Act on the Protection of Personal Information

As regards a request under Article 32, paragraph (2), or a request under Article 33, paragraph (1) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article; the same applies in paragraph (1) of the following Article and Article 39), Article 34, paragraph (1), Article 35, paragraph (1), (3), (5), (7), or (59) (hereinafter referred to as a "request for disclosure or other handling" in this Article and Article 54, paragraph (1)Chapter), a business handling personal information may decide on a method of receiving a request as prescribed by Cabinet Order. In such a case, an identifiable person must request disclosure or other handling in that way.

A business handling personal information may request an identifiable person requesting disclosure or other handling to present sufficient information to identify the personal data the business holds or the specified biometric personal information, or the record of provision to a third party, that would be subject to the disclosure or other handling. In such a case, the business handling personal information must provide information to help the person identify the relevant personal data the business holds or the relevant specified biometric personal information, or the relevant record of provision to a third party, or take other appropriate measures in consideration of the identifiable person's convenience, so as to allow the person to easily and accurately request disclosure or other handling.

A person may request disclosure legal representative of a minor or other handling throughadult ward, or an agent, as prescribed privately appointed by the identifiable person or any other agent specified by Cabinet Order may make a request for disclosure or other handling on behalf of the identifiable person.

When seeking to file a lawsuit in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), (5), (7), or (59), the identifiable person may not file the lawsuit unless the identifiable person had previously issued a request against a person who should become a defendant in the lawsuit and two weeks have elapsed since the arrival day of the issued request; provided, however, that this does not apply if the person who should become a defendant in the lawsuit has rejected the request.

The provisions of the preceding two paragraphs apply mutatis mutandis to a petition for a provisional disposition order in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), (5), (7), or (59).

A business handling personal information must endeavor to process complaints about the handling of personal information, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis appropriately and promptly.

With regard to applying the provisions of Article 18, Article 20, paragraph (2), Article 21, Article 21-2, paragraph (1), Article 26, paragraph (2), Article 27, Article 28, Article 30-2, paragraphs (1) and (5), Article 32, paragraph (1), and Article 35, paragraph (7) to personal information of a person under 16 years of age when a business handling personal information handles that personal information (excluding the following cases), the phrase "the identifiable person" in those provisions (excluding the provisions of Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i), the proviso to Article 26, paragraph (2), Article 27, paragraph (1), item (viii) and paragraph (2), Article 28, paragraph (3), and the part of Article 35, paragraph (7) other than its items, and item (ix) of that paragraph) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests" in Article 18, paragraph (3), item (vii), Article 20, paragraph (2), item (vii), Article 27, paragraph (1), item (viii), and Article 35, paragraph (7), item (ix) is deemed to be replaced with "does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively; the phrase "the identifiable person" in the proviso to Article 26, paragraph (2) is deemed to be replaced with "the legal representative of the identifiable person"; the phrase "at the request of that person" in Article 27, paragraph (2) is deemed to be replaced with "at the request of that person or that person's legal representative", the phrase "the business notifies that person" in that paragraph is deemed to be replaced with "the business notifies the legal representative of that person", and the phrase "or makes that information readily accessible to that person" in that paragraph is deemed to be replaced with "or makes that information readily accessible to the legal representative of that person"; and the phrase "to the identifiable person at the request of that person" in Article 28, paragraph (3) is deemed to be replaced with "to the identifiable person or that person's legal representative at the request of the identifiable person or that person's legal representative".

cases in which there is a legitimate reason for the business handling personal information not knowing that the personal information is that of a person under 16 years of age;

cases in which the legal representative of the identifiable person has permitted the identifiable person to engage in business, and the business handling personal information has acquired the personal information in connection with that business;

cases in which the identifiable person has no legal representative, or the business handling personal information has reasonable grounds to believe that the identifiable person has no legal representative.

With regard to applying the provisions of Article 31, paragraph (1) to information related to personal information when a business handling information related to personal information handles information related to personal information concerning a person under 16 years of age (excluding the following cases), the phrase "the identifiable person's consent" in item (i) of that paragraph is deemed to be replaced with "the consent of the legal representative of the identifiable person", and the phrases "the identifiable person's consent", "serves as a reference to the person" and "provided in advance to the person" in item (ii) of that paragraph are deemed to be replaced with "the consent of the legal representative of the identifiable person", "serves as a reference to the legal representative of the identifiable person" and "provided in advance to the legal representative of the identifiable person" respectively.

cases in which there is a legitimate reason for the business handling information related to personal information not knowing that the information related to personal information concerns a person under 16 years of age;

cases in which the legal representative of the person to whom the information related to personal information relates has permitted that person to engage in business, and the business handling information related to personal information has acquired the information related to personal information in connection with that business;

cases in which the person to whom the information related to personal information relates has no legal representative, or the business handling information related to personal information has reasonable grounds to believe that the person to whom the information related to personal information relates has no legal representative.

When preparing pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent; hereinafter the same applies in this Chapter (excluding paragraphs (3) and Chapter VI(4) of the following Article, Article 54, paragraph (1), and Article 58, paragraph (2))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual unless collated with other information.

With regard to applying the provisions of Article 21 and paragraph (1) of the preceding Article related to pseudonymized personal information, the phrase "notify the identifiable person of that purpose of use or disclose this to the public" in Article 21, paragraphs (1) and (3) of that Article is deemed to be replaced with "disclose that purpose of use"; the phrase "notifying the identifiable person of the purpose of use or disclosing this to the public" in the provisions of items (i) through (iii) of paragraph (4) of that Article is deemed to be replaced with "disclosing the purpose of use"; the phrase "Article 20, paragraph (2), Article 21" in paragraph (1) of the preceding Article is deemed to be replaced with "Article 20, paragraph (2)"; the phrase "Article 20, paragraph (2), item (vii), Article 21, paragraph (2) and paragraph (4), item (i)" in that paragraph is deemed to be replaced with "Article 20, paragraph (2), item (vii)"; and the phrase '"does not harm the identifiable person's rights and interests"; the phrases "to the identifiable person" in Article 21, paragraph (2) and "notifying the identifiable person" in paragraph (4), item (i) of that Article are deemed to be replaced with "to the legal representative of the identifiable person" and "notifying the legal representative of the identifiable person" respectively' in that paragraph is deemed to be replaced with '"does not harm the identifiable person's rights and interests"'.

Notwithstanding the provisions of Article 27, paragraphs (1) and (2), and Article 28, paragraph (1), and except cases based on laws and regulations, businesses handling pseudonymized personal information must not provide a third party with personal data that constitutes pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 41, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" in Article 27, paragraph (6) is deemed to be replaced with "disclose this without delay"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso of Article 29, paragraph (1), is deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)"; and the term "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso of Article 30, paragraph (1) areis deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)".

Businesses handling pseudonymized personal information, in handling that information, must not use contact addresses and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) or a specified correspondence delivery operator prescribed in Article 2, paragraph (9), for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.