Act on the Protection of Personal Information

A business handling personal information that has been entrusted by another business handling personal information or an administrative entity with all or part of the handling of personal information (including entrustment through two or more tiers) must not, except in cases based on laws and regulations, etc., handle the personal information whose handling it has been entrusted with (excluding that which constitutes information related to personal information for that business handling personal information) beyond the scope necessary for the performance of the entrusted services.

Except cases set forth in each item of Article 27, paragraph (1), if it is assumed that a third party acquires information related to personal information (limited to those compiled in a database or the equivalent of information related to personal information; hereinafter the same applies in this Chapterparagraph and Chapter VIthe following paragraph) as personal data, businesses handling information related to personal information must not provide the information related to personal information to the third party without confirming the matters set forth as follows pursuant to Order of the Personal Information Protection Commission:

The provisions of Article 30, paragraphs (2) through (4) of the preceding Article apply mutatis mutandis to cases in which a business handling information related to personal information conducts confirmation pursuant to the provisions of paragraph (1). In this case, the phrase "received" in paragraph (3) of the precedingthat Article is deemed to be replaced with "provided."

A business handling information related to personal information must not utilize contact-enabling information related to personal information in a way that there is a possibility of fomenting or inducing unlawful or unjust act.

A business handling information related to personal information must not acquire contact-enabling information related to personal information by deception or other wrongful means.

Notwithstanding the provisions of Article 31, paragraph (1) (limited to the part relating to item (i)), if a third party needs to handle information related to personal information for the purpose of statistical compilation or similar analysis (limited to cases in which the entire purpose of handling that information related to personal information is the purpose of statistical compilation or similar analysis), and the case falls under all of the following items, a business handling information related to personal information may provide that information related to personal information to that third party without confirming the matter set forth in Article 31, paragraph (1), item (i); provided, however, that this does not apply if that information related to personal information has been provided by a business handling personal information or by another business handling information related to personal information pursuant to the provisions of the main clause of Article 30-2, paragraph (5) or the main clause of this paragraph (including information all or part of which has been reproduced or processed).

that business handling information related to personal information and that third party have disclosed to the public, by using the internet or by other means prescribed by Order of the Personal Information Protection Commission, the names of that business handling information related to personal information and that third party, the content of the statistical compilation or similar analysis they intend to conduct, and other matters prescribed by Order of the Personal Information Protection Commission;

it is clearly specified by a written agreement (including an electronic or magnetic record) with that third party that the provision is made under the main clause of this paragraph.

A third party that has received a provision of information related to personal information pursuant to the main clause of the preceding paragraph and acquired it as personal data (limited to a person that is a business handling personal information; referred to as a "special-provision recipient of information related to personal information" in this Article and Article 72-3, paragraph (9), item (i)) must continuously disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in item (i) of the preceding paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the provisions of the main clause of the following paragraph or in the case referred to in paragraph (4), those matters as changed) for the period during which it handles that information related to personal information or information relating to a living individual produced by reproducing or processing all or part of it (hereinafter referred to as "provided personal data, etc. for statistical compilation or similar analysis").

A special-provision recipient of information related to personal information may change the matters disclosed to the public pursuant to the provisions of the preceding paragraph only if both that special-provision recipient of information related to personal information and the business handling information related to personal information that provided information related to personal information to that special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1) disclose to the public in advance, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that those matters will be changed and the content of the change; provided, however, that this does not apply when changing the name of that special-provision recipient of information related to personal information or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the special-provision recipient of information related to personal information must, promptly after making the change, disclose to the public, by the means prescribed by Order of the Personal Information Protection Commission referred to in paragraph (1), item (i), that it has made the change and the content of the change.

Notwithstanding the provisions of Article 18, a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in each of the following items in accordance with the category of cases set forth in that item, except in cases based on laws and regulations, etc.

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to a special-provision recipient of information related to personal information: statistical compilation or similar analysis of the content which that special-provision recipient of information related to personal information discloses to the public pursuant to the provisions of paragraph (2);

if the provision under the main clause of paragraph (1) to which that provided personal data, etc. for statistical compilation or similar analysis relates was made to an administrative organ's head or administrative entity: statistical compilation or similar analysis of the content which that administrative organ's head or administrative entity discloses to the public pursuant to the provisions of Article 72-3, paragraph (6).

Notwithstanding the provisions of Article 27, paragraphs (1) and (2) and Article 28, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide personal data that constitutes that provided personal data, etc. for statistical compilation or similar analysis to a third party, except in cases based on laws and regulations, etc. In this case, the phrase "is not to fall under a third party regarding applying the provisions of each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "(limited to a person that is a business handling personal information or an administrative organ's head or administrative entity prescribed in Article 63 (limited, if such a person is a person in a foreign country prescribed in paragraph (1) of the following Article, to a person that has established a system that conforms to standards prescribed in Article 30-2, paragraph (5))) is not to fall under a third party regarding applying the provisions of Article 31-3, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso to Article 29, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in Article 30-2, paragraph (4) or any of the items of Article 27, paragraph (5)"; and the phrase "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso to Article 30, paragraph (1) is deemed to be replaced with "a case based on laws and regulations, etc. prescribed in paragraph (4) of the following Article or any of the items of Article 27, paragraph (5)".

Notwithstanding the provisions of Article 31, paragraph (1), a business handling personal information that handles provided personal data, etc. for statistical compilation or similar analysis must not provide that provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data; the same applies in the following paragraph) to a third party, except in cases based on laws and regulations, etc.

The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving the provision of provided personal data, etc. for statistical compilation or similar analysis (limited to a person that is a business handling personal information or an administrative organ's head or administrative entity). In this case, the phrase "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 31-3, paragraph (7)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "discloses this to the public in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; and the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data" in paragraph (6) of that Article is deemed to be replaced with "disclose this to the public".

A business handling information related to personal information that has provided information related to personal information pursuant to the main clause of paragraph (1) to a third party in a foreign country that has established a system that conforms to standards, or a business handling personal information that has provided provided personal data, etc. for statistical compilation or similar analysis to that third party, must take necessary measures to ensure continuous implementation of the equivalent measures by that third party, and disclose information on those necessary measures to the public, pursuant to Order of the Personal Information Protection Commission. In this case, the provisions of Article 28, paragraph (3) do not apply.

The provisions of Articles 23 through 25 apply mutatis mutandis to the handling of provided personal data, etc. for statistical compilation or similar analysis (excluding that which constitutes personal data) by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information to a special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1). In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking".

the procedures for responding to a request under the following paragraph,for disclosure or to a request under paragraph (1) of the following Article (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (1); orother handling prescribed in Article 3537, paragraph (1), paragraph (3), or paragraph (5) ( (including the amount of the fee, if one a fee is setcollected pursuant to the provisions of Article 38, paragraph (21));