Act on the Protection of Personal Information

Notwithstanding the provisions of Article 20, paragraph (2), if a business handling personal information needs to handle sensitive personal information that is currently open to the public for the purpose of conducting statistical compilation or similar analysis (hereinafter referred to as the "purpose of statistical compilation or similar analysis" in this paragraph, paragraph (5), and Article 31-3, paragraph (1)) or for the purpose of making a provision under the main clause of paragraph (5) (limited to cases in which the entire purpose of handling that sensitive personal information is the purpose of statistical compilation or similar analysis or the purpose of making that provision), and has disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the name of that business handling personal information, the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information it acquires or the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5), and other matters prescribed by Order of the Personal Information Protection Commission, the business may acquire that sensitive personal information currently open to the public without obtaining the consent of the identifiable person.

A business handling personal information that has acquired sensitive personal information pursuant to the provisions of the preceding paragraph (referred to as a "special-provision acquirer of sensitive personal information" in the following paragraph, paragraph (4), and Article 72-3, paragraph (1)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in the preceding paragraph, the matters prescribed in that paragraph (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in the proviso to the following paragraph, those matters as changed) for the period during which it handles that sensitive personal information or information relating to a living individual produced by reproducing or processing all or part of it.

When changing the matters it discloses to the public pursuant to the provisions of the preceding paragraph, a special-provision acquirer of sensitive personal information must disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), that fact and the content of the change; provided, however, that when changing the name of that special-provision acquirer of sensitive personal information or other matters prescribed by Order of the Personal Information Protection Commission, it is sufficient for it to disclose to the public that fact and the content of the change promptly after making the change, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1).

Notwithstanding the provisions of Article 18, a business handling personal information that handles sensitive personal information acquired pursuant to the provisions of paragraph (1) or information relating to a living individual produced by reproducing or processing all or part of it (excluding that which constitutes provided personal information, etc. for statistical compilation or similar analysis prescribed in paragraph (6); hereinafter referred to as "sensitive personal information, etc. for statistical compilation or similar analysis") must not handle that sensitive personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for performing the act specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations and in cases in which there is an urgent need to rescue human life, provide disaster relief, or respond to any other emergency situation (hereinafter referred to as "cases based on laws and regulations, etc." in this Chapter).

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates (excluding the case set forth in item (iii)): statistical compilation or similar analysis of the content so disclosed;

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the fact that it will handle the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates for the purpose of making a provision under the main clause of the following paragraph (excluding the case set forth in the following item): that provision;

if the special-provision acquirer of sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates has disclosed to the public, pursuant to the provisions of paragraph (2), the content of the statistical compilation or similar analysis it intends to conduct using the sensitive personal information to which that sensitive personal information, etc. for statistical compilation or similar analysis relates and the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of the following paragraph: statistical compilation or similar analysis of the content so disclosed, and that provision.

Notwithstanding the provisions of Article 18 and Article 27, paragraph (1), if a third party (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity (meaning an administrative organ's head or administrative entity prescribed in Article 63; the same applies in paragraph (9), item (ii), paragraph (12), and Article 31-3, paragraph (5), item (ii) and paragraph (8)) (if that person is a person in a foreign country, limited to a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to those that a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, and a business handling information related to personal information (hereinafter referred to as a "business handling personal or other related information") must take concerning the handling of personal information, pseudonymized personal information, anonymized personal information, and information related to personal information (hereinafter referred to as "personal or other related information") pursuant to the provisions of this Chapter (those measures being referred to as "equivalent measures" in paragraph (13) and Article 31-3, paragraph (9)) (that system being referred to as a "system that conforms to standards" in paragraph (13) and Article 31-3, paragraph (9)); the same applies in paragraph (12) and Article 31-3, paragraph (8)); hereinafter the same applies in this paragraph, the following paragraph, and Article 31-3, paragraphs (1) and (2)) needs to handle personal information (including sensitive personal information, etc. for statistical compilation or similar analysis; hereinafter the same applies in this paragraph through paragraph (7), paragraph (13), and Article 72-3, paragraphs (2) and (3)) for the purpose of statistical compilation or similar analysis (limited to cases in which the entire purpose of handling that personal information is the purpose of statistical compilation or similar analysis), and the case falls under all of the following items, a business handling personal information may provide that personal information to that third party without obtaining the consent of the identifiable person; provided, however, that this does not apply if that personal information has been provided by another business handling personal information or by a business handling information related to personal information pursuant to the provisions of the main clause of this paragraph or the main clause of Article 31-3, paragraph (1) (including personal information all or part of which has been reproduced or processed).

that business handling personal information and that third party have disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the names of that business handling personal information and that third party, the content of the statistical compilation or similar analysis they intend to conduct, and other matters prescribed by Order of the Personal Information Protection Commission;

it is clearly specified by a written agreement (including an electronic or magnetic record) with that third party that the provision is made under the main clause of this paragraph.

A third party that has received a provision of personal information pursuant to the main clause of the preceding paragraph (limited to a person that is a business handling personal information; referred to as a "special-provision recipient of personal information" in this Article and Article 72-3, paragraph (5), item (i)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in item (i) of the preceding paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in paragraph (8), those matters as changed) for the period during which it handles that personal information or information relating to a living individual produced by reproducing or processing all or part of it (hereinafter referred to as "provided personal information, etc. for statistical compilation or similar analysis").

A special-provision recipient of personal information may change the matters disclosed to the public pursuant to the provisions of the preceding paragraph only if both that special-provision recipient of personal information and the business handling personal information that provided personal information to that special-provision recipient of personal information pursuant to the main clause of paragraph (5) disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (5), item (i), that those matters will be changed and the content of the change; provided, however, that this does not apply when changing the name of that special-provision recipient of personal information or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the special-provision recipient of personal information must, promptly after making the change, disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (5), item (i), that it has made the change and the content of the change.

Notwithstanding the provisions of Article 18, a business handling personal information that handles provided personal information, etc. for statistical compilation or similar analysis must not handle that provided personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations, etc.

if the provision under the main clause of paragraph (5) to which that provided personal information, etc. for statistical compilation or similar analysis relates was made to a special-provision recipient of personal information: statistical compilation or similar analysis of the content which that special-provision recipient of personal information discloses to the public pursuant to the provisions of paragraph (6);

if the provision under the main clause of paragraph (5) to which that provided personal information, etc. for statistical compilation or similar analysis relates was made to an administrative organ's head or administrative entity: statistical compilation or similar analysis of the content which that administrative organ's head or administrative entity discloses to the public pursuant to the provisions of Article 72-3, paragraph (2).

Notwithstanding the provisions of Article 27, paragraphs (1) and (2) and Article 28, paragraph (1), a business handling personal information that handles sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis must not provide personal data that constitutes that sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis to a third party, except in the following cases. In this case, the phrase "is not to fall under a third party regarding applying the provisions of each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "(limited to a person that is a business handling personal information or an administrative organ's head or administrative entity prescribed in Article 63 (limited, if such a person is a person in a foreign country prescribed in paragraph (1) of the following Article, to a person that has established a system that conforms to standards prescribed in Article 30-2, paragraph (5))) is not to fall under a third party regarding applying the provisions of Article 30-2, paragraph (10)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso to Article 29, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in Article 30-2, paragraph (4) or any of the items of Article 27, paragraph (5)"; and the phrase "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso to Article 30, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in paragraph (4) of the following Article or any of the items of Article 27, paragraph (5)".

cases based on laws and regulations, etc.;

cases in which that business handling personal information has acquired sensitive personal information pursuant to the provisions of paragraph (1) and has disclosed to the public, pursuant to the provisions of paragraph (2), the fact that it will handle that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5), and that business handling personal information provides the sensitive personal information, etc. for statistical compilation or similar analysis relating to that sensitive personal information pursuant to the main clause of paragraph (5).

Notwithstanding the provisions of Article 31, paragraph (1), a business handling personal information that handles sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis must not provide that sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (excluding those that constitute personal data; the same applies in the following paragraph) to a third party, except in the cases set forth in the items of the preceding paragraph.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving the provision of sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity). In this case, the phrase "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 30-2, paragraph (11)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; and the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public".

A business handling personal information that has provided personal information pursuant to the main clause of paragraph (5) to a third party in a foreign country that has established a system that conforms to standards, or has provided sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis to that third party, must take necessary measures to ensure continuous implementation of the equivalent measures by that third party, and disclose information on those necessary measures to the public, pursuant to Order of the Personal Information Protection Commission. In this case, the provisions of Article 28, paragraph (3) do not apply.

The provisions of Articles 23 through 25 apply mutatis mutandis to the handling of sensitive personal information, etc. for statistical compilation or similar analysis or provided personal information, etc. for statistical compilation or similar analysis (excluding those that constitute personal data) by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling personal information provides sensitive personal information, etc. for statistical compilation or similar analysis (limited to that which constitutes information related to personal information prescribed in Article 31, paragraph (1)) to a special-provision recipient of personal information pursuant to the main clause of paragraph (5) (limited to cases in which it is assumed that the special-provision recipient of personal information acquires that sensitive personal information, etc. for statistical compilation or similar analysis as personal data). In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking".