Act on the Protection of Personal Information

A business handling personal information must, when handling specified biometric personal information, notify the identifiable person of the following matters in advance, or put them in a state where the identifiable person can easily know them, as provided by Order of the Personal Information Protection Commission:

the name and address of that business handling personal information and, if it is a corporation, the name of its representative (or, for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; the same applies in Article 27, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));

the fact that specified biometric personal information will be handled;

the purpose of use of the specified biometric personal information;

the content of the information on the characteristic of a part of the body that is converted into the specified biometric individual identification code included in the specified biometric personal information;

the procedures for responding to a request for disclosure or other handling prescribed in Article 37, paragraph (1) (including the amount of the fee, if a fee is collected pursuant to the provisions of Article 38, paragraph (1));

other matters prescribed by Order of the Personal Information Protection Commission as those necessary to protect individual rights and interests.

The provisions of the preceding paragraph do not apply in the following cases:

taking the measures under the preceding paragraph is likely to harm the life, wellbeing, property, or other rights or interests of the identifiable person or a third party;

taking the measures under the preceding paragraph is likely to harm the rights or legitimate interests of the business handling personal information;

it is necessary for the business to cooperate with a national government organ or a local government in performing the functions prescribed by laws and regulations, and taking the measures under the preceding paragraph is likely to interfere with the performance of those functions;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in the preceding three items.

In cases prescribed in the preceding paragraph, businesses handling personal information (excluding those that have given a notice under the proviso of that paragraph) must notify the identifiable person of the occurrence of the situation, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply if it is difficult to notify the identifiable person of that occurrence, or in a case prescribed by Order of the Personal Information Protection Commission as one in which there is little risk of a failure to protect the identifiable person's rights and interests even if the identifiable person is not notified, and the necessary alternative measures are taken to protect that person's rights and interests.

cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person or there are otherwise reasonable grounds for not obtaining the consent of the identifiable person;

cases in which the business handling personal information that is an academic research institution or the equivalent conducts academic research jointly with a third party, and needs to provide the personal data to that third party for the academic research purpose (including cases in which a part of the purpose of providinghandling the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the third party jointly conduct academic research);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that providing the personal data is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal data, that providing it is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests.

Notwithstanding the provisions of the preceding paragraph, if a business handling personal information agrees to cease to provide a third party with any personal data which can be used to identify the identifiable person, at the request of that person; the business notifies that person of the following information in advance or makes that information readily accessible to that person in advance, as provided for by Order of the Personal Information Protection Commission; and the business files a notification of this to the Commission, the business may provide that personal data to a third party; provided, however, that this does not apply to cases in which personal data which is to be provided to a third party is sensitive personal information or specified biometric personal information, has been acquired in violation of the provisions of Article 20, paragraph (1), or has been provided by another business handling personal information pursuant to the provisions of the main clause of this paragraph (including personal data all or part of which has been reproduced or processed):

the name and address of a business handling personal information that provides personal information to a third party and, if it is a corporation, the name of its representative (or for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; hereinafter the same applies in this Article, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));

When providing personal data to a third party (excluding a person set forth in each item of Article 16, paragraph (2); hereinafter the same applies in this Article, Article 29, paragraph (1), and Article 30, paragraphs (1) and (2) (including as applied mutatis mutandis pursuant to Article 31, paragraph (3))) pursuant to the provisions of the main clause of paragraph (2), a business handling personal information must confirm the following matters in advance, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply in cases in which all of that personal data had been open to the public, at the time when that business handling personal information acquired that personal data, by the identifiable person, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission, or in cases prescribed by Order of the Personal Information Protection Commission as equivalent to those cases.

the name and address of the third party and, if the third party is a corporation, the name of its representative;

the purpose of use of the personal data by the third party.

A third party that has been asked by a business handling personal information to give confirmation under the preceding paragraph must not deceive that business handling personal information on a matter relating to the confirmation.