①"Personal information the administrative entity holds" in this Chapter and Chapter VIII means personal information that an employee of an administrative entity (in a case of an incorporated administrative agency or other prescribed corporation or a local incorporated administrative agency, its officer is included; hereinafter the same applies in this Chapter and Chapter VIII) prepares or acquires in the course of that employee's duties, and that administrative entity holds for organizational use by its employees; provided, however, that the personal information the administrative entity holds is limited to personal information recorded in administrative or similar documents (meaning administrative documents prescribed in Article 2, paragraph (2) of the Act on Access to Information Held by Administrative Organs (Act No. 42 of 1999; hereinafter referred to as the "Administrative Organs Information Disclosure Act" in this Chapter)), corporate documents (meaning corporate documents prescribed in Article 2, paragraph (2) of the Act on Access to Information Held by Incorporated Administrative Agencies (Act No. 140 of 2001); hereinafter referred to as "Incorporated Administrative Agencies Information Disclosure Act" in this Chapter; those documents include those listed in item (iv) of that paragraph), or local government documents (meaning documents, drawings, or electronic or magnetic records that an employee of a local government organ or local incorporated administrative agency prepares or acquires in the course of that employee's duties, and that local government organ or local incorporated administrative agency holds for organizational use by its employees; and excluding those prescribed by Cabinet Order as equivalent to those set forth in the items of Article 2, paragraph (2) of the Administrative Organs Information Disclosure Act) (the above-mentioned documents are hereinafter collectively referred to as "administrative or similar documents" in this Chapter).

②"Personal information file" in this Chapter and Chapter VIII means a collective body of information comprised of personal information the administrative entity holds, as set forth below:

③"Anonymized personal information the administrative entity holds" in this Chapter means any anonymized personal information that can be prepared in a way that processes all or a part of personal information the administrative entity holds that constitutes a personal information file that falls under all of the following items (if a part of that personal information the administrative entity holds contains non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article; hereinafter the same applies in this paragraph), non-disclosure information prescribed in Article 5 of the Incorporated Administrative Agencies Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article), or non-disclosure information prescribed in the information disclosure ordinance of local government (meaning a local government's ordinance which provides for the resident's or other equivalent person's right to request the disclosure of information the local government organ or local incorporated administrative agency holds; hereinafter the same applies in this Chapter) (that non-disclosure information means information equivalent to non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act), the part containing the above-mentioned non-disclosure information is excluded):

④The term "anonymized personal information file the administrative entity holds" in this Chapter means a collective body of information comprised of anonymized personal information the administrative entity holds, as set forth below:

⑤The term "sensitive personal information prescribed by local ordinance" in this Chapter means personal information (excluding sensitive personal information) that is held by a local government organ or local incorporated administrative agency and that is comprised of identifiers or their equivalent prescribed by a local government's ordinance, accounting for the regional characteristics and other circumstances, as those of which the handling requires special care so as not to cause unfair discrimination, prejudice, or other disadvantage to the identifiable person.

①Administrative entities may hold personal information only when necessary for conducting processes and functions under the jurisdiction provided by laws and regulations (including local ordinances; the same applies in Article 66, paragraph (2), items (iii) and (iv), Article 69, paragraph (2), items (ii) and (iii), and Section 4), and must specify the purpose of use of personal information as much as possible when holding this information.

②Administrative entities must not hold personal information beyond the extent necessary for the purpose of use specified pursuant to the provisions of the preceding paragraph.

③Administrative entities must not alter the purpose of use beyond a reasonable extent from that of the original purpose of use.

Before an administrative entity directly acquires personal information on an identifiable person that is recorded in a document (including an electronic or magnetic record), the administrative entity must clearly indicate the purpose of use to that person, except in the following cases:

The head of an administrative organ (for any organ designated by Cabinet Order referred to in Article 2, paragraph (8), items (iv) and (v), the head is designated for each respective organ by Cabinet Order; hereinafter the same applies in this Chapter and Article 174), a local government organ, an incorporated administrative agency or other prescribed corporation, and a local incorporated administrative agency (hereinafter referred to as an "administrative organ's head or administrative entity" in this Chapter and the following Chapter) must not utilize personal information using a method that has the possibility of fomenting or inducing unlawful or unjust act.

An administrative organ's head or administrative entity must not acquire personal information by deception or other wrongful means.

An administrative organ's head or administrative entity must endeavor to keep personal information the head or entity holds consistent with the past or the present facts within the scope necessary for fulfilling the purpose of use.

①An administrative organ's head or administrative entity must take necessary and appropriate measures for managing the security of personal information the administrative entity holds, preventing its leaking, loss or damage.

②The provisions of the preceding paragraph apply mutatis mutandis to cases in which a person set forth in each following item handles personal information in conducting services as prescribed in each item respectively:

An employee or a former employee of an administrative entity that handles personal information, a person engaged in or formerly engaged in business prescribed in each item of paragraph (2) of the preceding Article, or a staffing agency worker or a former staffing agency worker (meaning a staffing agency worker prescribed in Article 2, item (ii) of the Act on Securing the Proper Operation of Worker Dispatching Businesses and Protecting Dispatched Workers (Act No. 88 of 1985); hereinafter the same applies in this Chapter and Article 176) that handles personal information must not disclose personal information acquired in the course of that employee's work to other persons without reason or use this information for an unjust purpose.

①If there is a leak, loss or damage and other situation concerning the security of the personal information an administrative entity holds as prescribed by Order of the Personal Information Protection Commission that is highly likely to harm individual rights and interests, the administrative organ's head or administrative entity must report to that effect to the Personal Information Protection Commission, pursuant to Order of the Personal Information Protection Commission.

②In cases prescribed in the preceding paragraph, an administrative organ's head or administrative entity must notify an identifiable person of the occurrence of the situation pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply to cases falling under any of each following item: