Act on the Protection of Personal Information

The Commission may recommendIf a business handling personal or other related information to stop committing the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need for protecting individual rights and interests in cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Article 21 (including the cases in which the provisions of paragraphs (1), (3) and (4) are applied pursuant to the Article 41, paragraph (4) following the deemed replacement of terms), Articles 23Chapter IV, Sections 2 through 26, Article 27 (excluding paragraph (4), and including the cases in which the provisions of paragraphs (5) and (6) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms),4 (excluding Article 2817, Article 29 (including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 4127, paragraph (6) following the deemed replacement of terms8), Article 30 (excluding, paragraph (2), and (including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 32, Article 33 (excluding paragraph (1) (including asit is applied mutatis mutandis pursuant to paragraph (5))), Article 3431, paragraph (2) or paragraph (3), Article 35 (excluding paragraphs (13)), (3) and (5)), Article 38, paragraph (237), Article 41 (excluding paragraphs (4) and (5)) or Article 43 (excluding paragraph (6)); in cases in whichthe Commission finds that there is a business handling information related to personal information has violated the provisions of Article 31, paragraph (1), has violated need for protecting individual rights and interests, the provisions of Article 28, paragraph (3) as applied mutatis mutandis pursuantCommission may recommend the business handling personal or other related information to Article 31, paragraph (2) followingtake measures necessary to stop the deemed replacement of terms,violation or has violatedotherwise rectify the provisions of Article 30, paragraph (3) violation, or paragraph (4) as applied mutatis mutandis pursuant to Article 31, paragraph (3) followingmeasures necessary to protect individual rights and interests, such as notifying the deemed replacementidentifiable person of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of Article 42, paragraph (1), has violated Article 27, paragraph (5)fact pertaining to the violation or paragraph (6) as applied mutatis mutandis pursuant to Article 42, paragraph (2) following the deemed replacement of terms, or has violatedmaking it public (hereinafter referred to as "rectification measures, etc." in the provisions of Articles 23 through 25 or Article 41, paragraph (7) orfollowing paragraph (8) as applied mutatis mutandis pursuant to Article 42,and paragraph (3) following the deemed replacement of terms; or in cases in which a business handling anonymized personal information has violated the provisions of Article 44 or Article 45).

If a business handling personal or other related information has received a recommendation under the preceding paragraph but has not taken the rectification measures , etc. in line with the recommendation without legitimate grounds, and the Commission finds that a serious infringement ofthere is a risk that serious individual rights and interests is impendingwill be harmed, the Commission may order the business handling personal or other related information to take the rectification measures, etc. in line with the recommendation.

Notwithstanding the provisions of the preceding two paragraphs, the Commission may orderif a business handling personal or other related information to stophas violated the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need to take urgent measures because there is a fact that seriously prejudices individual rights and interests inprovisions of Chapter IV, Sections 2 through 4 (excluding Article 17, Article 21, Article 21-2, Article 27, paragraph (3), paragraph (6) (including the cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Articles 23 through 26,it is applied mutatis mutandis pursuant to Article 30-2, paragraph (12), Article 31-3, paragraph (8) or Article 2742, paragraph (1), Article 282)), paragraph (1) or7) and paragraph (38), Article 41, paragraphs (1) through (3), or paragraphs (6) through (8), or Article 43, paragraph (1), 28, paragraph (2), Article 29 (including the cases in which the provisions of the main clause of paragraph (2) or1) and paragraph (5); in cases in which a business handling information related2) are applied mutatis mutandis pursuant to personal information has violated the provisions ofArticle 30-2, paragraph (14) or Article 3131-3, paragraph (1), or has violated10)), Article 30 (including the cases in which the provisions of Article 28, paragraph (3) asparagraphs (2) through (4) are applied mutatis mutandis pursuant to Article 31, paragraph (2) following the deemed replacement of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of3)), Article 30-2, paragraph (2), paragraph (3) and paragraphs (6) through (8), Article 31-3, paragraphs (2) through (4), Articles 32 through 35, Article 37, Article 38, Article 4243, paragraph (1), or has violated 3) and paragraph (4), and Article 44), and the provisions of Articles 23 through 25 or Article 41, paragraph (7) or paragraph (8) as applied mutatis mutandis pursuant to Article 42, paragraph (3) following the deemed replacementCommission finds that there is a need to take urgent measures because there is a fact that seriously prejudices individual rights and interests or because a serious infringement of terms; or in cases in which a individual rights and interests is impending, the Commission may order the business handling anonymized personal information has violated the provisions of Article 45or other related information to take rectification measures, etc.

If the Commission has issued an order under the preceding two paragraphs (hereinafter referred to as an "order for measures") and the business handling personal or other related information that has received the order for measures has violated the order for measures, the Commission may make public announcement to that effect.

If a business handling personal or other related information that has received an order for measures does not comply with that order for measures, and there is a handling-related service supplier (meaning a person that has been entrusted by a business handling personal or other related information with all or part of the handling of personal or other related information, or any other person that, under a contract with a business handling personal or other related information, supplies a service that the business handling personal or other related information uses for the handling of its personal or other related information; the same applies hereinafter in this paragraph and the following paragraph) that supplies a service the business handling personal or other related information uses for the handling of personal or other related information pertaining to the violation pertaining to the order for measures, the Commission may request that handling-related service supplier to take measures necessary to stop the violation, such as suspending the handling of the personal or other related information pertaining to the violation or suspending the supply of that service.

A handling-related service supplier that, upon receiving a request under the preceding paragraph, has taken the measures pertaining to that request is not liable to compensate for damage incurred by the business handling personal or other related information that has received the order for measures.

If the Commission has issued an order for measures and the violation is the transmission of information including personal or other related information by means of specified telecommunications (meaning specified telecommunications prescribed in Article 2, item (i) of the Act on Measures against Infringement of Rights, etc. Arising from the Distribution of Information through Specified Telecommunications (Act No. 137 of 2001); the same applies hereinafter in this paragraph), the Commission may request a specified telecommunications service provider (meaning a specified telecommunications service provider prescribed in Article 2, item (iv) of that Act; the same applies in the following paragraph) that provides the specified telecommunications service prescribed in item (iii) of that Article pertaining to the distribution of information through those specified telecommunications to take measures to prevent the distribution of that information through specified telecommunications.

A specified telecommunications service provider that, upon receiving a request under the preceding paragraph, has taken the measures pertaining to that request is not liable to compensate for damage incurred by the business handling personal or other related information that has received the order for measures.

If a business handling personal information has committed any of the following acts (hereinafter referred to as a "violation" in this paragraph) (excluding the case where the business handling personal information is found not to be a person that failed to exercise reasonable care to prevent the violation throughout the period in which the violation was committed), and has obtained a monetary or other proprietary benefit (hereinafter referred to as "monies, etc." in this Article) as consideration for the violation or for ceasing the violation, regardless of the name given, such as price, remuneration, usage fee, or fee, the Commission must order the business handling personal information to pay to the national treasury an administrative monetary penalty in an amount equivalent to the amount calculated by the method specified by Cabinet Order as an amount equivalent to those monies, etc. (referred to as the "amount of consideration under paragraph (1)" in the following Article); provided, however, that the Commission may not order payment if the number of identifiable persons of the personal information or personal data (meaning personal data prescribed in Article 16, paragraph (3); the same applies in item (iii)) pertaining to the violation does not exceed 1,000, or in other cases specified by Cabinet Order as cases where the degree of harm to individual rights and interests is not great.

provision of personal information to a third party that is in a situation where it is anticipated that the third party will use that personal information to commit an unlawful act or unjustly discriminatory treatment;

use of personal information at the request of a third party, carried out where the third party is in a situation where it is anticipated that the third party will commit an unlawful act or unjustly discriminatory treatment through the use of that personal information;

provision of personal data in violation of the provisions of Article 27, paragraph (1) (including the cases in which it is applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1));

handling of personal information in violation of the provisions of Article 30-2, paragraph (4) or paragraph (9), or Article 31-3, paragraph (5);

provision of personal information in violation of the provisions of Article 30-2, paragraph (10) or paragraph (11), or Article 31-3, paragraph (6) or paragraph (7).

If a business handling personal information has acquired personal information in violation of Article 20, paragraph (1) and used that personal information (excluding the case where the business handling personal information is found not to be a person that failed to exercise reasonable care to prevent the acquisition and use throughout the period in which the acquisition and use were carried out), and has obtained monies, etc. as consideration for that use or for ceasing that use, the Commission must order the business handling personal information to pay to the national treasury an administrative monetary penalty in an amount equivalent to the amount calculated by the method specified by Cabinet Order as an amount equivalent to those monies, etc. (referred to as the "amount of consideration under paragraph (2)" in the following Article); provided, however, that the Commission may not order payment if the number of identifiable persons of the personal information pertaining to that use does not exceed 1,000, or in other cases specified by Cabinet Order as cases where the degree of harm to individual rights and interests is not great.

If the Commission is to issue an order under the paragraphs of the preceding Article (hereinafter referred to as a "payment order for administrative monetary penalty") and the business handling personal information has not complied with a requirement to submit a report or material under Article 146, paragraph (1) concerning the facts that are to form the basis for calculating the administrative monetary penalty pertaining to that payment order for administrative monetary penalty, the Commission may issue a payment order for administrative monetary penalty by estimating, by a reasonable method specified by Order of the Personal Information Protection Commission, the amount of consideration under paragraph (1) or the amount of consideration under paragraph (2) for the period in which the report or material on those facts has not been submitted and the Commission is unable to ascertain the facts that are to form the basis for calculating the administrative monetary penalty, using material obtained from the business handling personal information or another business that transacts with it, or from another business that conducts the same kind of business as the business pertaining to the act subject to administrative monetary penalty (meaning the violation prescribed in paragraph (1) of the preceding Article or the acquisition and use prescribed in paragraph (2) of that Article; the same applies hereinafter) pertaining to that payment order for administrative monetary penalty or another business that transacts with it, or other material.

If the Commission is to issue a payment order for administrative monetary penalty pursuant to the paragraphs of Article 148-3, and the business handling personal information is a person that has, within 10 years going back from the date on which collection of reports, etc. (meaning the requirement to submit a report or material or the on-site inspection under Article 146, paragraph (1); the same applies hereinafter in this Article, Article 148-7, paragraph (4) and Article 149, paragraph (1)) was first conducted regarding the case pertaining to the act subject to administrative monetary penalty pertaining to that payment order for administrative monetary penalty (or, if that collection of reports, etc. was not conducted, the date on which the business handling personal information received the notice under Article 148-10, paragraph (1) regarding that case), received a payment order for administrative monetary penalty under those paragraphs (limited to where that payment order for administrative monetary penalty has become final), and has committed that act subject to administrative monetary penalty on or after the date of that payment order for administrative monetary penalty, the Commission must order the person, in lieu of the amount under those paragraphs, to pay to the national treasury an administrative monetary penalty in an amount equivalent to 1.5 times that amount.

If the Commission is to issue a payment order for administrative monetary penalty pursuant to the paragraphs of Article 148-3, and the business handling personal information has reported to the Commission, as provided for by Order of the Personal Information Protection Commission, the facts constituting the act subject to administrative monetary penalty pertaining to that payment order for administrative monetary penalty, the Commission is to reduce from the amount of the administrative monetary penalty the amount obtained by multiplying the amount of the administrative monetary penalty calculated under those paragraphs (for a person prescribed in the preceding Article, the amount of the administrative monetary penalty calculated under that Article) by 50 percent; provided, however, that this does not apply if the report was made in anticipation that a payment order for administrative monetary penalty would be issued for the act subject to administrative monetary penalty as a result of an investigation of that act subject to administrative monetary penalty.