Act on the Protection of Personal Information

"Administrative organContact-enabling information related to personal information" in this Act means information related to personal information that contains any of the following identifiers or the equivalent (including information that can be readily collated with other information and thereby enables any of the following identifiers or the equivalent to be identified):

organs within the Cabinet (excluding the address of a residence, place of work or any other place where a specific individual is or was located (limited to one that can be used for sending to a specific individual by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Cabinet Office Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) (referred to as "correspondence delivery" in Article 41, paragraph (8) and the Disaster Management Agency) Article 73, paragraph (4)) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or under the jurisdiction a specified correspondence delivery operator prescribed in paragraph (9) of the Cabinet which are established pursuantthat Article, for delivering a telegram to the provisions of lawsa specific individual, or for visiting a specific individual);

the Cabinet Office, the Imperial Household Agency, and organs prescribed in Article 49, paragraphs (1) and (2) of the Act for Establishment of the Cabinet Office (Act No. 89 of 1999) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (v) is established, that organ designated by Cabinet Order is excludeda telephone number (limited to one that can be used for telephoning a specific individual or for transmitting information to a specific individual using a facsimile machine);

an email address (meaning an email address prescribed in Article 2, item (iii) of the Disaster Management Agency (excluding facilities and other organs designated by Cabinet Order as Act on Regulation of Transmission of Specified Electronic Mail (Act No. 26 of 2002), limited to one that can be used for sending electronic mail prescribed in item (vi)i) of that Article to a specific individual);

organs a code assigned so as to enable the identification of a person using telecommunications facilities (meaning telecommunications facilities prescribed in Article 3, paragraph (22, item (ii) of the National Government OrganizationTelecommunications Business Act (Act No. 12086 of 1948) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (vii) is established, that organ designated 1984); the same applies hereinafter in this item) or of telecommunications facilities (limited to one that can be used for communicating information to a specific individual by Cabinet Order is excludedmeans of telecommunications (meaning telecommunications prescribed in item (i) of that Article));

organs referred to in Articles 39 and 55 of the Act for Establishment of the Cabinet Office andbeyond what is set forth in Article 16, paragraph (2) of the Imperial Household Agency Act (Act No. 70 of 1947), and extraordinary organs referred to in Articles 40 and 56preceding items, identifiers or the equivalent prescribed by Order of the Act for Establishment of the Cabinet Office (includingPersonal Information Protection Commission as applied mutatis mutandis pursuant to Article 18, paragraph (1) of the Imperial Household Agency Act), that are designated by Cabinet Order;those that can be used for contacting a specific individual or otherwise communicating information to a specific individual.

"Incorporated administrative agency or other prescribed corporationorgan" in this Act means an incorporated administrative agency as prescribed in Article 2, paragraph (1) of the Act on General Rules for Incorporated Administrative Agency (Act No. 103 of 1999) and the corporation listed in the Appended Table 1.following:

organs within the Cabinet (excluding the Cabinet Office and the Disaster Management Agency) or under the jurisdiction of the Cabinet which are established pursuant to the provisions of laws;

the Cabinet Office, the Imperial Household Agency, and organs prescribed in Article 49, paragraphs (1) and (2) of the Act for Establishment of the Cabinet Office (Act No. 89 of 1999) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (v) is established, that organ designated by Cabinet Order is excluded);

the Disaster Management Agency (excluding facilities and other organs designated by Cabinet Order as prescribed in item (vi));

organs prescribed in Article 3, paragraph (2) of the National Government Organization Act (Act No. 120 of 1948) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (vii) is established, that organ designated by Cabinet Order is excluded);

organs referred to in Articles 39 and 55 of the Act for Establishment of the Cabinet Office and in Article 16, paragraph (2) of the Imperial Household Agency Act (Act No. 70 of 1947), and extraordinary organs referred to in Articles 40 and 56 of the Act for Establishment of the Cabinet Office (including as applied mutatis mutandis pursuant to Article 18, paragraph (1) of the Imperial Household Agency Act), that are designated by Cabinet Order;

facilities and other organs referred to in Article 15 of the Act for Establishment of the Disaster Management Agency (Act No. 61 of 2026) that are designated by Cabinet Order;

facilities and other organs referred to in Article 8-2 of the National Government Organization Act, and extraordinary organs referred to in Article 8-3 of that Act, that are designated by Cabinet Order;

the Board of Audit.

"Local incorporatedIncorporated administrative agency or other prescribed corporation" in this Act means a localan incorporated administrative agency as prescribed in Article 2, paragraph (1) of the Local Act on General Rules for Incorporated Administrative Agency ActAgencies (Act No. 118103 of 2003)1999) and the corporation listed in the Appended Table 1.

"Administrative entitylocal incorporated administrative agency" in this Act means a local incorporated administrative agency as prescribed in Article 2, paragraph (1) of the following organs:Local Independent Administrative Agency Act (Act No. 118 of 2003).

"administrative entity" in this Act means the following organs:

administrative organs;

local government organs (excluding assemblies; the same applies hereinafter except the following Chapter, Chapter III and Article 69, paragraph (2), item (iii));

incorporated administrative agencies or other prescribed corporations (excluding corporations listed in the Appended Table 2; the same applies in Article 16, paragraph (2), item (iii), Article 63, Article 78, paragraph (1), item (vii), (a) and (b), Article 89, paragraphs (4) through (6), Article 119, paragraphs (5) through (7), and Article 125, paragraph (2));

local incorporated administrative agencies (excluding those whose main purpose is providing the service listed in Article 21, item (i) of the Local Independent Administrative Agency Act, or those whose purpose is providing the service listed in item (ii) or (iii) of that Article (limited to the part relating to (h)); the same applies in Article 16, paragraph (2), item (iv), Article 63, Article 78, paragraph (1), item (vii), (a) and (b), Article 89, paragraphs (7) through (9), Article 119, paragraphs (8) through (10), and Article 125, paragraph (2)).

"Statistical compilation or similar analysis" in this Act means an act of compiling statistics or otherwise creating information on the trends or properties of a large amount of information (excluding such trend or property information that concerns individuals) by extracting information relating to the elements constituting that information from the large amount of information and conducting classification, comparison or other analysis, which is prescribed by Order of the Personal Information Protection Commission as being unlikely to harm individual rights and interests.

the basic details of the measures to protect personal information to be taken by businesses handling personal information prescribed in Article 16, paragraph (2), businesses handling pseudonymized personal information prescribed in paragraph (56) of that Article, businesses handling anonymized personal information prescribed in paragraph (67) of that Article, and certified personal information protection organizations prescribed in Article 51, paragraph (1);

"Businessbusiness handling personal information" in this Chapter and Chapters, Chapter VI throughand Chapter VIII means a person that uses a personal information database or the equivalent for business; provided, however, that this excludes persons set forth as follows:

"Business handling pseudonymizedSpecified biometric personal information" in this Chapter and Chapters VI and VII meansmeans personal information that includes a person that uses a collective body of information consisting of pseudonymized personal information for business, which specified biometric individual identification code (meaning an individual identification code falling under Article 2, paragraph (2), item (i) that has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular pseudonymized personal information (referred to as a "pseudonymized personal information database orconverted from information prescribed by Cabinet Order as information on a characteristic of a part of the body which can be acquired by a method that does not require special technology or a costly expenditure and whose acquisition the identifiable person cannot easily recognize; the equivalent" same applies in Article 4121-2, paragraph (1)); provided, however, that this excludes persons set forth in each item of, item (iv) and Article 35, paragraph (27)).

"Business handling anonymizedpseudonymized personal information" in this Chapter and ChaptersChapter VI and VII means a person that uses collective body of information consisting of anonymizedpseudonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular anonymizedpseudonymized personal information (referred to as an "anonymizeda "pseudonymized personal information database or the equivalent" in Article 4341, paragraph (1) and Article 42, paragraph (3)); provided, however, that this excludes persons set forth in each item of paragraph (2).

"Businessbusiness handling information related toanonymized personal information" in this Chapter and ChaptersChapter VI and VII means a person that uses a collective body of information consisting of information related toanonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular information related toanonymized personal information (referred to as an "database or the equivalent ofanonymized personal information related to personal informationdatabase or the equivalent" in Article 3143, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).

"Academic research institution or the equivalentBusiness handling information related to personal information" in this Chapter and Chapter VI means a university or other organization or group associated with academic studies, person that uses collective body of information consisting of information related to personal information for business, which has been systematically organized to be searchable using a computer or a person belonging is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular information related to personal information (referred to as a "database or the equivalent of information related to itpersonal information" in Article 31, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).

"academic research institution or the equivalent" in this Chapter means a university or other organization or group associated with academic studies (including a hospital prescribed in Article 1-5, paragraph (1) of the Medical Care Act (Act No. 205 of 1948) (referred to as a "hospital" in Article 58, paragraph (2)) and other organizations or groups for the purpose of providing medical care), or a person belonging to it.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling the personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal information, that handling it is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases of acquiring the sensitive personal information fromconducting academic research jointly with an academic research institution or the equivalent and it is necessary to acquire that the sensitive personal information from that academic research institution or the equivalent for academic research purposepurposes (including cases in which a part of the purpose of acquiring the sensitive personal information is for academic research purposes, excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the academic research institution or the equivalent jointly conduct academic research);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that acquiring the sensitive personal information is open to unavoidably necessary for the public by a person identifiable by that information, a national government organ, a local government, an academic research institution or performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the equivalent, a person set forth in each item of Article 57, paragraph (1), or other acquisition of the sensitive personal information, that acquiring it is not contrary to the intention of the identifiable person prescribed by Order of and therefore does not harm the Personal Information Protection Commissionperson's rights and interests;

other cases prescribed by Cabinet Order of receiving the provision pursuant to the main clause of Article 30-2, paragraph (5), or of acquiring, as equivalent sensitive personal information, information related to personal information provided pursuant to the cases set forth in each preceding item.main clause of Article 31-3, paragraph (1);

cases in which the sensitive personal information is open to the public by a person identifiable by that information, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

A business handling personal information must, when handling specified biometric personal information, notify the identifiable person of the following matters in advance, or put them in a state where the identifiable person can easily know them, as provided by Order of the Personal Information Protection Commission:

the name and address of that business handling personal information and, if it is a corporation, the name of its representative (or, for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; the same applies in Article 27, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));

the fact that specified biometric personal information will be handled;

the purpose of use of the specified biometric personal information;

the content of the information on the characteristic of a part of the body that is converted into the specified biometric individual identification code included in the specified biometric personal information;

the procedures for responding to a request for disclosure or other handling prescribed in Article 37, paragraph (1) (including the amount of the fee, if a fee is collected pursuant to the provisions of Article 38, paragraph (1));

other matters prescribed by Order of the Personal Information Protection Commission as those necessary to protect individual rights and interests.

The provisions of the preceding paragraph do not apply in the following cases:

taking the measures under the preceding paragraph is likely to harm the life, wellbeing, property, or other rights or interests of the identifiable person or a third party;

taking the measures under the preceding paragraph is likely to harm the rights or legitimate interests of the business handling personal information;

it is necessary for the business to cooperate with a national government organ or a local government in performing the functions prescribed by laws and regulations, and taking the measures under the preceding paragraph is likely to interfere with the performance of those functions;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in the preceding three items.

In cases prescribed in the preceding paragraph, businesses handling personal information (excluding those that have given a notice under the proviso of that paragraph) must notify the identifiable person of the occurrence of the situation, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply if it is difficult to notify the identifiable person of that occurrence, or in a case prescribed by Order of the Personal Information Protection Commission as one in which there is little risk of a failure to protect the identifiable person's rights and interests even if the identifiable person is not notified, and the necessary alternative measures are taken to protect that person's rights and interests.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which the business handling personal information that is an academic research institution or the equivalent conducts academic research jointly with a third party, and needs to provide the personal data to that third party for the academic research purpose (including cases in which a part of the purpose of providinghandling the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the third party jointly conduct academic research);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that providing the personal data is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal data, that providing it is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests.

Notwithstanding the provisions of the preceding paragraph, if a business handling personal information agrees to cease to provide a third party with any personal data which can be used to identify the identifiable person, at the request of that person; the business notifies that person of the following information in advance or makes that information readily accessible to that person in advance, as provided for by Order of the Personal Information Protection Commission; and the business files a notification of this to the Commission, the business may provide that personal data to a third party; provided, however, that this does not apply to cases in which personal data which is to be provided to a third party is sensitive personal information or specified biometric personal information, has been acquired in violation of the provisions of Article 20, paragraph (1), or has been provided by another business handling personal information pursuant to the provisions of the main clause of this paragraph (including personal data all or part of which has been reproduced or processed):

the name and address of a business handling personal information that provides personal information to a third party and, if it is a corporation, the name of its representative (or for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; hereinafter the same applies in this Article, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));

When providing personal data to a third party (excluding a person set forth in each item of Article 16, paragraph (2); hereinafter the same applies in this Article, Article 29, paragraph (1), and Article 30, paragraphs (1) and (2) (including as applied mutatis mutandis pursuant to Article 31, paragraph (3))) pursuant to the provisions of the main clause of paragraph (2), a business handling personal information must confirm the following matters in advance, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply in cases in which all of that personal data had been open to the public, at the time when that business handling personal information acquired that personal data, by the identifiable person, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission, or in cases prescribed by Order of the Personal Information Protection Commission as equivalent to those cases.

the name and address of the third party and, if the third party is a corporation, the name of its representative;

the purpose of use of the personal data by the third party.

A third party that has been asked by a business handling personal information to give confirmation under the preceding paragraph must not deceive that business handling personal information on a matter relating to the confirmation.

Except cases set forth in the items of paragraph (1) of the preceding Article, before businesses handling personal information provide personal data to a third party (excluding a person that establishes a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to those that a business handling personal information must take concerning the handling of personal data pursuant to the provisions of this Section (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph, the following paragraph and Article 31, paragraph (1), item (ii)) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)) () (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)Section), the businesses must obtain an identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country. In this case, the provisions of the preceding Article do not apply.

When having provided personal data to a third party (excluding a person set forth in each item of Article 16, paragraph (2); hereinafter the same applies in this Article and the following Article (including as applied mutatis mutandis pursuant to Article 31, paragraph (3) following the deemed replacement of terms)), , businesses handling personal information must prepare a record pursuant to Order of the Personal Information Protection Commission on the date of the provision of the personal data, the name of the third party, and other matters prescribed by Order of the Personal Information Protection Commission (or, in cases in which confirmation under Article 27, paragraph (7) has been given, those matters and the matters set forth in item (ii) of that paragraph); provided, however, that this does not apply to cases in which the provision of personal data falls under any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article).

Notwithstanding the provisions of Article 20, paragraph (2), if a business handling personal information needs to handle sensitive personal information that is currently open to the public for the purpose of conducting statistical compilation or similar analysis (hereinafter referred to as the "purpose of statistical compilation or similar analysis" in this paragraph, paragraph (5), and Article 31-3, paragraph (1)) or for the purpose of making a provision under the main clause of paragraph (5) (limited to cases in which the entire purpose of handling that sensitive personal information is the purpose of statistical compilation or similar analysis or the purpose of making that provision), and has disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the name of that business handling personal information, the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information it acquires or the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5), and other matters prescribed by Order of the Personal Information Protection Commission, the business may acquire that sensitive personal information currently open to the public without obtaining the consent of the identifiable person.

A business handling personal information that has acquired sensitive personal information pursuant to the provisions of the preceding paragraph (referred to as a "special-provision acquirer of sensitive personal information" in the following paragraph, paragraph (4), and Article 72-3, paragraph (1)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in the preceding paragraph, the matters prescribed in that paragraph (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in the proviso to the following paragraph, those matters as changed) for the period during which it handles that sensitive personal information or information relating to a living individual produced by reproducing or processing all or part of it.

When changing the matters it discloses to the public pursuant to the provisions of the preceding paragraph, a special-provision acquirer of sensitive personal information must disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), that fact and the content of the change; provided, however, that when changing the name of that special-provision acquirer of sensitive personal information or other matters prescribed by Order of the Personal Information Protection Commission, it is sufficient for it to disclose to the public that fact and the content of the change promptly after making the change, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1).

Notwithstanding the provisions of Article 18, a business handling personal information that handles sensitive personal information acquired pursuant to the provisions of paragraph (1) or information relating to a living individual produced by reproducing or processing all or part of it (excluding that which constitutes provided personal information, etc. for statistical compilation or similar analysis prescribed in paragraph (6); hereinafter referred to as "sensitive personal information, etc. for statistical compilation or similar analysis") must not handle that sensitive personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for performing the act specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations and in cases in which there is an urgent need to rescue human life, provide disaster relief, or respond to any other emergency situation (hereinafter referred to as "cases based on laws and regulations, etc." in this Chapter).

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates (excluding the case set forth in item (iii)): statistical compilation or similar analysis of the content so disclosed;

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the fact that it will handle the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates for the purpose of making a provision under the main clause of the following paragraph (excluding the case set forth in the following item): that provision;

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates and the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of the following paragraph: statistical compilation or similar analysis of the content so disclosed, and that provision.

Notwithstanding the provisions of Article 18 and Article 27, paragraph (1), if a third party (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity (meaning an administrative organ's head or administrative entity prescribed in Article 63; the same applies in paragraph (9), item (ii), paragraph (12), and Article 31-3, paragraph (5), item (ii) and paragraph (8)) (if that person is a person in a foreign country, limited to a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to those that a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, and a business handling information related to personal information (hereinafter referred to as a "business handling personal or other related information") must take concerning the handling of personal information, pseudonymized personal information, anonymized personal information, and information related to personal information (hereinafter referred to as "personal or other related information") pursuant to the provisions of this Chapter (those measures being referred to as "equivalent measures" in paragraph (13) and Article 31-3, paragraph (9)) (that system being referred to as a "system that conforms to standards" in paragraph (13) and Article 31-3, paragraph (9)); the same applies in paragraph (12) and Article 31-3, paragraph (8)); hereinafter the same applies in this paragraph, the following paragraph, and Article 31-3, paragraphs (1) and (2)) needs to handle personal information (including sensitive personal information, etc. for statistical compilation or similar analysis; hereinafter the same applies in this paragraph through paragraph (7), paragraph (13), and Article 72-3, paragraphs (2) and (3)) for the purpose of statistical compilation or similar analysis (limited to cases in which the entire purpose of handling that personal information is the purpose of statistical compilation or similar analysis), and the case falls under all of the following items, a business handling personal information may provide that personal information to that third party without obtaining the consent of the identifiable person; provided, however, that this does not apply if that personal information has been provided by another business handling personal information or by a business handling information related to personal information pursuant to the provisions of the main clause of this paragraph or the main clause of Article 31-3, paragraph (1) (including personal information all or part of which has been reproduced or processed).

that business handling personal information and that third party have disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the names of that business handling personal information and that third party, the content of the statistical compilation or similar analysis they intend to conduct, and other matters prescribed by Order of the Personal Information Protection Commission;

it is clearly specified by a written agreement (including an electronic or magnetic record) with that third party that the provision is made under the main clause of this paragraph.

A third party that has received a provision of personal information pursuant to the main clause of the preceding paragraph (limited to a person that is a business handling personal information; referred to as a "special-provision recipient of personal information" in this Article and Article 72-3, paragraph (5), item (i)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in item (i) of the preceding paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in paragraph (8), those matters as changed) for the period during which it handles that personal information or information relating to a living individual produced by reproducing or processing all or part of it (hereinafter referred to as "provided personal information, etc. for statistical compilation or similar analysis").

A special-provision recipient of personal information may change the matters disclosed to the public pursuant to the provisions of the preceding paragraph only if both that special-provision recipient of personal information and the business handling personal information that provided personal information to that special-provision recipient of personal information pursuant to the main clause of paragraph (5) disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (5), item (i), that those matters will be changed and the content of the change; provided, however, that this does not apply when changing the name of that special-provision recipient of personal information or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the special-provision recipient of personal information must, promptly after making the change, disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (5), item (i), that it has made the change and the content of the change.

Notwithstanding the provisions of Article 18, a business handling personal information that handles provided personal information, etc. for statistical compilation or similar analysis must not handle that provided personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations, etc.

if the provision under the main clause of paragraph (5) to which that provided personal information, etc. for statistical compilation or similar analysis relates was made to a special-provision recipient of personal information: statistical compilation or similar analysis of the content which that special-provision recipient of personal information discloses to the public pursuant to the provisions of paragraph (6);

if the provision under the main clause of paragraph (5) to which that provided personal information, etc. for statistical compilation or similar analysis relates was made to an administrative organ's head or administrative entity: statistical compilation or similar analysis of the content which that administrative organ's head or administrative entity discloses to the public pursuant to the provisions of Article 72-3, paragraph (2).

Notwithstanding the provisions of Article 27, paragraphs (1) and (2) and Article 28, paragraph (1), a business handling personal information that handles sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis must not provide personal data that constitutes that sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis to a third party, except in the following cases. In this case, the phrase "is not to fall under a third party regarding applying the provisions of each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "(limited to a person that is a business handling personal information or an administrative organ's head or administrative entity prescribed in Article 63 (limited, if such a person is a person in a foreign country prescribed in paragraph (1) of the following Article, to a person that has established a system that conforms to standards prescribed in Article 30-2, paragraph (5))) is not to fall under a third party regarding applying the provisions of Article 30-2, paragraph (10)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso to Article 29, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in Article 30-2, paragraph (4) or any of the items of Article 27, paragraph (5)"; and the phrase "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso to Article 30, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in paragraph (4) of the following Article or any of the items of Article 27, paragraph (5)".

cases based on laws and regulations, etc.;

cases in which that business handling personal information has acquired sensitive personal information pursuant to the provisions of paragraph (1) and has disclosed to the public, pursuant to the provisions of paragraph (2), the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5), and that business handling personal information provides the sensitive personal information, etc. for statistical compilation or similar analysis relating to that sensitive personal information pursuant to the main clause of paragraph (5).

Notwithstanding the provisions of Article 31, paragraph (1), a business handling personal information that handles sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis must not provide that sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (excluding those that constitute personal data; the same applies in the following paragraph) to a third party, except in the cases set forth in the items of the preceding paragraph.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving the provision of sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity). In this case, the phrase "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 30-2, paragraph (11)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; and the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public".

A business handling personal information that has provided personal information pursuant to the main clause of paragraph (5) to a third party in a foreign country that has established a system that conforms to standards, or has provided sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis to that third party, must take necessary measures to ensure continuous implementation of the equivalent measures by that third party, and disclose information on those necessary measures to the public, pursuant to Order of the Personal Information Protection Commission. In this case, the provisions of Article 28, paragraph (3) do not apply.

The provisions of Articles 23 through 25 apply mutatis mutandis to the handling of sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (excluding those that constitute personal data) by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling personal information provides sensitive personal information, etc. for statistical compilation or similar analysis (limited to that which constitutes information related to personal information prescribed in Article 31, paragraph (1)) to a special-provision recipient of personal information pursuant to the main clause of paragraph (5) (limited to cases in which it is assumed that the special-provision recipient of personal information acquires that sensitive personal information, etc. for statistical compilation or similar analysis as personal data). In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking".

A business handling personal information that has been entrusted by another business handling personal information or an administrative entity with all or part of the handling of personal information (including entrustment through two or more tiers) must not, except in cases based on laws and regulations, etc., handle the personal information whose handling it has been entrusted with (excluding that which constitutes information related to personal information for that business handling personal information) beyond the scope necessary for the performance of the entrusted services.

Except cases set forth in each item of Article 27, paragraph (1), if it is assumed that a third party acquires information related to personal information (limited to those compiled in a database or the equivalent of information related to personal information; hereinafter the same applies in this Chapterparagraph and Chapter VIthe following paragraph) as personal data, businesses handling information related to personal information must not provide the information related to personal information to the third party without confirming the matters set forth as follows pursuant to Order of the Personal Information Protection Commission:

The provisions of Article 30, paragraphs (2) through (4) of the preceding Article apply mutatis mutandis to cases in which a business handling information related to personal information conducts confirmation pursuant to the provisions of paragraph (1). In this case, the phrase "received" in paragraph (3) of the precedingthat Article is deemed to be replaced with "provided."

A business handling information related to personal information must not utilize contact-enabling information related to personal information in a way that there is a possibility of fomenting or inducing unlawful or unjust act.

A business handling information related to personal information must not acquire contact-enabling information related to personal information by deception or other wrongful means.

Notwithstanding the provisions of Article 31, paragraph (1) (limited to the part relating to item (i)), if a third party needs to handle information related to personal information for the purpose of statistical compilation or similar analysis (limited to cases in which the entire purpose of handling that information related to personal information is the purpose of statistical compilation or similar analysis), and the case falls under all of the following items, a business handling information related to personal information may provide that information related to personal information to that third party without confirming the matter set forth in Article 31, paragraph (1), item (i); provided, however, that this does not apply if that information related to personal information has been provided by a business handling personal information or by another business handling information related to personal information pursuant to the provisions of the main clause of Article 30-2, paragraph (5) or the main clause of this paragraph (including information all or part of which has been reproduced or processed).

that business handling information related to personal information and that third party have disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the names of that business handling information related to personal information and that third party, the content of the statistical compilation or similar analysis they intend to conduct, and other matters prescribed by Order of the Personal Information Protection Commission;

it is clearly specified by a written agreement (including an electronic or magnetic record) with that third party that the provision is made under the main clause of this paragraph.

A third party that has received a provision of information related to personal information pursuant to the main clause of the preceding paragraph and acquired it as personal data (limited to a person that is a business handling personal information; referred to as a "special-provision recipient of information related to personal information" in this Article and Article 72-3, paragraph (9), item (i)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in item (i) of the preceding paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in paragraph (4), those matters as changed) for the period during which it handles that information related to personal information or information relating to a living individual produced by reproducing or processing all or part of it (hereinafter referred to as "provided personal data, etc. for statistical compilation or similar analysis").

A special-provision recipient of information related to personal information may change the matters disclosed to the public pursuant to the provisions of the preceding paragraph only if both that special-provision recipient of information related to personal information and the business handling information related to personal information that provided information related to personal information to that special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1) disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that those matters will be changed and the content of the change; provided, however, that this does not apply when changing the name of that special-provision recipient of information related to personal information or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the special-provision recipient of information related to personal information must, promptly after making the change, disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that it has made the change and the content of the change.

Notwithstanding the provisions of Article 18, a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations, etc.

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to a special-provision recipient of information related to personal information: statistical compilation or similar analysis of the content which that special-provision recipient of information related to personal information discloses to the public pursuant to the provisions of paragraph (2);

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to an administrative organ's head or administrative entity: statistical compilation or similar analysis of the content which that administrative organ's head or administrative entity discloses to the public pursuant to the provisions of Article 72-3, paragraph (6).

Notwithstanding the provisions of Article 27, paragraphs (1) and (2) and Article 28, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide personal data that constitutes that provided personal data, etc. for statistical compilation or similar analysis to a third party, except in cases based on laws and regulations, etc. In this case, the phrase "is not to fall under a third party regarding applying the provisions of each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "(limited to a person that is a business handling personal information or an administrative organ's head or administrative entity prescribed in Article 63 (limited, if such a person is a person in a foreign country prescribed in paragraph (1) of the following Article, to a person that has established a system that conforms to standards prescribed in Article 30-2, paragraph (5))) is not to fall under a third party regarding applying the provisions of Article 31-3, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso to Article 29, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in Article 30-2, paragraph (4) or any of the items of Article 27, paragraph (5)"; and the phrase "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso to Article 30, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in paragraph (4) of the following Article or any of the items of Article 27, paragraph (5)".

Notwithstanding the provisions of Article 31, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide that provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data; the same applies in the following paragraph) to a third party, except in cases based on laws and regulations, etc.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving the provision of provided personal data, etc. for statistical compilation or similar analysis (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity). In this case, the phrase "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 31-3, paragraph (7)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; and the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public".

A business handling information related to personal information that has provided information related to personal information pursuant to the main clause of paragraph (1) to a third party in a foreign country that has established a system that conforms to standards, or a business handling personal information that has provided provided personal data, etc. for statistical compilation or similar analysis to that third party, must take necessary measures to ensure continuous implementation of the equivalent measures by that third party, and disclose information on those necessary measures to the public, pursuant to Order of the Personal Information Protection Commission. In this case, the provisions of Article 28, paragraph (3) do not apply.

The provisions of Articles 23 through 25 apply mutatis mutandis to the handling of provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data) by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information to a special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1). In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking".

the procedures for responding to a request under the following paragraph,for disclosure or to a request under paragraph (1) of the following Article (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (1); orother handling prescribed in Article 3537, paragraph (1), paragraph (3), or paragraph (5) ( (including the amount of the fee, if one a fee is setcollected pursuant to the provisions of Article 38, paragraph (21));

When having received a request under the preceding paragraph, a business handling personal information must disclose personal data the business holds to an identifiable person without delay by means that person requests pursuant to the provisions of that paragraph (or by paper-based document, in cases in which disclosing the data by that means would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances); provided, however, that in cases in which disclosing that data falls under any of each following, all or a part of it may not be disclosed:

Identifiable persons may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify that person (hereinafter referred to as a "ceasing to use or deleting personal data" in this Article), if the personal data the business holds is being handled in violation of the provisions of Article 18 or, Article 19, Article 30-2, paragraph (4) or (9), Article 30-3, or Article 31-3, paragraph (5), or has been obtained in violation of the provisions of Article 20.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds to the extent necessary to redress the violation without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person.

Identifiable persons may request that a business handling personal information cease to provide a third party with the personal data the business holds that can be used to identify the person, if the personal data the business holds is being provided to a third party in violation of the provisions of Article 27, paragraph (1) , Article 28, Article 30-2, paragraph (10), or Article 2831-3, paragraph (6).

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to provide a third party with the personal data the business holds without delay; provided, however, that this does not apply if ceasing to provide a third party with the personal data the business holds would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect an identifiable person's rights and interests.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds to the extent necessary to prevent an infringement of the identifiable person's rights and interests without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or prove otherwise difficultdue to other circumstances, and the businesses take the necessary alternative measures to protect the identifiable person's rights and interests.

If An identifiable person may request that a business handling personal information have ceasedcease to use or deleteddelete, or decided not to cease to use or delete all or part of personal data the business holds in connection withprovide a request under paragraph (1) or (5), or third party with, the business has ceased to provide a third party or decided not to ceasespecified biometric personal information that can be used to provide a third party with all or part ofidentify that person (limited to that included in the personal data the business holds in connection with a request under paragraph (3) or (5), the business must notify), if that specified biometric personal information is being handled, except in the identifiable person to that effect without delay.following cases:

cases in which the business handling personal information has created the specified biometric individual identification code included in that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information has acquired that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information handles that specified biometric personal information based on laws and regulations;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that specified biometric personal information in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that specified biometric personal information from that academic research institution or the equivalent, or in which a specified biometric individual identification code created by converting information that the business handling personal information conducting academic research jointly with an academic research institution or the equivalent has acquired from that academic research institution or the equivalent is included in that specified biometric personal information, and the business needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that specified biometric personal information by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the creation of the specified biometric individual identification code included in that specified biometric personal information or the circumstances of the acquisition of that specified biometric personal information, that handling it by the business handling personal information is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete that specified biometric personal information, or cease to provide it to a third party, without delay; provided, however, that this does not apply if ceasing to use or deleting that specified biometric personal information or ceasing to provide it to a third party would prove difficult because it would require a costly expenditure or due to other circumstances, and the business takes the necessary alternative measures to protect the identifiable person's rights and interests.

An identifiable person under 16 years of age may request that a business handling personal information cease to use or delete, or cease to provide a third party with, the personal data the business holds that can be used to identify that person, if that personal data the business holds is being handled, except in the following cases:

cases in which the business handling personal information has acquired that personal data the business holds with the consent of the legal representative of the identifiable person obtained in advance;

cases in which the business handling personal information handles that personal data the business holds based on laws and regulations;

cases in which the business handling personal information needs to handle that personal data the business holds in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that personal data the business holds in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that personal data the business holds in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that personal data the business holds from that academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that personal data the business holds by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal data the business holds, that handling it by the business handling personal information does not harm the rights and interests of the identifiable person under 16 years of age;

cases in which that personal data the business holds had been open to the public, at the time when the business handling personal information acquired it, by the legal representative of the identifiable person, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission;

cases in which the legal representative of the identifiable person had permitted the identifiable person to engage in business, and the business handling personal information acquired that personal data the business holds in connection with that business;

cases in which the identifiable person had used fraudulent means to make the business handling personal information believe that the identifiable person was 16 years of age or older;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or due to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person under 16 years of age.

If a business handling personal information have ceased to use or deleted, or decided not to cease to use or delete all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (1), (5), (7), or (9), or the business has ceased to provide a third party or decided not to cease to provide a third party with all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (3), (5), (7), or (9), the business must notify the identifiable person to that effect without delay.

If, pursuant to the provisions of Article 32, paragraph (3), Article 33, paragraph (3) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (3) or paragraph (711) of the preceding Article, a business handling personal information notifies an identifiable person that it will not take all or part of the measures which the person has requested the business take, or that it will take different measures, the business must endeavor to explain its reasons for this to the person.

As regards a request under Article 32, paragraph (2), or a request under Article 33, paragraph (1) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article; the same applies in paragraph (1) of the following Article and Article 39), Article 34, paragraph (1), Article 35, paragraph (1), (3), (5), (7), or (59) (hereinafter referred to as a "request for disclosure or other handling" in this Article and Article 54, paragraph (1)Chapter), a business handling personal information may decide on a method of receiving a request as prescribed by Cabinet Order. In such a case, an identifiable person must request disclosure or other handling in that way.

A business handling personal information may request an identifiable person requesting disclosure or other handling to present sufficient information to identify the personal data the business holds or the specified biometric personal information, or the record of provision to a third party, that would be subject to the disclosure or other handling. In such a case, the business handling personal information must provide information to help the person identify the relevant personal data the business holds or the relevant specified biometric personal information, or the relevant record of provision to a third party, or take other appropriate measures in consideration of the identifiable person's convenience, so as to allow the person to easily and accurately request disclosure or other handling.

A person may request disclosure legal representative of a minor or other handling throughadult ward, or an agent, as prescribed privately appointed by the identifiable person or any other agent specified by Cabinet Order may make a request for disclosure or other handling on behalf of the identifiable person.

When seeking to file a lawsuit in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), (5), (7), or (59), the identifiable person may not file the lawsuit unless the identifiable person had previously issued a request against a person who should become a defendant in the lawsuit and two weeks have elapsed since the arrival day of the issued request; provided, however, that this does not apply if the person who should become a defendant in the lawsuit has rejected the request.

The provisions of the preceding two paragraphs apply mutatis mutandis to a petition for a provisional disposition order in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), (5), (7), or (59).

A business handling personal information must endeavor to process complaints about the handling of personal information, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis appropriately and promptly.

With regard to applying the provisions of Article 18, Article 20, paragraph (2), Article 21, Article 21-2, paragraph (1), Article 26, paragraph (2), Article 27, Article 28, Article 30-2, paragraphs (1) and (5), Article 32, paragraph (1), and Article 35, paragraph (7) to personal information of a person under 16 years of age when a business handling personal information handles that personal information (excluding the following cases), the phrase "the identifiable person" in those provisions (excluding the provisions of Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i), the proviso to Article 26, paragraph (2), Article 27, paragraph (1), item (viii) and paragraph (2), Article 28, paragraph (3), and the part of Article 35, paragraph (7) other than its items, and item (ix) of that paragraph) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests" in Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 27, paragraph (1), item (viii), and Article 35, paragraph (7), item (ix) is deemed to be replaced with "does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively; the phrase "the identifiable person" in the proviso to Article 26, paragraph (2) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "at the request of that person" in Article 27, paragraph (2) is deemed to be replaced with "at the request of that person or that person's legal representative", the phrase "the business notifies that person" in that paragraph is deemed to be replaced with "the business notifies the legal representative of that person", and the phrase "or makes that information readily accessible to that person" in that paragraph is deemed to be replaced with "or makes that information readily accessible to the legal representative of that person"; and the phrase "to the identifiable person at the request of that person" in Article 28, paragraph (3) is deemed to be replaced with "to the identifiable person or that person's legal representative at the request of the identifiable person or that person's legal representative".

cases in which there is a legitimate reason for the business handling personal information not knowing that the personal information is that of a person under 16 years of age;

cases in which the legal representative of the identifiable person has permitted the identifiable person to engage in business, and the business handling personal information has acquired the personal information in connection with that business;

cases in which the identifiable person has no legal representative, or the business handling personal information has reasonable grounds to believe that the identifiable person has no legal representative.

With regard to applying the provisions of Article 31, paragraph (1) to information related to personal information when a business handling information related to personal information handles information related to personal information concerning a person under 16 years of age (excluding the following cases), the phrase "the identifiable person's consent" in item (i) of that paragraph is deemed to be replaced with "the consent of the legal representative of the identifiable person", and the phrases "the identifiable person's consent", "serves as a reference to the person" and "provided in advance to the person" in item (ii) of that paragraph are deemed to be replaced with "the consent of the legal representative of the identifiable person", "serves as a reference to the legal representative of the identifiable person" and "provided in advance to the legal representative of the identifiable person" respectively.

cases in which there is a legitimate reason for the business handling information related to personal information not knowing that the information related to personal information concerns a person under 16 years of age;

cases in which the legal representative of the person to whom the information related to personal information relates has permitted that person to engage in business, and the business handling information related to personal information has acquired the information related to personal information in connection with that business;

cases in which the person to whom the information related to personal information relates has no legal representative, or the business handling information related to personal information has reasonable grounds to believe that the person to whom the information related to personal information relates has no legal representative.

When preparing pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent; hereinafter the same applies in this Chapter (excluding paragraphs (3) and Chapter VI(4) of the following Article, Article 54, paragraph (1), and Article 58, paragraph (2))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual unless collated with other information.

With regard to applying the provisions of Article 21 and paragraph (1) of the preceding Article related to pseudonymized personal information, the phrase "notify the identifiable person of that purpose of use or disclose this to the public" in Article 21, paragraphs (1) and (3) of that Article is deemed to be replaced with "disclose that purpose of use"; the phrase "notifying the identifiable person of the purpose of use or disclosing this to the public" in the provisions of items (i) through (iii) of paragraph (4) of that Article is deemed to be replaced with "disclosing the purpose of use"; the phrase "Article 20, paragraph (2), Article 21" in paragraph (1) of the preceding Article is deemed to be replaced with "Article 20, paragraph (2)"; the phrase "Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i)" in that paragraph is deemed to be replaced with "Article 20, paragraph (2), item (vii)"; and the phrase '"does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively' in that paragraph is deemed to be replaced with '"does not harm the identifiable person's rights and interests"'.

Notwithstanding the provisions of Article 27, paragraphs (1) and (2), and Article 28, paragraph (1), and except cases based on laws and regulations, businesses handling pseudonymized personal information must not provide a third party with personal data that constitutes pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 41, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" in Article 27, paragraph (6) is deemed to be replaced with "disclose this without delay"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso of Article 29, paragraph (1), is deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)"; and the term "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso of Article 30, paragraph (1) areis deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)".

Businesses handling pseudonymized personal information, in handling that information, must not use contact addresses and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) or a specified correspondence delivery operator prescribed in Article 2, paragraph (9), for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

Except in cases based on laws and regulations, businesses handling pseudonymized personal information must not provide pseudonymized personal information (excluding those that constitute personal information; hereinafter the same applies in the following paragraph and paragraph (3)this Article) to a third party.

The provisions of Articles 23 through 25, Article 40, and paragraphs (7) and (8) of the preceding Article apply mutatis mutandis to the handling of pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent) by a business handling pseudonymized personal information, and the provisions of Article 40 apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information, respectively. In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking"; and the term "not" in Article 41, paragraph (7) is replaced with "neither acquire deleted or other related information, nor".

The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling pseudonymized personal information, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

When preparing anonymized personal information (limited to those compiled in an anonymized personal information database or the equivalent; hereinafter the same applies in this Chapter (excluding paragraph (6) of this Article, Article 46, Article 46-2, and Chapter VIArticle 54, paragraph (1))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual and restore the information to its original state.

Businesses handling anonymized personal information, before providing anonymized personal information (excluding those into which they have processed personal information themselves; hereinafter the same applies in this SectionArticle through Article 46) to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information it will provide to the third party, and the means of providing this, and state to the third party explicitly that the information it will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling anonymized personal information, of anonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).

A corporation (or an organization without legal personality that has made provisions for a representative or manager; the same applies in item (iii), (b) of the following Article) seeking to perform services as set forth in one of the following items with the aim of ensuring that a business handling personal or other related information, pseudonymized personal (excluding a business handling information, or anonymized related to personal information (; hereinafter referred to as "the same applies in this Section) handles the personal or other related information" in this Chapter) ( (limited, in the business in question is hereinafter referred case of information related to personal information, to as a "business handlingthat which constitutes sensitive personal information, etc. for statistical compilation or other related similar analysis, provided personal information" in this Chapter) handles the , etc. for statistical compilation or similar analysis, and provided personal informationdata, etc. for statistical compilation or similar analysis; hereinafter the same applies in this Section) properly may receive certification from the Personal Information Protection Commission:

In order to ensure the proper handling of personal or other related information by its covered businesses, a certified personal information protection organization must endeavor to create guidelines which follow the spirit of this Act (hereinafter referred to as "personal information protection guidelines" in this Section and Chapter VI), for how to specify the purpose of use of personal information, for measures to ensure its secure management, for procedures to deal with requests for disclosure or other handling, for other such matters, how to conduct statistical compilation or similar analysis concerning sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, and the security measures for that information and other such matters, as well as how to produce pseudonymized processedpersonal information or anonymized personal information, and its security measures and other such matters, by listening to the opinions of representatives of customers or other relevant persons.