Act on the Protection of Personal Information

An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis provided to it (including provision via two or more layers) by a special-provision acquirer of sensitive personal information must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that sensitive personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for performing the act specified in the following items in accordance with the categories of cases set forth in those items:

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates (excluding the case set forth in item (iii)): the statistical compilation or similar analysis of the disclosed content;

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), that it handles the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates for the purpose of making a provision under the main clause of paragraph (5) of that Article (excluding the case set forth in the following item): that provision;

if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates, and that it handles that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5) of that Article: the statistical compilation or similar analysis of the disclosed content and that provision.

An administrative organ's head or administrative entity that has been provided with personal information pursuant to the main clause of Article 30-2, paragraph (5) must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (4), those matters after the change) for the period during which it handles the provided personal information, etc. for statistical compilation or similar analysis relating to that personal information.

The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling personal information that provided the personal information pursuant to the main clause of Article 30-2, paragraph (5) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (2) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 30-2, paragraph (5), item (i).

An administrative organ's head or administrative entity that handles provided personal information, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:

if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to a special-provision recipient of personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of personal information discloses pursuant to the provisions of paragraph (6) of that Article;

if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (2).

An administrative organ's head or administrative entity that has been provided with information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) and has acquired it as personal data must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (8), those matters after the change) for the period during which it handles the provided personal data, etc. for statistical compilation or similar analysis relating to that information related to personal information.

The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling information related to personal information prescribed in Article 16, paragraph (8) that provided the information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.

In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (6) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 31-3, paragraph (1), item (i).

An administrative organ's head or administrative entity that handles provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:

if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to a special-provision recipient of information related to personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of information related to personal information discloses pursuant to the provisions of paragraph (2) of that Article;

if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (6).

An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., provide that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis to a third party (excluding a business handling personal information, or an administrative organ's head or administrative entity, that has been entrusted with the handling of that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis).

An administrative organ's head or administrative entity must take the necessary and appropriate measures for the secure management of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, including preventing the leaking of the sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis it handles (excluding those that constitute personal information the administrative entity holds; hereinafter the same applies in this paragraph).

The provisions of paragraphs (1) and (5) and the preceding three paragraphs apply mutatis mutandis to cases in which a person that has been entrusted (including entrustment via two or more layers) with the handling of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis by an administrative organ's head or administrative entity conducts the entrusted business, and the provisions of Article 70 apply mutatis mutandis to cases in which an administrative organ's head or administrative entity provides sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis (excluding those that constitute personal information the administrative entity holds), respectively.

Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must not utilize a contact address and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or a specified correspondence delivery operator prescribed in Article 2, paragraph (9) of that Act, for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).