Act on the Protection of Personal Information

Except in cases based on laws and regulations, businesses handling pseudonymized personal information must not provide pseudonymized personal information (excluding those that constitute personal information; hereinafter the same applies in the following paragraph and paragraph (3)this Article) to a third party.

The provisions of Articles 23 through 25, Article 40, and paragraphs (7) and (8) of the preceding Article apply mutatis mutandis to the handling of pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent) by a business handling pseudonymized personal information, and the provisions of Article 40 apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information, respectively. In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking"; and the term "not" in Article 41, paragraph (7) is replaced with "neither acquire deleted or other related information, nor".

The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling pseudonymized personal information, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

When preparing anonymized personal information (limited to those compiled in an anonymized personal information database or the equivalent; hereinafter the same applies in this Chapter (excluding paragraph (6) of this Article, Article 46, Article 46-2, and Chapter VIArticle 54, paragraph (1))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual and restore the information to its original state.

Businesses handling anonymized personal information, before providing anonymized personal information (excluding those into which they have processed personal information themselves; hereinafter the same applies in this SectionArticle through Article 46) to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information it will provide to the third party, and the means of providing this, and state to the third party explicitly that the information it will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling anonymized personal information, of anonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

A corporation (or an organization without legal personality that has made provisions for a representative or manager; the same applies in item (iii), (b) of the following Article) seeking to perform services as set forth in one of the following items with the aim of ensuring that a business handling personal or other related information, pseudonymized personal (excluding a business handling information, or anonymized related to personal information (; hereinafter referred to as "the same applies in this Section) handles the personal or other related information" in this Chapter) ( (limited, in the business in question is hereinafter referred case of information related to personal information, to as a "business handlingthat which constitutes sensitive personal information, etc. for statistical compilation or other related similar analysis, provided personal information" in this Chapter) handles the , etc. for statistical compilation or similar analysis, and provided personal informationdata, etc. for statistical compilation or similar analysis; hereinafter the same applies in this Section) properly may receive certification from the Personal Information Protection Commission:

In order to ensure the proper handling of personal or other related information by its covered businesses, a certified personal information protection organization must endeavor to create guidelines which follow the spirit of this Act (hereinafter referred to as "personal information protection guidelines" in this Section and Chapter VI), for how to specify the purpose of use of personal information, for measures to ensure its secure management, for procedures to deal with requests for disclosure or other handling, for other such matters, how to conduct statistical compilation or similar analysis concerning sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, and the security measures for that information and other such matters, as well as how to produce pseudonymized processedpersonal information or anonymized personal information, and its security measures and other such matters, by listening to the opinions of representatives of customers or other relevant persons.

The provisions of this the preceding Chapter do not apply to a business handling personal or other related information or business handling information related to personal information as set forth in one of the following items if all or part of the purpose for which it handles the information in question is the purpose prescribed in that item:

A business handling personal or other related information (excluding a business handling information related to personal information) as set forth in one of the items of paragraph (1) must, itself, endeavor to take the necessary and appropriate measures for managing the security of personal data, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, provided personal data, etc. for statistical compilation or similar analysis, pseudonymized personal information or anonymized personal information, and the necessary measures for processing complaints about the handling of personal or other related information (limited, in the case of information related to personal information, to that which constitutes sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis; hereinafter the same applies in this paragraph) and for otherwise ensuring the proper handling of personal or other related information and must also endeavor to disclose the content of those measures.

(Exception to Application) for Corporations, etc. Set Forth in Appended Table 2

a local government organ: operation of a hospital , a clinic prescribed in Article 1-5, paragraph (12) of the Medical Care Act (Act No. 205 of 1948) (referred to as a "hospital" in the following item), a clinic prescribed in paragraph (2) of that Article, , and aan university prescribed in Article 1 of the School Education Act (Act No. 26 of 1947);

With regard to the handling of personal or other related information (referred to as "entrusted personal or other related information" in items (i) and (ii)) by a business handling personal or other related information that has been entrusted with all or part of the handling of the personal or other related information by another business handling personal or other related information or by an administrative entity (hereinafter referred to as an "entrusted business handling personal or other related information" in this Article), if the matters set forth in the following items are stipulated, pursuant to Order of the Personal Information Protection Commission, in the contract for the entrustment between that other business handling personal or other related information or administrative entity (referred to as the "entrustor" in item (ii)) and the entrusted business handling personal or other related information, and the handling is carried out in accordance with the provisions of the contract concerning the matters set forth in item (i) within the scope necessary for managing the entrusted services, the provisions of Sections 2 through 4 (excluding Articles 23 through 26, Article 30-2, paragraph (14), Article 30-3, Article 31-3, paragraph (10), Article 40-2, paragraph (1), Article 41, paragraphs (2) and (9), Article 42, paragraph (3), Article 43, paragraphs (2) and (6), and Article 46) and paragraph (1) of the following Article do not apply; and for the purpose of applying the provisions of Article 30-2, paragraph (14), Article 31-3, paragraph (10), Article 41, paragraph (9), Article 42, paragraph (3), Article 43, paragraph (6), and Article 46, the phrase "までの規定は" (the provisions of Articles 23 through 25) in Article 30-2, paragraph (14) and Article 31-3, paragraph (10) is deemed to be replaced with "までの規定は、" (the provisions of Articles 23 through 25, followed by a reading comma); the phrase "by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling personal information provides sensitive personal information, etc. for statistical compilation or similar analysis (limited to that which constitutes information related to personal information prescribed in Article 31, paragraph (1)) to a special-provision recipient of personal information pursuant to the main clause of paragraph (5) (limited to cases in which the special-provision recipient of personal information is expected to acquire the sensitive personal information, etc. for statistical compilation or similar analysis as personal data), respectively" in Article 30-2, paragraph (14) and the phrase "by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information to a special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1), respectively" in Article 31-3, paragraph (10) are deemed to be replaced with "by a business handling personal information"; the phrase "pseudonymized personal information, personal data that constitutes pseudonymized personal information, and personal data the business holds that constitutes pseudonymized personal information" in Article 41, paragraph (9) is deemed to be replaced with "personal data that constitutes pseudonymized personal information", and the phrase "Article 17, paragraph (2), Article 26 and Articles 32 through 39" in that paragraph is deemed to be replaced with "Article 26"; the phrase "and paragraphs (7) and (8) of the preceding Article apply" in Article 42, paragraph (3) is deemed to be replaced with "apply", the phrase "by a business handling pseudonymized personal information, and the provisions of Article 40 apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information, respectively" in that paragraph is deemed to be replaced with "by a business handling pseudonymized personal information", and the phrase "'leaking'; and the term 'not' in Article 41, paragraph (7) is replaced with 'neither acquire deleted or other related information, nor'" in that paragraph is deemed to be replaced with "'leaking'"; and the phrase "measures for managing the security of the anonymized personal information, and the necessary measures for processing complaints about the preparation or other handling of the anonymized personal information, or for otherwise ensuring the proper handling of the anonymized personal information" in Article 43, paragraph (6) and the phrase "measures for managing the security of anonymized personal information and the necessary measures to ensure the proper handling of anonymized personal information such as processing complaints about the handling of anonymized personal information" in Article 46 are deemed to be replaced with "measures for managing the security of the anonymized personal information" and "measures for managing the security of anonymized personal information", respectively.

matters prescribed by Order of the Personal Information Protection Commission as the method of handling entrusted personal or other related information (excluding matters concerning measures for the secure management of entrusted personal or other related information and matters that are not likely to hinder the protection of individual rights and interests);

if the entrusted business handling personal or other related information learns that a situation prescribed in Article 26, paragraph (1) has arisen with regard to entrusted personal or other related information, or that entrusted personal or other related information has been handled beyond the scope necessary for managing the entrusted services or in violation of the provisions of the contract concerning the matters set forth in the preceding item, promptly reporting this to the entrustor;

other matters prescribed by Order of the Personal Information Protection Commission.

A business handling personal or other related information must, with regard to the handling of personal or other related information concerning minors, comply with the provisions of this Act, and also endeavor to take necessary measures so as not to harm the rights or interests of minors, after giving primary consideration to their best interests in accordance with their age and degree of development.

When making a request for disclosure or other handling (or, for the legal representative of the identifiable person under 16 years of age, when making a request for disclosure or other handling or giving the consent under Article 35, paragraph (9), item (i); under Article 18, paragraph (1) or (2), the part of Article 20, paragraph (2) other than the items, the part of Article 27, paragraph (1) other than the items, or Article 28, paragraph (1), as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1); or under Article 31, paragraph (1), item (i), as applied following the deemed replacement of terms pursuant to Article 35, paragraph (7), item (i) or (ii) or Article 40-2, paragraph (2)), the legal representative of the identifiable person who is a minor must give primary consideration to the best interests of that identifiable person.

"Anonymizedanonymized personal information the administrative entity holds" in this Chapter means any anonymized personal information that can be prepared in a way that processes all or a part of personal information the administrative entity holds (excluding that which constitutes sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis; the same applies in items (ii) and (iii) and Section 5) that constitutes a personal information file that falls under all of the following items (if a part of that personal information the administrative entity holds contains non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article; hereinafter the same applies in this paragraph), non-disclosure information prescribed in Article 5 of the Incorporated Administrative Agencies Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article), or non-disclosure information prescribed in the information disclosure ordinance of local government (meaning a local government's ordinance which provides for the resident's or other equivalent person's right to request the disclosure of information the local government organ or local incorporated administrative agency holds; hereinafter the same applies in this Chapter) (that non-disclosure information means information equivalent to non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act), the part containing the above-mentioned non-disclosure information is excluded):

The head of an administrative organ (for any organ designated by Cabinet Order referred to in Article 2, paragraph (89), items (v) through (vii), the head is designated for each respective organ by Cabinet Order; hereinafter the same applies in this Chapter and Article 174), a local government organ, an incorporated administrative agency or other prescribed corporation, and a local incorporated administrative agency (hereinafter referred to as an "administrative organ's head or administrative entity" in this Chapter and the following Chapter) must not utilize personal information using a method that has the possibility of fomenting or inducing unlawful or unjust act.

cases in which it is difficult to give a notification to the identifiable person, or cases prescribed by Order of the Personal Information Protection Commission as those in which there is little risk of the protection of the rights and interests of the identifiable person being impaired even if no notification is given to the identifiable person, and necessary alternative measures are taken to protect the person's rights and interests;

beyond what is set forth in the preceding three items, if the personal information the administrative entity holds is provided exclusively for statisticalthe purpose orof statistical compilation or similar analysis or for academic research purpose; provision of the information to other persons is obviously beneficial to the identifiable person; or there are other special grounds for providing that personal information.

Except in cases based on laws and regulations or set forth in Article 69, paragraph (2), item (iv), before an administrative organ's organ 's head or administrative entity provides personal information the administrative entity holds to a third party (excluding a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to the one that a business handling personal information (meaning a business handling personal information prescribed in Article 16, paragraph (2) ; the same applies in the following Article and Article 72-3, paragraphs (3) and (10)) is to take concerning the handling of personal data (meaning personal data prescribed in Article 16, paragraph (3) ; the same applies in Article 72-3, paragraph (6)) pursuant to the provisions of Section 2 of the preceding Chapter (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph and the following paragraph) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article) (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article) for any purpose other than the purpose of use, the administrative organ's head or administrative entity must acquire the identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country.

An administrative entity that has been entrusted with all or part of the handling of personal information (including entrustment via two or more layers) by a business handling personal information or by another administrative entity must not, except in cases based on laws and regulations and cases in which there is an urgent need to respond to the rescue of human life, disaster relief, or other emergency situations (referred to as "cases based on laws and regulations, etc." in Article 72-3), handle the personal information whose handling has been entrusted to it (excluding that which becomes information related to personal information for that administrative entity) beyond the scope necessary for managing the entrusted services.

With regard to the application of the provisions of Article 62, Article 68, paragraph (2), Article 69, paragraph (2), and Article 71 to the personal information of a person under 16 years of age in cases in which an administrative entity handles that personal information (excluding the cases set forth in the following items), the phrase "to that person" in Article 62 and the phrase "notify an identifiable person" in Article 68, paragraph (2) are deemed to be replaced with "to the legal representative of that person" and "notify the legal representative of the identifiable person", respectively; the phrase "to the identifiable person" in item (i) of Article 68, paragraph (2) is deemed to be replaced with "to the legal representative of the identifiable person"; in Article 69, paragraph (2), item (i), the phrase "the identifiable person's consent" is deemed to be replaced with "the consent of the legal representative of the identifiable person", and the phrase "provided to the identifiable person" is deemed to be replaced with "provided to the identifiable person or the legal representative of the identifiable person"; the term "identifiable person" in Article 71, paragraphs (1) and (2) is deemed to be replaced with "legal representative of the identifiable person"; and the term "identifiable person" in paragraph (3) of that Article is deemed to be replaced with "identifiable person or the legal representative of the identifiable person".

cases in which the administrative organ's head or administrative entity has a legitimate reason for not knowing that the personal information is that of a person under 16 years of age;

cases in which the legal representative of the identifiable person has permitted the identifiable person to carry on a business, and the administrative entity has acquired the personal information in connection with that business;

cases in which the identifiable person has no legal representative, or in which the administrative organ's head or administrative entity has reasonable grounds to believe that the identifiable person has no legal representative.

An administrative organ's head or administrative entity must not utilize contact-enabling information related to personal information using a method that has the possibility of fomenting or inducing unlawful or unjust act.

An administrative organ's head or administrative entity must not acquire contact-enabling information related to personal information by deception or other wrongful means.

An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis provided to it (including provision via two or more layers) by a special-provision acquirer of sensitive personal information must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that sensitive personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for performing the act specified in the following items in accordance with the categories of cases set forth in those items:

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates (excluding the case set forth in item (iii)): the statistical compilation or similar analysis of the disclosed content;

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), that it handles the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates for the purpose of making a provision under the main clause of paragraph (5) of that Article (excluding the case set forth in the following item): that provision;

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates, and that it handles that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5) of that Article: the statistical compilation or similar analysis of the disclosed content and that provision.

An administrative organ's head or administrative entity that has been provided with personal information pursuant to the main clause of Article 30-2, paragraph (5) must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (4), those matters after the change) for the period during which it handles the provided personal information, etc. for statistical compilation or similar analysis relating to that personal information.

The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling personal information that provided the personal information pursuant to the main clause of Article 30-2, paragraph (5) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (2) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 30-2, paragraph (5), item (i).

An administrative organ's head or administrative entity that handles provided personal information, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:

if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to a special-provision recipient of personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of personal information discloses pursuant to the provisions of paragraph (6) of that Article;

if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (2).

An administrative organ's head or administrative entity that has been provided with information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) and has acquired it as personal data must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (8), those matters after the change) for the period during which it handles the provided personal data, etc. for statistical compilation or similar analysis relating to that information related to personal information.

The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling information related to personal information prescribed in Article 16, paragraph (8) that provided the information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (6) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 31-3, paragraph (1), item (i).

An administrative organ's head or administrative entity that handles provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:

if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to a special-provision recipient of information related to personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of information related to personal information discloses pursuant to the provisions of paragraph (2) of that Article;

if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (6).

An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., provide that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis to a third party (excluding a business handling personal information, or an administrative organ's head or administrative entity, that has been entrusted with the handling of that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis).

An administrative organ's head or administrative entity must take the necessary and appropriate measures for the secure management of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, including preventing the leaking of the sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis it handles (excluding those that constitute personal information the administrative entity holds; hereinafter the same applies in this paragraph).

The provisions of paragraphs (1) and (5) and the preceding three paragraphs apply mutatis mutandis to cases in which a person that has been entrusted (including entrustment via two or more layers) with the handling of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis by an administrative organ's head or administrative entity conducts the entrusted business, and the provisions of Article 70 apply mutatis mutandis to cases in which an administrative organ's head or administrative entity provides sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis (excluding those that constitute personal information the administrative entity holds), respectively.

Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must not utilize a contact address and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or a specified correspondence delivery operator prescribed in Article 2, paragraph (9) of that Act, for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

A legal representative of a minor or adult ward, or an agent privately appointed by the identifiable person or any other agent specified by Cabinet Order (hereinafter collectively referred to as an "agent" in this Section) may make a request for disclosure (hereinafter referred to as a "request for disclosure" in this Section, Article 125-2, paragraph (2), and Article 127) provided in the preceding paragraph on behalf of that person.

An agent may make a request for correction (hereinafter referred to as a "request for correction" in this Section, Article 125-2, paragraph (2), and Article 127) as prescribed in the preceding paragraph on behalf of the identifiable person.

if the personal information the administrative entity holds is held in violation of Article 61, paragraph (2), is handled in violation of Article 63, Article 71-2, or Article 72-3, paragraph (1), (5), or (9), is acquired in violation of Article 64, or is used in violation of Article 69, paragraphs (1) and (2): ceasing to use or deleting that personal information;

if the personal information the administrative entity holds is provided in violation of Article 69, paragraphs (1) and (2) or, Article 71, paragraph (1):, Article 71-2, or Article 72-3, paragraph (10): ceasing to provide that personal information.

An agent may make a request for ceasing to use personal information (hereinafter referred to as a "request for ceasing to use personal information" in this Section, Article 125-2, paragraph (2), and Article 127) prescribed in the preceding paragraph on behalf of the identifiable person.

An administrative organ's head or administrative entity may prepare anonymized personal information the administrative entity holds (limited to information constituting anonymized personal information files the administrative entity holds; hereinafter the same applies in this Section (excluding Article 121-2)) pursuant to the provisions of this Section.

An administrative organ's head or administrative entity must take necessary measures for proper management of the anonymized personal information the administrative entity holds, deleted information prescribed in Article 109, paragraph (4), and information on the method of the processing as performed under Article 116, paragraph (1) (hereinafter referred to as "anonymized personal information and other related information of an administrative entity" in this Article and the following Article 122), in accordance with the criteria specified by Order of the Personal Information Protection Commission as necessary for preventing the leaking of anonymized personal information and other related information of an administrative entity.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of anonymized personal information the administrative entity holds that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified), and to the handling of that anonymized personal information the administrative entity holds in cases in which a person that has been entrusted (including entrustment via two or more layers) by an administrative entity with the handling of that anonymized personal information the administrative entity holds conducts the entrusted business.

An employee or former employee of an administrative entity handling anonymized personal information and other related information of the administrative entity, a person engaged in or formerly engaged in the entrusted activities referred to in Article 121, paragraph (3) of the preceding Article, or a staffing agencydispatched worker or former staffing agency worker that handlesthat is or was engaged in handling anonymized personal information and other related information of an administrative entity must not disclose anonymized personal information and other related information of an administrative entity acquired in the course of that person's work to other persons without reason, or use that information for an unjust purpose.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of anonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

To apply the provisions of Article 98 to a person set forth in one of the items of paragraph (1) and (2) of Article 58 (limited to cases in which business prescribed in one of the items of that paragraph is conducted), the phrase "is held in violation of Article 61, paragraph (2), is handled in violation of Article 63, Article 71-2, or Article 72-3, paragraph (1), (5), or (9), is acquired in violation of Article 64, or is used in violation of Article 69, paragraphs (1) and (2)" in paragraph (1), item (i) of that Article is deemed to be replaced with "is held in violation of Article 18 , Article 19, Article 30-2, paragraph (4) or (9), Article 1930-3, or Article 31-3, paragraph (5), or is obtained in violation of Article 20"; and the term "Article 69, paragraphparagraphs (1) and (2) or, Article 71, paragraph (1), Article 71-2, or Article 72-3, paragraph (10)" in item (ii) of that paragraph is deemed to be replaced with "Article 27, paragraph (1) , Article 28, Article 30-2, paragraph (10) or (11), or Article 2831-3, paragraph (6) or (7)".

When handling personal or other related information concerning minors, an administrative organ's head or administrative entity must endeavor to take necessary measures so as not to harm the rights or interests of minors, after giving primary consideration to their best interests in accordance with their age and degree of development.

When making a request for disclosure, a request for correction, or a request for ceasing to use personal information (or, for the legal representative of the identifiable person under 16 years of age, when making a request for disclosure, a request for correction, or a request for ceasing to use personal information, or giving the consent under Article 69, paragraph (2), item (i) or Article 71, paragraph (1), as applied following the deemed replacement of terms pursuant to Article 71-3), the legal representative of the identifiable person who is a minor must give primary consideration to the best interests of that identifiable person.