database or the equivalent" in Article 41, paragraph (1) and Article 42, paragraph (3)); provided, however, that this excludes persons set forth in each item of paragraph (2).

"Businessbusiness handling anonymized personal information" in this Chapter and Chapters VI and VII Chapter VI means a person that uses a collective body of information consisting of anonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular anonymized personal information (referred to as an "anonymized personal information database or the equivalent" in Article 43, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).

"Business handling information related to personal information" in this Chapter and Chapters VI and VII Chapter VI means a person that uses collective body of information consisting of information related to personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular information related to personal information (referred to as ana "database or the equivalent of information related to personal information" in Article 31, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).

"Academicacademic research institution or the equivalent" in this Chapter means a university or other organization or group associated with academic studies (including a hospital prescribed in Article 1-5, paragraph (1) of the Medical Care Act (Act No. 205 of 1948) (referred to as a "hospital" in Article 58, paragraph (2)) and other organizations or groups for the purpose of providing medical care), or a person belonging to it.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling the personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal information, that handling it is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases of acquiring the sensitive personal information fromconducting academic research jointly with an academic research institution or the equivalent and it is necessary to acquire that information the sensitive personal information from that academic research institution or the equivalent for academic research purposepurposes (including cases in which a part of the purpose of acquiring the sensitive personal information is for academic research purposes, excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the academic research institution or the equivalent jointly conduct academic research);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that acquiring the sensitive personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of the sensitive personal information, that acquiring it is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests;

cases of receiving the provision pursuant to the main clause of Article 30-2, paragraph (5), or of acquiring, as sensitive personal information, information related to personal information provided pursuant to the main clause of Article 31-3, paragraph (1);

A business handling personal information must, when handling specified biometric personal information, notify the identifiable person of the following matters in advance, or put them in a state where the identifiable person can easily know them, as provided by Order of the Personal Information Protection Commission:

the name and address of that business handling personal information and, if it is a corporation, the name of its representative (or, for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; the same applies in Article 27, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));

the fact that specified biometric personal information will be handled;

the purpose of use of the specified biometric personal information;

the content of the information on the characteristic of a part of the body that is converted into the specified biometric individual identification code included in the specified biometric personal information;

the procedures for responding to a request for disclosure or other handling prescribed in Article 37, paragraph (1) (including the amount of the fee, if a fee is collected pursuant to the provisions of Article 38, paragraph (1));

other matters prescribed by Order of the Personal Information Protection Commission as those necessary to protect individual rights and interests.

The provisions of the preceding paragraph do not apply in the following cases:

taking the measures under the preceding paragraph is likely to harm the life, wellbeing, property, or other rights or interests of the identifiable person or a third party;

taking the measures under the preceding paragraph is likely to harm the rights or legitimate interests of the business handling personal information;

it is necessary for the business to cooperate with a national government organ or a local government in performing the functions prescribed by laws and regulations, and taking the measures under the preceding paragraph is likely to interfere with the performance of those functions;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in the preceding three items.

In cases prescribed in the preceding paragraph, businesses handling personal information (excluding those that have given a notice under the proviso of that paragraph) must notify the identifiable person of the occurrence of the situation, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply if it is difficult to notify the identifiable person of that occurrence, or in a case prescribed by Order of the Personal Information Protection Commission as one in which there is little risk of a failure to protect the identifiable person's rights and interests even if the identifiable person is not notified, and the necessary alternative measures are taken to protect that person's rights and interests.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which the business handling personal information that is an academic research institution or the equivalent conducts academic research jointly with a third party, and needs to provide the personal data to that third party for the academic research purpose (including cases in which a part of the purpose of providinghandling the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the third party jointly conduct academic research);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that providing the personal data is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal data, that providing it is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests.

Notwithstanding the provisions of the preceding paragraph, if a business handling personal information agrees to cease to provide a third party with any personal data which can be used to identify the identifiable person, at the request of that person; the business notifies that person of the following information in advance or makes that information readily accessible to that person in advance, as provided for by Order of the Personal Information Protection Commission; and the business files a notification of this to the Commission, the business may provide that personal data to a third party; provided, however, that this does not apply to cases in which personal data which is to be provided to a third party is sensitive personal information or specified biometric personal information, has been acquired in violation of the provisions of Article 20, paragraph (1), or has been provided by another business handling personal information pursuant to the provisions of the main clause of this paragraph (including personal data all or part of which has been reproduced or processed):

the name and address of a business handling personal information that provides personal information to a third party and, if it is a corporation, the name of its representative (or for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; hereinafter the same applies in this Article, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));

When providing personal data to a third party (excluding a person set forth in each item of Article 16, paragraph (2); hereinafter the same applies in this Article, Article 29, paragraph (1), and Article 30, paragraphs (1) and (2) (including as applied mutatis mutandis pursuant to Article 31, paragraph (3))) pursuant to the provisions of the main clause of paragraph (2), a business handling personal information must confirm the following matters in advance, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply in cases in which all of that personal data had been open to the public, at the time when that business handling personal information acquired that personal data, by the identifiable person, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission, or in cases prescribed by Order of the Personal Information Protection Commission as equivalent to those cases.

the name and address of the third party and, if the third party is a corporation, the name of its representative;

the purpose of use of the personal data by the third party.

A third party that has been asked by a business handling personal information to give confirmation under the preceding paragraph must not deceive that business handling personal information on a matter relating to the confirmation.

Except cases set forth in the items of paragraph (1) of the preceding Article, before businesses handling personal information provide personal data to a third party (excluding a person that establishes a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to those that a business handling personal information must take concerning the handling of personal data pursuant to the provisions of this Section (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph, the following paragraph and Article 31, paragraph (1), item (ii)) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)) (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)Section), the businesses must obtain an identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country. In this case, the provisions of the preceding Article do not apply.

When having provided personal data to a third party (excluding a person set forth in each item of Article 16, paragraph (2); hereinafter the same applies in this Article and the following Article (including as applied mutatis mutandis pursuant to Article 31, paragraph (3) following the deemed replacement of terms)), , businesses handling personal information must prepare a record pursuant to Order of the Personal Information Protection Commission on the date of the provision of the personal data, the name of the third party, and other matters prescribed by Order of the Personal Information Protection Commission (or, in cases in which confirmation under Article 27, paragraph (7) has been given, those matters and the matters set forth in item (ii) of that paragraph); provided, however, that this does not apply to cases in which the provision of personal data falls under any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article).

Notwithstanding the provisions of Article 20, paragraph (2), if a business handling personal information needs to handle sensitive personal information that is currently open to the public for the purpose of conducting statistical compilation or similar analysis (hereinafter referred to as the "purpose of statistical compilation or similar analysis" in this paragraph, paragraph (5), and Article 31-3, paragraph (1)) or for the purpose of making a provision under the main clause of paragraph (5) (limited to cases in which the entire purpose of handling that sensitive personal information is the purpose of statistical compilation or similar analysis or the purpose of making that provision), and has disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the name of that business handling personal information, the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information it acquires or the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5), and other matters prescribed by Order of the Personal Information Protection Commission, the business may acquire that sensitive personal information currently open to the public without obtaining the consent of the identifiable person.

A business handling personal information that has acquired sensitive personal information pursuant to the provisions of the preceding paragraph (referred to as a "special-provision acquirer of sensitive personal information" in the following paragraph, paragraph (4), and Article 72-3, paragraph (1)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in the preceding paragraph, the matters prescribed in that paragraph (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in the proviso to the following paragraph, those matters as changed) for the period during which it handles that sensitive personal information or information relating to a living individual produced by reproducing or processing all or part of it.

When changing the matters it discloses to the public pursuant to the provisions of the preceding paragraph, a special-provision acquirer of sensitive personal information must disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), that fact and the content of the change; provided, however, that when changing the name of that special-provision acquirer of sensitive personal information or other matters prescribed by Order of the Personal Information Protection Commission, it is sufficient for it to disclose to the public that fact and the content of the change promptly after making the change, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1).

Notwithstanding the provisions of Article 18, a business handling personal information that handles sensitive personal information acquired pursuant to the provisions of paragraph (1) or information relating to a living individual produced by reproducing or processing all or part of it (excluding that which constitutes provided personal information, etc. for statistical compilation or similar analysis prescribed in paragraph (6); hereinafter referred to as "sensitive personal information, etc. for statistical compilation or similar analysis") must not handle that sensitive personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for performing the act specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations and in cases in which there is an urgent need to rescue human life, provide disaster relief, or respond to any other emergency situation (hereinafter referred to as "cases based on laws and regulations, etc." in this Chapter).

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates (excluding the case set forth in item (iii)): statistical compilation or similar analysis of the content so disclosed;

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the fact that it will handle the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates for the purpose of making a provision under the main clause of the following paragraph (excluding the case set forth in the following item): that provision;

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates and the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of the following paragraph: statistical compilation or similar analysis of the content so disclosed, and that provision.

Notwithstanding the provisions of Article 18 and Article 27, paragraph (1), if a third party (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity (meaning an administrative organ's head or administrative entity prescribed in Article 63; the same applies in paragraph (9), item (ii), paragraph (12), and Article 31-3, paragraph (5), item (ii) and paragraph (8)) (if that person is a person in a foreign country, limited to a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to those that a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, and a business handling information related to personal information (hereinafter referred to as a "business handling personal or other related information") must take concerning the handling of personal information, pseudonymized personal information, anonymized personal information, and information related to personal information (hereinafter referred to as "personal or other related information") pursuant to the provisions of this Chapter (those measures being referred to as "equivalent measures" in paragraph (13) and Article 31-3, paragraph (9)) (that system being referred to as a "system that conforms to standards" in paragraph (13) and Article 31-3, paragraph (9)); the same applies in paragraph (12) and Article 31-3, paragraph (8)); hereinafter the same applies in this paragraph, the following paragraph, and Article 31-3, paragraphs (1) and (2)) needs to handle personal information (including sensitive personal information, etc. for statistical compilation or similar analysis; hereinafter the same applies in this paragraph through paragraph (7), paragraph (13), and Article 72-3, paragraphs (2) and (3)) for the purpose of statistical compilation or similar analysis (limited to cases in which the entire purpose of handling that personal information is the purpose of statistical compilation or similar analysis), and the case falls under all of the following items, a business handling personal information may provide that personal information to that third party without obtaining the consent of the identifiable person; provided, however, that this does not apply if that personal information has been provided by another business handling personal information or by a business handling information related to personal information pursuant to the provisions of the main clause of this paragraph or the main clause of Article 31-3, paragraph (1) (including personal information all or part of which has been reproduced or processed).

that business handling personal information and that third party have disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the names of that business handling personal information and that third party, the content of the statistical compilation or similar analysis they intend to conduct, and other matters prescribed by Order of the Personal Information Protection Commission;

it is clearly specified by a written agreement (including an electronic or magnetic record) with that third party that the provision is made under the main clause of this paragraph.

A third party that has received a provision of personal information pursuant to the main clause of the preceding paragraph (limited to a person that is a business handling personal information; referred to as a "special-provision recipient of personal information" in this Article and Article 72-3, paragraph (5), item (i)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in item (i) of the preceding paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in paragraph (8), those matters as changed) for the period during which it handles that personal information or information relating to a living individual produced by reproducing or processing all or part of it (hereinafter referred to as "provided personal information, etc. for statistical compilation or similar analysis").

A special-provision recipient of personal information may change the matters disclosed to the public pursuant to the provisions of the preceding paragraph only if both that special-provision recipient of personal information and the business handling personal information that provided personal information to that special-provision recipient of personal information pursuant to the main clause of paragraph (5) disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (5), item (i), that those matters will be changed and the content of the change; provided, however, that this does not apply when changing the name of that special-provision recipient of personal information or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the special-provision recipient of personal information must, promptly after making the change, disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (5), item (i), that it has made the change and the content of the change.

Notwithstanding the provisions of Article 18, a business handling personal information that handles provided personal information, etc. for statistical compilation or similar analysis must not handle that provided personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations, etc.

if the provision under the main clause of paragraph (5) to which that provided personal information, etc. for statistical compilation or similar analysis relates was made to a special-provision recipient of personal information: statistical compilation or similar analysis of the content which that special-provision recipient of personal information discloses to the public pursuant to the provisions of paragraph (6);

if the provision under the main clause of paragraph (5) to which that provided personal information, etc. for statistical compilation or similar analysis relates was made to an administrative organ's head or administrative entity: statistical compilation or similar analysis of the content which that administrative organ's head or administrative entity discloses to the public pursuant to the provisions of Article 72-3, paragraph (2).

Notwithstanding the provisions of Article 27, paragraphs (1) and (2) and Article 28, paragraph (1), a business handling personal information that handles sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis must not provide personal data that constitutes that sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis to a third party, except in the following cases. In this case, the phrase "is not to fall under a third party regarding applying the provisions of each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "(limited to a person that is a business handling personal information or an administrative organ's head or administrative entity prescribed in Article 63 (limited, if such a person is a person in a foreign country prescribed in paragraph (1) of the following Article, to a person that has established a system that conforms to standards prescribed in Article 30-2, paragraph (5))) is not to fall under a third party regarding applying the provisions of Article 30-2, paragraph (10)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso to Article 29, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in Article 30-2, paragraph (4) or any of the items of Article 27, paragraph (5)"; and the phrase "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso to Article 30, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in paragraph (4) of the following Article or any of the items of Article 27, paragraph (5)".

cases based on laws and regulations, etc.;

cases in which that business handling personal information has acquired sensitive personal information pursuant to the provisions of paragraph (1) and has disclosed to the public, pursuant to the provisions of paragraph (2), the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5), and that business handling personal information provides the sensitive personal information, etc. for statistical compilation or similar analysis relating to that sensitive personal information pursuant to the main clause of paragraph (5).

Notwithstanding the provisions of Article 31, paragraph (1), a business handling personal information that handles sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis must not provide that sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (excluding those that constitute personal data; the same applies in the following paragraph) to a third party, except in the cases set forth in the items of the preceding paragraph.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving the provision of sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity). In this case, the phrase "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 30-2, paragraph (11)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; and the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public".

A business handling personal information that has provided personal information pursuant to the main clause of paragraph (5) to a third party in a foreign country that has established a system that conforms to standards, or has provided sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis to that third party, must take necessary measures to ensure continuous implementation of the equivalent measures by that third party, and disclose information on those necessary measures to the public, pursuant to Order of the Personal Information Protection Commission. In this case, the provisions of Article 28, paragraph (3) do not apply.

The provisions of Articles 23 through 25 apply mutatis mutandis to the handling of sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (excluding those that constitute personal data) by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling personal information provides sensitive personal information, etc. for statistical compilation or similar analysis (limited to that which constitutes information related to personal information prescribed in Article 31, paragraph (1)) to a special-provision recipient of personal information pursuant to the main clause of paragraph (5) (limited to cases in which it is assumed that the special-provision recipient of personal information acquires that sensitive personal information, etc. for statistical compilation or similar analysis as personal data). In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking".

A business handling personal information that has been entrusted by another business handling personal information or an administrative entity with all or part of the handling of personal information (including entrustment through two or more tiers) must not, except in cases based on laws and regulations, etc., handle the personal information whose handling it has been entrusted with (excluding that which constitutes information related to personal information for that business handling personal information) beyond the scope necessary for the performance of the entrusted services.

Except cases set forth in each item of Article 27, paragraph (1), if it is assumed that a third party acquires information related to personal information (limited to those compiled in a database or the equivalent of information related to personal information; hereinafter the same applies in this Chapter and Chapter VIparagraph and the following paragraph) as personal data, businesses handling information related to personal information must not provide the information related to personal information to the third party without confirming the matters set forth as follows pursuant to Order of the Personal Information Protection Commission:

The provisions of Article 30, paragraphs (2) through (4) of the preceding Article apply mutatis mutandis to cases in which a business handling information related to personal information conducts confirmation pursuant to the provisions of paragraph (1). In this case, the phrase "received" in paragraph (3) of the precedingthat Article is deemed to be replaced with "provided."

A business handling information related to personal information must not utilize contact-enabling information related to personal information in a way that there is a possibility of fomenting or inducing unlawful or unjust act.

A business handling information related to personal information must not acquire contact-enabling information related to personal information by deception or other wrongful means.

Notwithstanding the provisions of Article 31, paragraph (1) (limited to the part relating to item (i)), if a third party needs to handle information related to personal information for the purpose of statistical compilation or similar analysis (limited to cases in which the entire purpose of handling that information related to personal information is the purpose of statistical compilation or similar analysis), and the case falls under all of the following items, a business handling information related to personal information may provide that information related to personal information to that third party without confirming the matter set forth in Article 31, paragraph (1), item (i); provided, however, that this does not apply if that information related to personal information has been provided by a business handling personal information or by another business handling information related to personal information pursuant to the provisions of the main clause of Article 30-2, paragraph (5) or the main clause of this paragraph (including information all or part of which has been reproduced or processed).

that business handling information related to personal information and that third party have disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the names of that business handling information related to personal information and that third party, the content of the statistical compilation or similar analysis they intend to conduct, and other matters prescribed by Order of the Personal Information Protection Commission;

it is clearly specified by a written agreement (including an electronic or magnetic record) with that third party that the provision is made under the main clause of this paragraph.

A third party that has received a provision of information related to personal information pursuant to the main clause of the preceding paragraph and acquired it as personal data (limited to a person that is a business handling personal information; referred to as a "special-provision recipient of information related to personal information" in this Article and Article 72-3, paragraph (9), item (i)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in item (i) of the preceding paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in paragraph (4), those matters as changed) for the period during which it handles that information related to personal information or information relating to a living individual produced by reproducing or processing all or part of it (hereinafter referred to as "provided personal data, etc. for statistical compilation or similar analysis").

A special-provision recipient of information related to personal information may change the matters disclosed to the public pursuant to the provisions of the preceding paragraph only if both that special-provision recipient of information related to personal information and the business handling information related to personal information that provided information related to personal information to that special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1) disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that those matters will be changed and the content of the change; provided, however, that this does not apply when changing the name of that special-provision recipient of information related to personal information or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the special-provision recipient of information related to personal information must, promptly after making the change, disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that it has made the change and the content of the change.

Notwithstanding the provisions of Article 18, a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations, etc.

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to a special-provision recipient of information related to personal information: statistical compilation or similar analysis of the content which that special-provision recipient of information related to personal information discloses to the public pursuant to the provisions of paragraph (2);

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to an administrative organ's head or administrative entity: statistical compilation or similar analysis of the content which that administrative organ's head or administrative entity discloses to the public pursuant to the provisions of Article 72-3, paragraph (6).

Notwithstanding the provisions of Article 27, paragraphs (1) and (2) and Article 28, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide personal data that constitutes that provided personal data, etc. for statistical compilation or similar analysis to a third party, except in cases based on laws and regulations, etc. In this case, the phrase "is not to fall under a third party regarding applying the provisions of each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "(limited to a person that is a business handling personal information or an administrative organ's head or administrative entity prescribed in Article 63 (limited, if such a person is a person in a foreign country prescribed in paragraph (1) of the following Article, to a person that has established a system that conforms to standards prescribed in Article 30-2, paragraph (5))) is not to fall under a third party regarding applying the provisions of Article 31-3, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso to Article 29, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in Article 30-2, paragraph (4) or any of the items of Article 27, paragraph (5)"; and the phrase "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso to Article 30, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in paragraph (4) of the following Article or any of the items of Article 27, paragraph (5)".

Notwithstanding the provisions of Article 31, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide that provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data; the same applies in the following paragraph) to a third party, except in cases based on laws and regulations, etc.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving the provision of provided personal data, etc. for statistical compilation or similar analysis (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity). In this case, the phrase "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 31-3, paragraph (7)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; and the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public".

A business handling information related to personal information that has provided information related to personal information pursuant to the main clause of paragraph (1) to a third party in a foreign country that has established a system that conforms to standards, or a business handling personal information that has provided provided personal data, etc. for statistical compilation or similar analysis to that third party, must take necessary measures to ensure continuous implementation of the equivalent measures by that third party, and disclose information on those necessary measures to the public, pursuant to Order of the Personal Information Protection Commission. In this case, the provisions of Article 28, paragraph (3) do not apply.

The provisions of Articles 23 through 25 apply mutatis mutandis to the handling of provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data) by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information to a special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1). In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking".

the procedures for responding to a request under the following paragraph, or to a request under paragraph (1) of the following Article (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (1); orfor disclosure or other handling prescribed in Article 3537, paragraph (1), paragraph (3), or paragraph (5) (including the amount of the fee, if one is seta fee is collected pursuant to the provisions of Article 38, paragraph (2)(1));

When having received a request under the preceding paragraph, a business handling personal information must disclose personal data the business holds to an identifiable person without delay by means that person requests pursuant to the provisions of that paragraph (or by paper-based document, in cases in which disclosing the data by that means would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances); provided, however, that in cases in which disclosing that data falls under any of each following, all or a part of it may not be disclosed: