Act on the Protection of Personal Information

"Personal information the administrative entity holds" in this Chapter and Chapter VIII means personal information that an employee of an administrative entity (in a case of an incorporated administrative agency or other prescribed corporation or a local incorporated administrative agency, its officer is included; hereinafter the same applies in this Chapter and Chapter VIII) prepares or acquires in the course of that employee's duties, and that administrative entity holds for organizational use by its employees; provided, however, that the personal information the administrative entity holds is limited to personal information recorded in administrative or similar documents (meaning administrative documents prescribed in Article 2, paragraph (2) of the Act on Access to Information Held by Administrative Organs (Act No. 42 of 1999; hereinafter referred to as the "Administrative Organs Information Disclosure Act" in this Chapter)), corporate documents (meaning corporate documents prescribed in Article 2, paragraph (2) of the Act on Access to Information Held by Incorporated Administrative Agencies (Act No. 140 of 2001); hereinafter referred to as "Incorporated Administrative Agencies Information Disclosure Act" in this Chapter; those documents include those listed in item (iv) of that paragraph), or local government documents (meaning documents, drawings, or electronic or magnetic records that an employee of a local government organ or local incorporated administrative agency prepares or acquires in the course of that employee's duties, and that local government organ or local incorporated administrative agency holds for organizational use by its employees; and excluding those prescribed by Cabinet Order as equivalent to those set forth in the items of Article 2, paragraph (2) of the Administrative Organs Information Disclosure Act) (the above-mentioned documents are hereinafter collectively referred to as "administrative or similar documents" in this Chapter).

"Personal information file" in this Chapter and Chapter VIII means a collective body of information comprised of personal information the administrative entity holds, as set forth below:

those systematically organized so as to be searchable for particular personal information the administrative entity holds, by using a computer for the purpose of certain processes;

beyond what is set forth in the preceding item, those systematically organized so as to be searchable for particular personal information the administrative entity holds, by using a name, date of birth or other identifiers or their equivalent for the purpose of certain processes.

the information does not fall under any of items in Article 75, paragraph (2), or the information that is not designated under paragraph (3) of that Article as an exception to registration in the personal information file register as prescribed in paragraph (1) of that Article;

the information for which the head of an administrative organ as prescribed in Article 3 of the Administrative Organs Information Disclosure Act, an incorporated administrative agency or other prescribed corporation as prescribed in Article 2, paragraph (1) of the Incorporated Administrative Agencies Information Disclosure Act, a local government organ or, a local incorporated administrative agency is required to take either of the following measures, if that person receives a request to disclose any administrative or similar document in which the personal information the administrative entity holds that constitutes a personal information file is recorded (meaning a request for disclosure as prescribed in Article 3 of the Administrative Organs Information Disclosure Act, Article 3 of the Administrative Organs Information Disclosure Act, or the information disclosure ordinance);

making a decision to disclose all or a part of the personal information the administrative entity holds that is recorded in that administrative or similar document;

providing an opportunity to submit an opinion under Article 13, paragraph (1) or paragraph (2) of the Administrative Organs Information Disclosure Act, under Article 14, paragraph (1) or paragraph (2) of the Incorporated Administrative Agencies Information Disclosure Act, or under the information disclosure ordinance (limited to those with provisions equivalent to Article 13, paragraph (1) or (2) of the Administrative Organs Information Disclosure Act);

anonymized personal information can be prepared in a way that processes the personal information the administrative entity holds that constitutes a personal information file in accordance with the criteria set forth in Article 116, paragraph (1), and to extent that it does not hinder proper and smooth management of processes and services by the administrative entity.

The term "anonymized personal information file the administrative entity holds" in this Chapter means a collective body of information comprised of anonymized personal information the administrative entity holds, as set forth below:

those systematically organized so as to be searchable for particular anonymized personal information the administrative entity holds, by using a computer;

beyond what is set forth in the preceding item, those prescribed by Cabinet Order as having been systematically organized so as to be searchable for particular anonymized personal information the administrative entity holds.

The term "sensitive personal information prescribed by local ordinance" in this Chapter means personal information (excluding sensitive personal information) that is held by a local government organ or local incorporated administrative agency and that is comprised of identifiers or their equivalent prescribed by a local government's ordinance, accounting for the regional characteristics and other circumstances, as those of which the handling requires special care so as not to cause unfair discrimination, prejudice, or other disadvantage to the identifiable person.

Administrative entities may hold personal information only when necessary for conducting processes and functions under the jurisdiction provided by laws and regulations (including local ordinances; the same applies in Article 66, paragraph (2), items (iii) and (iv), Article 69, paragraph (2), items (ii) and (iii), and Section 4), and must specify the purpose of use of personal information as much as possible when holding this information.

Administrative entities must not hold personal information beyond the extent necessary for the purpose of use specified pursuant to the provisions of the preceding paragraph.

Administrative entities must not alter the purpose of use beyond a reasonable extent from that of the original purpose of use.

Before an administrative entity directly acquires personal information on an identifiable person that is recorded in a document (including an electronic or magnetic record), the administrative entity must clearly indicate the purpose of use to that person, except in the following cases:

cases in which there is an urgent need to protect the life, wellbeing or property of an individual;

cases in which indicating the purpose of use to the identifiable person clearly is likely to cause harm to the life, wellbeing, property, or other rights or interests of the identifiable person or a third party;

cases in which indicating the purpose of use to the identifiable person clearly is likely to hinder the proper execution of the process or service of a national government organ, incorporated administrative agency or other prescribed corporation, local government, or local incorporated administrative agency;

cases in which the purpose of use is found to be clear in light of the circumstances of the acquisition.

An administrative organ's head or administrative entity must not acquire personal information by deception or other wrongful means.

An administrative organ's head or administrative entity must endeavor to keep personal information the head or entity holds consistent with the past or the present facts within the scope necessary for fulfilling the purpose of use.

An administrative organ's head or administrative entity must take necessary and appropriate measures for managing the security of personal information the administrative entity holds, preventing its leaking, loss or damage.

The provisions of the preceding paragraph apply mutatis mutandis to cases in which a person set forth in each following item handles personal information in conducting services as prescribed in each item respectively:

a person entrusted by an administrative entity with the handling of personal information:that entrusted service;

a designated administrator (meaning a designated administrator prescribed in Article 244-2, paragraph (3) of the Local Autonomy Act (Act No. 67 of 1947)):management service of a public facility (meaning a public facility prescribed in Article 244, paragraph (1) of that Act);

a person set forth in each item of Article 58, paragraph (1):service which is conducted based on laws and regulations and specified by Cabinet Order;

a person set forth in each item of Article 58, paragraph (2):business prescribed in each item of that paragraph which is conducted based on laws and regulations and specified by Cabinet Order;

a person entrusted by a person set forth in each preceding item with service prescribed in each item (including entrustment via two or more layers):that entrusted service.

An employee or a former employee of an administrative entity that handles personal information, a person engaged in or formerly engaged in business prescribed in each item of paragraph (2) of the preceding Article, or a staffing agency worker or a former staffing agency worker (meaning a staffing agency worker prescribed in Article 2, item (ii) of the Act on Securing the Proper Operation of Worker Dispatching Businesses and Protecting Dispatched Workers (Act No. 88 of 1985); hereinafter the same applies in this Chapter and Article 176) that handles personal information must not disclose personal information acquired in the course of that employee's work to other persons without reason or use this information for an unjust purpose.

If there is a leak, loss or damage and other situation concerning the security of the personal information an administrative entity holds as prescribed by Order of the Personal Information Protection Commission that is highly likely to harm individual rights and interests, the administrative organ's head or administrative entity must report to that effect to the Personal Information Protection Commission, pursuant to Order of the Personal Information Protection Commission.

In cases prescribed in the preceding paragraph, an administrative organ's head or administrative entity must notify an identifiable person of the occurrence of the situation pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply to cases falling under any of each following item:

cases in which the personal information the administrative organ or agency holds includes any of information set forth in each item of Article 78, paragraph (1).