Act on the Protection of Personal Information

With regard to the handling of personal or other related information (referred to as "entrusted personal or other related information" in items (i) and (ii)) by a business handling personal or other related information that has been entrusted with all or part of the handling of the personal or other related information by another business handling personal or other related information or by an administrative entity (hereinafter referred to as an "entrusted business handling personal or other related information" in this Article), if the matters set forth in the following items are stipulated, pursuant to Order of the Personal Information Protection Commission, in the contract for the entrustment between that other business handling personal or other related information or administrative entity (referred to as the "entrusting party" in item (ii)) and the entrusted business handling personal or other related information, and the handling is carried out in accordance with the provisions of the contract concerning the matters set forth in item (i) within the scope necessary for managing the entrusted services, the provisions of Sections 2 through 4 (excluding Articles 23 through 26, Article 30-2, paragraph (14), Article 30-3, Article 31-3, paragraph (10), Article 40-2, paragraph (1), Article 41, paragraphs (2) and (9), Article 42, paragraph (3), Article 43, paragraphs (2) and (6), and Article 46) and paragraph (1) of the following Article do not apply; and for the purpose of applying the provisions of Article 30-2, paragraph (14), Article 31-3, paragraph (10), Article 41, paragraph (9), Article 42, paragraph (3), Article 43, paragraph (6), and Article 46, the phrase "までの規定は" (the provisions of Articles 23 through 25) in Article 30-2, paragraph (14) and Article 31-3, paragraph (10) is deemed to be replaced with "までの規定は、" (the provisions of Articles 23 through 25, followed by a reading comma); the phrase "by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling personal information provides sensitive personal information, etc. for statistical compilation or similar analysis (limited to that which constitutes information related to personal information prescribed in Article 31, paragraph (1)) to a special-provision recipient of personal information pursuant to the main clause of paragraph (5) (limited to cases in which it is assumed that the special-provision recipient of personal information acquires that sensitive personal information, etc. for statistical compilation or similar analysis as personal data), respectively" in Article 30-2, paragraph (14) and the phrase "by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information to a special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1), respectively" in Article 31-3, paragraph (10) are deemed to be replaced with "by a business handling personal information"; the phrase "pseudonymized personal information, personal data that constitutes pseudonymized personal information, and personal data the business holds that constitutes pseudonymized personal information" in Article 41, paragraph (9) is deemed to be replaced with "personal data that constitutes pseudonymized personal information", and the phrase "Article 17, paragraph (2), Article 26 and Articles 32 through 39" in that paragraph is deemed to be replaced with "Article 26"; the phrase "and paragraphs (7) and (8) of the preceding Article apply" in Article 42, paragraph (3) is deemed to be replaced with "apply", the phrase "by a business handling pseudonymized personal information, and the provisions of Article 40 apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information, respectively" in that paragraph is deemed to be replaced with "by a business handling pseudonymized personal information", and the phrase "'leaking'; and the term 'not' in Article 41, paragraph (7) is replaced with 'neither acquire deleted or other related information, nor'" in that paragraph is deemed to be replaced with "'leaking'"; and the phrase "measures for managing the security of the anonymized personal information, and the necessary measures for processing complaints about the preparation or other handling of the anonymized personal information, or for otherwise ensuring the proper handling of the anonymized personal information" in Article 43, paragraph (6) and the phrase "measures for managing the security of anonymized personal information and the necessary measures to ensure the proper handling of anonymized personal information such as processing complaints about the handling of anonymized personal information" in Article 46 are deemed to be replaced with "measures for managing the security of the anonymized personal information" and "measures for managing the security of anonymized personal information", respectively.

matters prescribed by Order of the Personal Information Protection Commission as the method of handling entrusted personal or other related information (excluding matters concerning measures for the secure management of entrusted personal or other related information and matters that are not likely to hinder the protection of individual rights and interests);

if the entrusted business handling personal or other related information learns that a situation prescribed in Article 26, paragraph (1) has arisen with regard to entrusted personal or other related information, or that entrusted personal or other related information has been handled beyond the scope necessary for managing the entrusted services or in violation of the provisions of the contract concerning the matters set forth in the preceding item, promptly reporting this to the entrusting party;

other matters prescribed by Order of the Personal Information Protection Commission.

A business handling personal or other related information must, with regard to the handling of personal or other related information concerning minors, comply with the provisions of this Act, and also endeavor to take necessary measures so as not to harm the rights or interests of minors, after giving primary consideration to their best interests in accordance with their age and degree of development.

When making a request for disclosure or other handling (or, for the legal representative of the identifiable person under 16 years of age, when making a request for disclosure or other handling or giving the consent under Article 35, paragraph (9), item (i); under Article 18, paragraph (1) or (2), the part of Article 20, paragraph (2) other than the items, the part of Article 27, paragraph (1) other than the items, or Article 28, paragraph (1), as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1); or under Article 31, paragraph (1), item (i), as applied following the deemed replacement of terms pursuant to Article 35, paragraph (7), item (i) or (ii) or Article 40-2, paragraph (2)), the legal representative of the identifiable person who is a minor must give primary consideration to the best interests of that identifiable person.

"Anonymizedanonymized personal information the administrative entity holds" in this Chapter means any anonymized personal information that can be prepared in a way that processes all or a part of personal information the administrative entity holds (excluding that which constitutes sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis; the same applies in items (ii) and (iii) and Section 5) that constitutes a personal information file that falls under all of the following items (if a part of that personal information the administrative entity holds contains non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article; hereinafter the same applies in this paragraph), non-disclosure information prescribed in Article 5 of the Incorporated Administrative Agencies Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article), or non-disclosure information prescribed in the information disclosure ordinance of local government (meaning a local government's ordinance which provides for the resident's or other equivalent person's right to request the disclosure of information the local government organ or local incorporated administrative agency holds; hereinafter the same applies in this Chapter) (that non-disclosure information means information equivalent to non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act), the part containing the above-mentioned non-disclosure information is excluded):

The head of an administrative organ (for any organ designated by Cabinet Order referred to in Article 2, paragraph (8)(9), items (v) through (vii), the head is designated for each respective organ by Cabinet Order; hereinafter the same applies in this Chapter and Article 174), a local government organ, an incorporated administrative agency or other prescribed corporation, and a local incorporated administrative agency (hereinafter referred to as an "administrative organ's head or administrative entity" in this Chapter and the following Chapter) must not utilize personal information using a method that has the possibility of fomenting or inducing unlawful or unjust act.

cases in which it is difficult to give a notification to the identifiable person, or cases prescribed by Order of the Personal Information Protection Commission as those in which there is little risk of the protection of the rights and interests of the identifiable person being impaired even if no notification is given to the identifiable person, and necessary alternative measures are taken to protect the person's rights and interests;

beyond what is set forth in the preceding three items, if the personal information the administrative entity holds is provided exclusively for statistical purpose orthe purpose of statistical compilation or similar analysis or for academic research purpose; provision of the information to other persons is obviously beneficial to the identifiable person; or there are other special grounds for providing that personal information.

Except in cases based on laws and regulations or set forth in Article 69, paragraph (2), item (iv), before an administrative organ's organ 's head or administrative entity provides personal information the administrative entity holds to a third party (excluding a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to the one that a business handling personal information prescribed in Article 16, paragraph (2) (meaning a business handling personal information prescribed in Article 16, paragraph (2); the same applies in the following Article and Article 72-3, paragraphs (3) and (10)) is to take concerning the handling of personal data (meaning personal data prescribed in Article 16, paragraph (3) ; the same applies in Article 72-3, paragraph (6)) pursuant to the provisions of Section 2 of the preceding Chapter (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph and the following paragraph) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article) (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article) for any purpose other than the purpose of use, the administrative organ's head or administrative entity must acquire the identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country.

An administrative entity that has been entrusted with all or part of the handling of personal information (including entrustment via two or more layers) by a business handling personal information or by another administrative entity must not, except in cases based on laws and regulations and cases in which there is an urgent need to respond to the rescue of human life, disaster relief, or other emergency situations (referred to as "cases based on laws and regulations, etc." in Article 72-3), handle the personal information whose handling has been entrusted to it (excluding that which becomes information related to personal information for that administrative entity) beyond the scope necessary for managing the entrusted services.

With regard to the application of the provisions of Article 62, Article 68, paragraph (2), Article 69, paragraph (2), and Article 71 to the personal information of a person under 16 years of age in cases in which an administrative entity handles that personal information (excluding the cases set forth in the following items), the phrase "to that person" in Article 62 and the phrase "notify an identifiable person" in Article 68, paragraph (2) are deemed to be replaced with "to the legal representative of that person" and "notify the legal representative of the identifiable person", respectively; the phrase "to the identifiable person" in item (i) of Article 68, paragraph (2) is deemed to be replaced with "to the legal representative of the identifiable person"; in Article 69, paragraph (2), item (i), the phrase "the identifiable person's consent" is deemed to be replaced with "the consent of the legal representative of the identifiable person", and the phrase "provided to the identifiable person" is deemed to be replaced with "provided to the identifiable person or the legal representative of the identifiable person"; the term "identifiable person" in Article 71, paragraphs (1) and (2) is deemed to be replaced with "legal representative of the identifiable person"; and the term "identifiable person" in paragraph (3) of that Article is deemed to be replaced with "identifiable person or the legal representative of the identifiable person".

cases in which the administrative organ's head or administrative entity has a legitimate reason for not knowing that the personal information is that of a person under 16 years of age;

cases in which the legal representative of the identifiable person has permitted the identifiable person to carry on a business, and the administrative entity has acquired the personal information in connection with that business;

cases in which the identifiable person has no legal representative, or in which the administrative organ's head or administrative entity has reasonable grounds to believe that the identifiable person has no legal representative.

An administrative organ's head or administrative entity must not utilize contact-enabling information related to personal information using a method that has the possibility of fomenting or inducing unlawful or unjust act.

An administrative organ's head or administrative entity must not acquire contact-enabling information related to personal information by deception or other wrongful means.

An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis provided to it (including provision via two or more layers) by a special-provision acquirer of sensitive personal information must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that sensitive personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for performing the act specified in the following items in accordance with the categories of cases set forth in those items:

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates (excluding the case set forth in item (iii)): the statistical compilation or similar analysis of the disclosed content;

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), that it handles the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates for the purpose of making a provision under the main clause of paragraph (5) of that Article (excluding the case set forth in the following item): that provision;

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates, and that it handles that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5) of that Article: the statistical compilation or similar analysis of the disclosed content and that provision.

An administrative organ's head or administrative entity that has been provided with personal information pursuant to the main clause of Article 30-2, paragraph (5) must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (4), those matters after the change) for the period during which it handles the provided personal information, etc. for statistical compilation or similar analysis relating to that personal information.

The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling personal information that provided the personal information pursuant to the main clause of Article 30-2, paragraph (5) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (2) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 30-2, paragraph (5), item (i).

An administrative organ's head or administrative entity that handles provided personal information, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:

if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to a special-provision recipient of personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of personal information discloses pursuant to the provisions of paragraph (6) of that Article;

if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (2).

An administrative organ's head or administrative entity that has been provided with information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) and has acquired it as personal data must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (8), those matters after the change) for the period during which it handles the provided personal data, etc. for statistical compilation or similar analysis relating to that information related to personal information.

The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling information related to personal information prescribed in Article 16, paragraph (8) that provided the information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (6) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 31-3, paragraph (1), item (i).

An administrative organ's head or administrative entity that handles provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:

if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to a special-provision recipient of information related to personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of information related to personal information discloses pursuant to the provisions of paragraph (2) of that Article;

if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (6).

An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., provide that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis to a third party (excluding a business handling personal information, or an administrative organ's head or administrative entity, that has been entrusted with the handling of that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis).

An administrative organ's head or administrative entity must take the necessary and appropriate measures for the secure management of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, including preventing the leaking of the sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis it handles (excluding those that constitute personal information the administrative entity holds; hereinafter the same applies in this paragraph).

The provisions of paragraphs (1) and (5) and the preceding three paragraphs apply mutatis mutandis to cases in which a person that has been entrusted (including entrustment via two or more layers) with the handling of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis by an administrative organ's head or administrative entity conducts the entrusted business, and the provisions of Article 70 apply mutatis mutandis to cases in which an administrative organ's head or administrative entity provides sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis (excluding those that constitute personal information the administrative entity holds), respectively.

Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must not utilize a contact address and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or a specified correspondence delivery operator prescribed in Article 2, paragraph (9) of that Act, for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

A legal representative of a minor or adult ward, or an agent privately appointed by the identifiable person or any other agent specified by Cabinet Order (hereinafter collectively referred to as an "agent" in this Section) may make a request for disclosure (hereinafter referred to as a "request for disclosure" in this Section, Article 125-2, paragraph (2), and Article 127) provided in the preceding paragraph on behalf of that person.

An agent may make a request for correction (hereinafter referred to as a "request for correction" in this Section, Article 125-2, paragraph (2), and Article 127) as prescribed in the preceding paragraph on behalf of the identifiable person.

if the personal information the administrative entity holds is held in violation of Article 61, paragraph (2), is handled in violation of Article 63, Article 71-2, or Article 72-3, paragraph (1), (5), or (9), is acquired in violation of Article 64, or is used in violation of Article 69, paragraphs (1) and (2): ceasing to use or deleting that personal information;

if the personal information the administrative entity holds is provided in violation of Article 69, paragraphs (1) and (2) or, Article 71, paragraph (1):, Article 71-2, or Article 72-3, paragraph (10): ceasing to provide that personal information.

An agent may make a request for ceasing to use personal information (hereinafter referred to as a "request for ceasing to use personal information" in this Section, Article 125-2, paragraph (2), and Article 127) prescribed in the preceding paragraph on behalf of the identifiable person.

An administrative organ's head or administrative entity may prepare anonymized personal information the administrative entity holds (limited to information constituting anonymized personal information files the administrative entity holds; hereinafter the same applies in this Section (excluding Article 121-2)) pursuant to the provisions of this Section.

An administrative organ's head or administrative entity must take necessary measures for proper management of the anonymized personal information the administrative entity holds, deleted information prescribed in Article 109, paragraph (4), and information on the method of the processing as performed under Article 116, paragraph (1) (hereinafter referred to as "anonymized personal information and other related information of an administrative entity" in this Article and the following Article 122), in accordance with the criteria specified by Order of the Personal Information Protection Commission as necessary for preventing the leaking of anonymized personal information and other related information of an administrative entity.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of anonymized personal information the administrative entity holds that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified), and to the handling of that anonymized personal information the administrative entity holds in cases in which a person that has been entrusted (including entrustment via two or more layers) by an administrative entity with the handling of that anonymized personal information the administrative entity holds conducts the entrusted business.

An employee or former employee of an administrative entity handling anonymized personal information and other related information of the administrative entity, a person engaged in or formerly engaged in the entrusted activities referred to in paragraph (3) of the preceding Article, or a staffing agency worker or former staffing agency worker that handlesArticle 121, paragraph (3), or a dispatched worker that is or was engaged in handling anonymized personal information and other related information of an administrative entity must not disclose anonymized personal information and other related information of an administrative entity acquired in the course of that person's work to other persons without reason, or use that information for an unjust purpose.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of anonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

To apply the provisions of Article 98 to a person set forth in one of the items of paragraph (1) and (2) of Article 58 (limited to cases in which business prescribed in one of the items of that paragraph is conducted), the phrase "is held in violation of Article 61, paragraph (2), is handled in violation of Article 63, Article 71-2, or Article 72-3, paragraph (1), (5), or (9), is acquired in violation of Article 64, or is used in violation of Article 69, paragraphs (1) and (2)" in paragraph (1), item (i) of that Article is deemed to be replaced with "is held in violation of Article 18 or , Article 19, Article 30-2, paragraph (4) or (9), Article 1930-3, or Article 31-3, paragraph (5), or is obtained in violation of Article 20"; and the term "Article 69, paragraphparagraphs (1) and (2) or, Article 71, paragraph (1), Article 71-2, or Article 72-3, paragraph (10)" in item (ii) of that paragraph is deemed to be replaced with "Article 27, paragraph (1) or Article 28, Article 28, Article 30-2, paragraph (10) or (11), or Article 31-3, paragraph (6) or (7)".

When handling personal or other related information concerning minors, an administrative organ's head or administrative entity must endeavor to take necessary measures so as not to harm the rights or interests of minors, after giving primary consideration to their best interests in accordance with their age and degree of development.

When making a request for disclosure, a request for correction, or a request for ceasing to use personal information (or, for the legal representative of the identifiable person under 16 years of age, when making a request for disclosure, a request for correction, or a request for ceasing to use personal information, or giving the consent under Article 69, paragraph (2), item (i) or Article 71, paragraph (1), as applied following the deemed replacement of terms pursuant to Article 71-3), the legal representative of the identifiable person who is a minor must give primary consideration to the best interests of that identifiable person.

An administrative organ's head or administrative entity must endeavor to properly and expeditiously process a complaint on the handling of personal information, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, provided personal data, etc. for statistical compilation or similar analysis, pseudonymized personal information or anonymized personal information in that administrative entity.

affairs (excluding those set forth in item (iv)) related to supervision of the handling of personal information , sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis by a business handling personal information, the handling of pseudonymized personal information by a business handling personal information or a business handling pseudonymized personal information, the handling of anonymized personal information by a business handling personal information or a business handling anonymized personal information, the handling of information related to personal information by a business handling information related to personal information; affairs related to monitoring over the handling of personal information, pseudonymized personal information, anonymized personal information and information related to personal or other related information by an administrative entity; affairs related to necessary mediation on a lodged complaint related to the handling of personal information, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, provided personal data, etc. for statistical compilation or similar analysis, pseudonymized personal information and anonymized personal information; and affairs related to cooperation with a business that deals with that complaint;

Division 1 Reports and On-Site Inspections

(Reports and On-Site Inspections)

No English for the amended wording yet.

The Commission may require a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, a business handling information related to personal information (hereinafter referred to as a "business handling personal or other related information" in this Subsection), or other concerned person to submit necessary information or material relating to the handling of personal information, pseudonymized personal information, anonymized personal information, or information related to personal information (hereinafter referred to as "personal or other related information" in this Subsection and Subsection 3)or other related information or other necessary matters, or have its officials enter a business office or other necessary place of a business handling personal or other related information or other concerned person, inquire about the handling of personal or other related information or other necessary matters, or inspect a book, document, or other item, to the extent necessary to implement the provisions of Chapter IV (excluding Section 5; the same applies in the following Article and Article 151) and this Subsection.

Division 2 Orders for Measures, etc.