Act on the Protection of Personal Information

Identifiable persons may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify that person (hereinafter referred to as a "ceasing to use or deleting personal data" in this Article), if the personal data the business holds is being handled in violation of the provisions of Article 18 or 19, Article 19, Article 30-2, paragraph (4) or (9), Article 30-3, or Article 31-3, paragraph (5), or has been obtained in violation of the provisions of Article 20.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds to the extent necessary to redress the violation without delay; provided, however, that this does not apply if ceasing to use or deleting personal data in respect of the personal data the business holds would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person.

Identifiable persons may request that a business handling personal information cease to provide a third party with the personal data the business holds that can be used to identify the person, if the personal data the business holds is being provided to a third party in violation of the provisions of Article 27, paragraph (1) or Article 28, Article 28, Article 30-2, paragraph (10), or Article 31-3, paragraph (6).

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to provide a third party with the personal data the business holds without delay; provided, however, that this does not apply if ceasing to provide a third party with the personal data the business holds would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect an identifiable person's rights and interests.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds, to the extent necessary to prevent an infringement of the identifiable person's rights and interests without delay; provided, however, that this does not apply if ceasing to use or deleting personal data in respect of the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect the identifiable person's rights and interests.

An identifiable person may request that a business handling personal information cease to use or delete, or cease to provide a third party with, the specified biometric personal information that can be used to identify that person (limited to that included in the personal data the business holds), if that specified biometric personal information is being handled, except in the following cases:

cases in which the business handling personal information has created the specified biometric individual identification code included in that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information has acquired that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information handles that specified biometric personal information based on laws and regulations;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that specified biometric personal information in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that specified biometric personal information from that academic research institution or the equivalent, or in which a specified biometric individual identification code created by converting information that the business handling personal information conducting academic research jointly with an academic research institution or the equivalent has acquired from that academic research institution or the equivalent is included in that specified biometric personal information, and the business needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that specified biometric personal information by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the creation of the specified biometric individual identification code included in that specified biometric personal information or the circumstances of the acquisition of that specified biometric personal information, that handling it by the business handling personal information is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete that specified biometric personal information, or cease to provide a third party with it, without delay; provided, however, that this does not apply if ceasing to use or deleting personal data in respect of that specified biometric personal information or ceasing to provide a third party with it would prove difficult because it would require a costly expenditure or due to other circumstances, and the business takes the necessary alternative measures to protect the identifiable person's rights and interests.

An identifiable person under 16 years of age may request that a business handling personal information cease to use or delete, or cease to provide a third party with, the personal data the business holds that can be used to identify that person, if that personal data the business holds is being handled, except in the following cases:

cases in which the business handling personal information has acquired that personal data the business holds with the consent of the legal representative of the identifiable person obtained in advance;

cases in which the business handling personal information handles that personal data the business holds based on laws and regulations;

cases in which the business handling personal information needs to handle that personal data the business holds in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that personal data the business holds in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that personal data the business holds in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that personal data the business holds from that academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that personal data the business holds by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal data the business holds, that handling it by the business handling personal information does not harm the rights and interests of the identifiable person under 16 years of age;

cases in which that personal data the business holds had been open to the public, at the time when the business handling personal information acquired it, by the legal representative of the identifiable person, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission;

cases in which the legal representative of the identifiable person had permitted the identifiable person to engage in business, and the business handling personal information acquired that personal data the business holds in connection with that business;

cases in which the identifiable person had used fraudulent means to make the business handling personal information believe that the identifiable person was 16 years of age or older;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds, without delay; provided, however, that this does not apply if ceasing to use or deleting personal data in respect of the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or due to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person under 16 years of age.

If a business handling personal information havehas ceased to use or deleted, or decided not to cease to use or delete, all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (1) or (5), (5), (7), or (9), or the business has ceased to provide a third party or decided not to cease to provide a third party with all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (3) or (5), (5), (7), or (9), the business must notify the identifiable person to that effect without delay.

If, pursuant to the provisions of Article 32, paragraph (3), Article 33, paragraph (3) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (3) or paragraph (7)(11) of the preceding Article, a business handling personal information notifies an identifiable person that it will not take all or part of the measures which the person has requested the business take, or that it will take different measures, the business must endeavor to explain its reasons for this to the person.

As regards a request under Article 32, paragraph (2), or a request under Article 33, paragraph (1) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article; the same applies in paragraph (1) of the following Article and Article 39), Article 34, paragraph (1), Article 35, paragraph (1), (3), or (5)(5), (7), or (9) (hereinafter referred to as a "request for disclosure or other handling" in this Article and Article 54, paragraph (1)Chapter), a business handling personal information may decide on a method of receiving a request as prescribed by Cabinet Order. In such a case, an identifiable person must request disclosure or other handling in that way.

A business handling personal information may request an identifiable person requesting , in connection with a request for disclosure or other handling, to present sufficient information to identify the personal data the business holds or the specified biometric personal information, or the record of provision to a third party, that would be subject to the request for disclosure or other handling. In such a case, the business handling personal information must provide information to help the person identify the relevant personal data the business holds or the relevant specified biometric personal information, or the relevant record of provision to a third party, or take other appropriate measures in consideration of the identifiable person's convenience, so as to allow the person to easily and accurately make a request for disclosure or other handling.

A person may request disclosure or other handling through an agent, as prescribed by Cabinet Orderlegal representative of a minor or adult ward, or an agent privately appointed by the identifiable person or any other agent specified by Cabinet Order may make a request for disclosure or other handling on behalf of the identifiable person.

When seeking to file a lawsuit in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), or (5)(5), (7), or (9), the identifiable person may not file the lawsuit unless the identifiable person had previously issued a request against a person who should become a defendant in the lawsuit and two weeks have elapsed since the arrival day of the issued request; provided, however, that this does not apply if the person who should become a defendant in the lawsuit has rejected the request.

The provisions of the preceding two paragraphs apply mutatis mutandis to a petition for a provisional disposition order in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), or (5)(5), (7), or (9).

A business handling personal information must endeavor to process complaints about the handling of personal information, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis appropriately and promptly.

With regard to applying the provisions of Article 18, Article 20, paragraph (2), Article 21, Article 21-2, paragraph (1), Article 26, paragraph (2), Article 27, Article 28, Article 30-2, paragraphs (1) and (5), Article 32, paragraph (1), and Article 35, paragraph (7) to personal information of a person under 16 years of age when a business handling personal information handles that personal information (excluding the following cases), the phrase "the identifiable person" in those provisions (excluding the provisions of Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i), the proviso to Article 26, paragraph (2), Article 27, paragraph (1), item (viii) and paragraph (2), Article 28, paragraph (3), and the part of Article 35, paragraph (7) other than its items, and item (ix) of that paragraph) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests" in Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 27, paragraph (1), item (viii), and Article 35, paragraph (7), item (ix) is deemed to be replaced with "does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively; the phrase "the identifiable person" in the proviso to Article 26, paragraph (2) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "at the request of that person" in Article 27, paragraph (2) is deemed to be replaced with "at the request of that person or that person's legal representative", the phrase "the business notifies that person" in that paragraph is deemed to be replaced with "the business notifies the legal representative of that person", and the phrase "or makes that information readily accessible to that person" in that paragraph is deemed to be replaced with "or makes that information readily accessible to the legal representative of that person"; and the phrase "to the identifiable person at the request of that person" in Article 28, paragraph (3) is deemed to be replaced with "to the identifiable person or that person's legal representative at the request of the identifiable person or that person's legal representative".

cases in which there is a legitimate reason for the business handling personal information not knowing that the personal information is that of a person under 16 years of age;

cases in which the legal representative of the identifiable person has permitted the identifiable person to engage in business, and the business handling personal information has acquired the personal information in connection with that business;

cases in which the identifiable person has no legal representative, or the business handling personal information has reasonable grounds to believe that the identifiable person has no legal representative.

With regard to applying the provisions of Article 31, paragraph (1) to information related to personal information when a business handling information related to personal information handles information related to personal information concerning a person under 16 years of age (excluding the following cases), the phrase "the identifiable person's consent" in item (i) of that paragraph is deemed to be replaced with "the consent of the legal representative of the identifiable person", and the phrases "the identifiable person's consent", "serves as a reference to the person" and "provided in advance to the person" in item (ii) of that paragraph are deemed to be replaced with "the consent of the legal representative of the identifiable person", "serves as a reference to the legal representative of the identifiable person" and "provided in advance to the legal representative of the identifiable person" respectively.

cases in which there is a legitimate reason for the business handling information related to personal information not knowing that the information related to personal information concerns a person under 16 years of age;

cases in which the legal representative of the person to whom the information related to personal information relates has permitted that person to engage in business, and the business handling information related to personal information has acquired the information related to personal information in connection with that business;

cases in which the person to whom the information related to personal information relates has no legal representative, or the business handling information related to personal information has reasonable grounds to believe that the person to whom the information related to personal information relates has no legal representative.

When preparing pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent; hereinafter the same applies in this Chapter and Chapter VI(excluding paragraphs (3) and (4) of the following Article, Article 54, paragraph (1), and Article 58, paragraph (2))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual unless collated with other information.

With regard to applying the provisions of Article 21 and paragraph (1) of the preceding Article related to pseudonymized personal information, the phrase "notify the identifiable person of that purpose of use or disclose this to the public" in Article 21, paragraphs (1) and (3) of that Article is deemed to be replaced with "disclose that purpose of use"; the phrase "notifying the identifiable person of the purpose of use or disclosing this to the public" in the provisions of items (i) through (iii) of paragraph (4) of that Article is deemed to be replaced with "disclosing the purpose of use"; the phrase "Article 20, paragraph (2), Article 21" in paragraph (1) of the preceding Article is deemed to be replaced with "Article 20, paragraph (2)"; the phrase "Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i)" in that paragraph is deemed to be replaced with "Article 20, paragraph (2), item (vii)"; and the phrase '"does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively' in that paragraph is deemed to be replaced with '"does not harm the identifiable person's rights and interests"'.

Notwithstanding the provisions of Article 27, paragraphs (1) and (2), and Article 28, paragraph (1), and except cases based on laws and regulations, businesses handling pseudonymized personal information must not provide a third party with personal data that constitutes pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 41, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" in Article 27, paragraph (6) is deemed to be replaced with "disclose this without delay"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso of Article 29, paragraph (1), is deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)"; and the term "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso of Article 30, paragraph (1) areis deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)".

Businesses handling pseudonymized personal information, in handling that information, must not use contact addresses and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) or a specified correspondence delivery operator prescribed in Article 2, paragraph (9), for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

Except in cases based on laws and regulations, businesses handling pseudonymized personal information must not provide pseudonymized personal information (excluding those that constitute personal information; hereinafter the same applies in the following paragraph and paragraph (3)this Article) to a third party.

The provisions of Articles 23 through 25, Article 40, and paragraphs (7) and (8) of the preceding Article apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information(limited to those compiled in a pseudonymized personal information database or the equivalent) by a business handling pseudonymized personal information, and the provisions of Article 40 apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information, respectively. In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking"; and the term "not" in Article 41, paragraph (7) is replaced with "neither acquire deleted or other related information, nor".

The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling pseudonymized personal information, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

When preparing anonymized personal information (limited to those compiled in an anonymized personal information database or the equivalent; hereinafter the same applies in this Chapter and Chapter VI(excluding paragraph (6) of this Article, Article 46, Article 46-2, and Article 54, paragraph (1))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual and restore the information to its original state.

Businesses handling anonymized personal information, before providing anonymized personal information (excluding those into which they have processed personal information themselves; hereinafter the same applies in this SectionArticle through Article 46) to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information it will provide to the third party, and the means of providing this, and state to the third party explicitly that the information it will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling anonymized personal information, of anonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

A corporation (or an organization without legal personality that has made provisions for a representative or manager; the same applies in item (iii), (b) of the following Article) seeking to perform services as set forth in one of the following items with the aim of ensuring that a business handling personal information, pseudonymized personal information, or anonymizedor other related information (excluding a business handling information related to personal information (; hereinafter referred to as "personal or other related information" in this Chapter) (the business in question is hereinafter referred to as a "business handling personal or other related information" in this Chapter) handles the personal informationthe same applies in this Section) handles the personal or other related information (limited, in the case of information related to personal information, to that which constitutes sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis; hereinafter the same applies in this Section) properly may receive certification from the Personal Information Protection Commission:

In order to ensure the proper handling of personal or other related information by its covered businesses, a certified personal information protection organization must endeavor to create guidelines which follow the spirit of this Act (hereinafter referred to as "personal information protection guidelines" in this Section and Chapter VI), for how to specify the purpose of use of personal information, for measures to ensure its secure management, for procedures to deal with requests for disclosure or other handling, for other such matters, how to conduct statistical compilation or similar analysis concerning sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, and the security measures for that information and other such matters, as well as how to produce pseudonymized processedpersonal information or anonymized personal information, and its security measures and other such matters, by listening to the opinions of representatives of customers or other relevant persons.

The provisions of this Chapter do not apply to a business handling personal or other related information or business handling information related to personal information as set forth in one of the following items if all or part of the purpose for which it handles the information in questionpersonal or other related information is the purpose prescribed in that item:

A business handling personal or other related information (excluding a business handling information related to personal information) as set forth in one of the items of paragraph (1) must, itself, endeavor to take the necessary and appropriate measures for managing the security of personal data, pseudonymized personal information or anonymized personal information, and the necessary measures for processing complaints about the handling of personal or other related informationsensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, provided personal data, etc. for statistical compilation or similar analysis, pseudonymized personal information or anonymized personal information, and the necessary measures for processing complaints about the handling of personal or other related information (limited, in the case of information related to personal information, to that which constitutes sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis; hereinafter the same applies in this paragraph) and for otherwise ensuring the proper handling of personal or other related information and must also endeavor to disclose the content of those measures.

(Exception to Application) for Corporations, etc. Set Forth in Appended Table 2

a local government organ: operation of a hospital , a clinic prescribed in Article 1-5, paragraph (1)(2) of the Medical Care Act (Act No. 205 of 1948) (referred to as a "hospital" in the following item), a clinic prescribed in paragraph (2) of that Article, , and aan university prescribed in Article 1 of the School Education Act (Act No. 26 of 1947);