Act on the Protection of Personal Information

Identifiable persons may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify that person (hereinafter referred to as a "ceasing to use or deleting personal data" in this Article), if the personal data the business holds is being handled in violation of the provisions of Article 18, Article 19, Article 30-2, paragraph (4) or (9), Article 30-3, or Article 31-3, paragraph (5), or has been obtained in violation of the provisions of Article 20.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds to the extent necessary to redress the violation without delay; provided, however, that this does not apply if ceasing to use or deleting personal data in respect of the personal data the business holds would prove difficult because it would require a costly expenditure or due to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person.

Identifiable persons may request that a business handling personal information cease to provide a third party with the personal data the business holds that can be used to identify the person, if the personal data the business holds is being provided to a third party in violation of the provisions of Article 27, paragraph (1), Article 28, Article 30-2, paragraph (10), or Article 31-3, paragraph (6).

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to provide a third party with the personal data the business holds without delay; provided, however, that this does not apply if ceasing to provide a third party with the personal data the business holds would prove difficult because it would require a costly expenditure or due to other circumstances, and the businesses take the necessary alternative measures to protect an identifiable person's rights and interests.

An identifiable person may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify the person, or cease to provide a third party with the personal data the business holds, if it has ceased to be necessary for the business to use that personal data, if the situation concerning that personal data as prescribed in the main text of Article 26, paragraph (1) has occurred, or if handling that personal data is likely to harm the identifiable person's rights and interests.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds, to the extent necessary to prevent an infringement of the identifiable person's rights and interests without delay; provided, however, that this does not apply if ceasing to use or deleting personal data in respect of the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or due to other circumstances, and the businesses take the necessary alternative measures to protect the identifiable person's rights and interests.

An identifiable person may request that a business handling personal information cease to use or delete, or cease to provide a third party with, the specified biometric personal information that can be used to identify that person (limited to that included in the personal data the business holds), if that specified biometric personal information is being handled, except in the following cases:

cases in which the business handling personal information has created the specified biometric individual identification code included in that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information has acquired that specified biometric personal information with the consent of the identifiable person obtained in advance;

cases in which the business handling personal information handles that specified biometric personal information based on laws and regulations;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that specified biometric personal information in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that specified biometric personal information in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that specified biometric personal information from that academic research institution or the equivalent, or in which a specified biometric individual identification code created by converting information that the business handling personal information conducting academic research jointly with an academic research institution or the equivalent has acquired from that academic research institution or the equivalent is included in that specified biometric personal information, and the business needs to handle that specified biometric personal information for academic research purposes (including cases in which a part of the purpose of handling that specified biometric personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that specified biometric personal information by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the creation of the specified biometric individual identification code included in that specified biometric personal information or the circumstances of the acquisition of that specified biometric personal information, that handling it by the business handling personal information is not contrary to the intention of the identifiable person and therefore does not harm the person's rights and interests;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete that specified biometric personal information, or cease to provide a third party with it, without delay; provided, however, that this does not apply if ceasing to use or deleting personal data in respect of that specified biometric personal information or ceasing to provide a third party with it would prove difficult because it would require a costly expenditure or due to other circumstances, and the business takes the necessary alternative measures to protect the identifiable person's rights and interests.

An identifiable person under 16 years of age may request that a business handling personal information cease to use or delete, or cease to provide a third party with, the personal data the business holds that can be used to identify that person, if that personal data the business holds is being handled, except in the following cases:

cases in which the business handling personal information has acquired that personal data the business holds with the consent of the legal representative of the identifiable person obtained in advance;

cases in which the business handling personal information handles that personal data the business holds based on laws and regulations;

cases in which the business handling personal information needs to handle that personal data the business holds in order to protect the life, wellbeing, or property of an individual;

cases in which there is a special need for the business handling personal information to handle that personal data the business holds in order to improve public wellbeing or promote healthy child development;

cases in which the business handling personal information needs to handle that personal data the business holds in order to cooperate with a national government organ, a local government, or a person entrusted thereby in the performance of the functions prescribed by laws and regulations;

cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases in which the business handling personal information that conducts academic research jointly with an academic research institution or the equivalent has acquired that personal data the business holds from that academic research institution or the equivalent, and needs to handle that personal data the business holds for academic research purposes (including cases in which a part of the purpose of handling that personal data the business holds is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);

cases prescribed by Order of the Personal Information Protection Commission as cases in which it is obvious that handling that personal data the business holds by the business handling personal information is unavoidably necessary for the performance of the contract with the identifiable person, or other cases in which it is obvious, in light of the circumstances of the acquisition of that personal data the business holds, that handling it by the business handling personal information does not harm the rights and interests of the identifiable person under 16 years of age;

cases in which that personal data the business holds had been open to the public, at the time when the business handling personal information acquired it, by the legal representative of the identifiable person, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission;

cases in which the legal representative of the identifiable person had permitted the identifiable person to engage in business, and the business handling personal information acquired that personal data the business holds in connection with that business;

cases in which the identifiable person had used fraudulent means to make the business handling personal information believe that the identifiable person was 16 years of age or older;

other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.

If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds, without delay; provided, however, that this does not apply if ceasing to use or deleting personal data in respect of the personal data the business holds or ceasing to provide a third-party with that personal data would prove difficult because it would require a costly expenditure or due to other circumstances, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person under 16 years of age.

If a business handling personal information has ceased to use or deleted, or decided not to cease to use or delete, all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (1), (5), (7), or (9), or the business has ceased to provide a third party or decided not to cease to provide a third party with all or part of personal data the business holds or specified biometric personal information in connection with a request under paragraph (3), (5), (7), or (9), the business must notify the identifiable person to that effect without delay.

If, pursuant to the provisions of Article 32, paragraph (3), Article 33, paragraph (3) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (3) or paragraph (11) of the preceding Article, a business handling personal information notifies an identifiable person that it will not take all or part of the measures which the person has requested the business take, or that it will take different measures, the business must endeavor to explain its reasons for this to the person.