Act on the Protection of Personal Information

A business handling personal information that has been entrusted by another business handling personal information or an administrative entity with all or part of the handling of personal information (including entrustment through two or more tiers) must not, except in cases based on laws and regulations, etc., handle the personal information whose handling it has been entrusted with (excluding that which constitutes information related to personal information for that business handling personal information) beyond the scope necessary for the performance of the entrusted services.

Except cases set forth in each item of Article 27, paragraph (1), if it is assumed that a third party acquires information related to personal information (limited to those compiled in a database or the equivalent of information related to personal information; hereinafter the same applies in this Chapterparagraph and Chapter VIthe following paragraph) as personal data, businesses handling information related to personal information must not provide the information related to personal information to the third party without confirming the matters set forth as follows pursuant to Order of the Personal Information Protection Commission:

The provisions of Article 30, paragraphs (2) through (4) of the preceding Article apply mutatis mutandis to cases in which a business handling information related to personal information conducts confirmation pursuant to the provisions of paragraph (1). In this case, the phrase "received" in paragraph (3) of the precedingthat Article is deemed to be replaced with "provided."

A business handling information related to personal information must not utilize contact-enabling information related to personal information in a way that there is a possibility of fomenting or inducing unlawful or unjust act.

A business handling information related to personal information must not acquire contact-enabling information related to personal information by deception or other wrongful means.

Notwithstanding the provisions of Article 31, paragraph (1) (limited to the part relating to item (i)), if a third party needs to handle information related to personal information for the purpose of statistical compilation or similar analysis (limited to cases in which the entire purpose of handling that information related to personal information is the purpose of statistical compilation or similar analysis), and the case falls under all of the following items, a business handling information related to personal information may provide that information related to personal information to that third party without confirming the matter set forth in Article 31, paragraph (1), item (i); provided, however, that this does not apply if that information related to personal information has been provided by a business handling personal information or by another business handling information related to personal information pursuant to the provisions of the main clause of Article 30-2, paragraph (5) or the main clause of this paragraph (including information all or part of which has been reproduced or processed).

that business handling information related to personal information and that third party have disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the names of that business handling information related to personal information and that third party, the content of the statistical compilation or similar analysis they intend to conduct, and other matters prescribed by Order of the Personal Information Protection Commission;

it is clearly specified by a written agreement (including an electronic or magnetic record) with that third party that the provision is made under the main clause of this paragraph.

A third party that has received a provision of information related to personal information pursuant to the main clause of the preceding paragraph and acquired it as personal data (limited to a person that is a business handling personal information; referred to as a "special-provision recipient of information related to personal information" in this Article and Article 72-3, paragraph (9), item (i)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in item (i) of the preceding paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in paragraph (4), those matters as changed) for the period during which it handles that information related to personal information or information relating to a living individual produced by reproducing or processing all or part of it (hereinafter referred to as "provided personal data, etc. for statistical compilation or similar analysis").

A special-provision recipient of information related to personal information may change the matters disclosed to the public pursuant to the provisions of the preceding paragraph only if both that special-provision recipient of information related to personal information and the business handling information related to personal information that provided information related to personal information to that special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1) disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that those matters will be changed and the content of the change; provided, however, that this does not apply when changing the name of that special-provision recipient of information related to personal information or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the special-provision recipient of information related to personal information must, promptly after making the change, disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that it has made the change and the content of the change.

Notwithstanding the provisions of Article 18, a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations, etc.

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to a special-provision recipient of information related to personal information: statistical compilation or similar analysis of the content which that special-provision recipient of information related to personal information discloses to the public pursuant to the provisions of paragraph (2);

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to an administrative organ's head or administrative entity: statistical compilation or similar analysis of the content which that administrative organ's head or administrative entity discloses to the public pursuant to the provisions of Article 72-3, paragraph (6).

Notwithstanding the provisions of Article 27, paragraphs (1) and (2) and Article 28, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide personal data that constitutes that provided personal data, etc. for statistical compilation or similar analysis to a third party, except in cases based on laws and regulations, etc. In this case, the phrase "is not to fall under a third party regarding applying the provisions of each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "(limited to a person that is a business handling personal information or an administrative organ's head or administrative entity prescribed in Article 63 (limited, if such a person is a person in a foreign country prescribed in paragraph (1) of the following Article, to a person that has established a system that conforms to standards prescribed in Article 30-2, paragraph (5))) is not to fall under a third party regarding applying the provisions of Article 31-3, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso to Article 29, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in Article 30-2, paragraph (4) or any of the items of Article 27, paragraph (5)"; and the phrase "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso to Article 30, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in paragraph (4) of the following Article or any of the items of Article 27, paragraph (5)".

Notwithstanding the provisions of Article 31, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide that provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data; the same applies in the following paragraph) to a third party, except in cases based on laws and regulations, etc.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving the provision of provided personal data, etc. for statistical compilation or similar analysis (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity). In this case, the phrase "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 31-3, paragraph (7)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; and the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public".

A business handling information related to personal information that has provided information related to personal information pursuant to the main clause of paragraph (1) to a third party in a foreign country that has established a system that conforms to standards, or a business handling personal information that has provided provided personal data, etc. for statistical compilation or similar analysis to that third party, must take necessary measures to ensure continuous implementation of the equivalent measures by that third party, and disclose information on those necessary measures to the public, pursuant to Order of the Personal Information Protection Commission. In this case, the provisions of Article 28, paragraph (3) do not apply.

The provisions of Articles 23 through 25 apply mutatis mutandis to the handling of provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data) by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information to a special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1). In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking".

the procedures for responding to a request under the following paragraph,for disclosure or to a request under paragraph (1) of the following Article (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (1); orother handling prescribed in Article 3537, paragraph (1), paragraph (3), or paragraph (5) ( (including the amount of the fee, if one a fee is setcollected pursuant to the provisions of Article 38, paragraph (21));

When having received a request under the preceding paragraph, a business handling personal information must disclose personal data the business holds to an identifiable person without delay by means that person requests pursuant to the provisions of that paragraph (or by paper-based document, in cases in which disclosing the data by that means would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances); provided, however, that in cases in which disclosing that data falls under any of each following, all or a part of it may not be disclosed:

Identifiable persons may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify that person (hereinafter referred to as a "ceasing to use or deleting personal data" in this Article), if the personal data the business holds is being handled in violation of the provisions of Article 18 or, Article 19, Article 30-2, paragraph (4) or (9), Article 30-3, or Article 31-3, paragraph (5), or has been obtained in violation of the provisions of Article 20.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds to the extent necessary to redress the violation without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person.

Identifiable persons may request that a business handling personal information cease to provide a third party with the personal data the business holds that can be used to identify the person, if the personal data the business holds is being provided to a third party in violation of the provisions of Article 27, paragraph (1) , Article 28, Article 30-2, paragraph (10), or Article 2831-3, paragraph (6).

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to provide a third party with the personal data the business holds without delay; provided, however, that this does not apply if ceasing to provide a third party with the personal data the business holds would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect an identifiable person's rights and interests.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds to the extent necessary to prevent an infringement of the identifiable person's rights and interests without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect the identifiable person's rights and interests.

If An identifiable person may request that a business handling personal information have ceasedcease to use or deleteddelete, or decided not to cease to use or delete all or part of personal data the business holds in connection withprovide a request under paragraph (1) or (5), or third party with, the business has ceased to provide a third party or decided not to ceasespecified biometric personal information that can be used to provide a third party with all or part ofidentify that person (limited to that included in the personal data the business holds in connection with a request under paragraph (3) or (5), the business must notify), if that specified biometric personal information is being handled, except in the identifiable person to that effect without delay.following cases:

cases in which the business handling personal information has created the specified biometric individual identification code included in that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information has acquired that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information handles that specified biometric personal information based on laws and regulations;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that specified biometric personal information in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that specified biometric personal information from that academic research institution or the equivalent, or in which a specified biometric individual identification code created by converting information that the business handling personal information conducting academic research jointly with an academic research institution or the equivalent has acquired from that academic research institution or the equivalent is included in that specified biometric personal information, and the business needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that specified biometric personal information by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the creation of the specified biometric individual identification code included in that specified biometric personal information or the circumstances of the acquisition of that specified biometric personal information, that handling it by the business handling personal information is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete that specified biometric personal information, or cease to provide it to a third party, without delay; provided, however, that this does not apply if ceasing to use or deleting that specified biometric personal information or ceasing to provide it to a third party would prove difficult because it would require a costly expenditure or due to other circumstances, and the business takes the necessary alternative measures to protect the identifiable person's rights and interests.

An identifiable person under 16 years of age may request that a business handling personal information cease to use or delete, or cease to provide a third party with, the personal data the business holds that can be used to identify that person, if that personal data the business holds is being handled, except in the following cases:

cases in which the business handling personal information has acquired that personal data the business holds with the consent of the legal representative of the identifiable person obtained in advance;

cases in which the business handling personal information handles that personal data the business holds based on laws and regulations;

cases in which the business handling personal information needs to handle that personal data the business holds in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that personal data the business holds in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that personal data the business holds in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that personal data the business holds from that academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that personal data the business holds by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal data the business holds, that handling it by the business handling personal information does not harm the rights and interests of the identifiable person under 16 years of age;

cases in which that personal data the business holds had been open to the public, at the time when the business handling personal information acquired it, by the legal representative of the identifiable person, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission;

cases in which the legal representative of the identifiable person had permitted the identifiable person to engage in business, and the business handling personal information acquired that personal data the business holds in connection with that business;

cases in which the identifiable person had used fraudulent means to make the business handling personal information believe that the identifiable person was 16 years of age or older;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or due to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person under 16 years of age.

If a business handling personal information have ceased to use or deleted, or decided not to cease to use or delete all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (1), (5), (7), or (9), or the business has ceased to provide a third party or decided not to cease to provide a third party with all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (3), (5), (7), or (9), the business must notify the identifiable person to that effect without delay.

If, pursuant to the provisions of Article 32, paragraph (3), Article 33, paragraph (3) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (3) or paragraph (711) of the preceding Article, a business handling personal information notifies an identifiable person that it will not take all or part of the measures which the person has requested the business take, or that it will take different measures, the business must endeavor to explain its reasons for this to the person.

As regards a request under Article 32, paragraph (2), or a request under Article 33, paragraph (1) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article; the same applies in paragraph (1) of the following Article and Article 39), Article 34, paragraph (1), Article 35, paragraph (1), (3), (5), (7), or (59) (hereinafter referred to as a "request for disclosure or other handling" in this Article and Article 54, paragraph (1)Chapter), a business handling personal information may decide on a method of receiving a request as prescribed by Cabinet Order. In such a case, an identifiable person must request disclosure or other handling in that way.

A business handling personal information may request an identifiable person requesting disclosure or other handling to present sufficient information to identify the personal data the business holds or the specified biometric personal information, or the record of provision to a third party, that would be subject to the disclosure or other handling. In such a case, the business handling personal information must provide information to help the person identify the relevant personal data the business holds or the relevant specified biometric personal information, or the relevant record of provision to a third party, or take other appropriate measures in consideration of the identifiable person's convenience, so as to allow the person to easily and accurately request disclosure or other handling.

A person may request disclosure legal representative of a minor or other handling throughadult ward, or an agent, as prescribed privately appointed by the identifiable person or any other agent specified by Cabinet Order may make a request for disclosure or other handling on behalf of the identifiable person.

When seeking to file a lawsuit in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), (5), (7), or (59), the identifiable person may not file the lawsuit unless the identifiable person had previously issued a request against a person who should become a defendant in the lawsuit and two weeks have elapsed since the arrival day of the issued request; provided, however, that this does not apply if the person who should become a defendant in the lawsuit has rejected the request.

The provisions of the preceding two paragraphs apply mutatis mutandis to a petition for a provisional disposition order in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), (5), (7), or (59).

A business handling personal information must endeavor to process complaints about the handling of personal information, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis appropriately and promptly.

With regard to applying the provisions of Article 18, Article 20, paragraph (2), Article 21, Article 21-2, paragraph (1), Article 26, paragraph (2), Article 27, Article 28, Article 30-2, paragraphs (1) and (5), Article 32, paragraph (1), and Article 35, paragraph (7) to personal information of a person under 16 years of age when a business handling personal information handles that personal information (excluding the following cases), the phrase "the identifiable person" in those provisions (excluding the provisions of Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i), the proviso to Article 26, paragraph (2), Article 27, paragraph (1), item (viii) and paragraph (2), Article 28, paragraph (3), and the part of Article 35, paragraph (7) other than its items, and item (ix) of that paragraph) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests" in Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 27, paragraph (1), item (viii), and Article 35, paragraph (7), item (ix) is deemed to be replaced with "does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively; the phrase "the identifiable person" in the proviso to Article 26, paragraph (2) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "at the request of that person" in Article 27, paragraph (2) is deemed to be replaced with "at the request of that person or that person's legal representative", the phrase "the business notifies that person" in that paragraph is deemed to be replaced with "the business notifies the legal representative of that person", and the phrase "or makes that information readily accessible to that person" in that paragraph is deemed to be replaced with "or makes that information readily accessible to the legal representative of that person"; and the phrase "to the identifiable person at the request of that person" in Article 28, paragraph (3) is deemed to be replaced with "to the identifiable person or that person's legal representative at the request of the identifiable person or that person's legal representative".

cases in which there is a legitimate reason for the business handling personal information not knowing that the personal information is that of a person under 16 years of age;

cases in which the legal representative of the identifiable person has permitted the identifiable person to engage in business, and the business handling personal information has acquired the personal information in connection with that business;

cases in which the identifiable person has no legal representative, or the business handling personal information has reasonable grounds to believe that the identifiable person has no legal representative.

With regard to applying the provisions of Article 31, paragraph (1) to information related to personal information when a business handling information related to personal information handles information related to personal information concerning a person under 16 years of age (excluding the following cases), the phrase "the identifiable person's consent" in item (i) of that paragraph is deemed to be replaced with "the consent of the legal representative of the identifiable person", and the phrases "the identifiable person's consent", "serves as a reference to the person" and "provided in advance to the person" in item (ii) of that paragraph are deemed to be replaced with "the consent of the legal representative of the identifiable person", "serves as a reference to the legal representative of the identifiable person" and "provided in advance to the legal representative of the identifiable person" respectively.

cases in which there is a legitimate reason for the business handling information related to personal information not knowing that the information related to personal information concerns a person under 16 years of age;

cases in which the legal representative of the person to whom the information related to personal information relates has permitted that person to engage in business, and the business handling information related to personal information has acquired the information related to personal information in connection with that business;

cases in which the person to whom the information related to personal information relates has no legal representative, or the business handling information related to personal information has reasonable grounds to believe that the person to whom the information related to personal information relates has no legal representative.

When preparing pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent; hereinafter the same applies in this Chapter (excluding paragraphs (3) and Chapter VI(4) of the following Article, Article 54, paragraph (1), and Article 58, paragraph (2))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual unless collated with other information.

With regard to applying the provisions of Article 21 and paragraph (1) of the preceding Article related to pseudonymized personal information, the phrase "notify the identifiable person of that purpose of use or disclose this to the public" in Article 21, paragraphs (1) and (3) of that Article is deemed to be replaced with "disclose that purpose of use"; the phrase "notifying the identifiable person of the purpose of use or disclosing this to the public" in the provisions of items (i) through (iii) of paragraph (4) of that Article is deemed to be replaced with "disclosing the purpose of use"; the phrase "Article 20, paragraph (2), Article 21" in paragraph (1) of the preceding Article is deemed to be replaced with "Article 20, paragraph (2)"; the phrase "Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i)" in that paragraph is deemed to be replaced with "Article 20, paragraph (2), item (vii)"; and the phrase '"does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively' in that paragraph is deemed to be replaced with '"does not harm the identifiable person's rights and interests"'.

Notwithstanding the provisions of Article 27, paragraphs (1) and (2), and Article 28, paragraph (1), and except cases based on laws and regulations, businesses handling pseudonymized personal information must not provide a third party with personal data that constitutes pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 41, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" in Article 27, paragraph (6) is deemed to be replaced with "disclose this without delay"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso of Article 29, paragraph (1), is deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)"; and the term "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso of Article 30, paragraph (1) areis deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)".

Businesses handling pseudonymized personal information, in handling that information, must not use contact addresses and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) or a specified correspondence delivery operator prescribed in Article 2, paragraph (9), for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.