①The Personal Information Protection Commission (hereinafter referred to as the "Commission") is to be established based on the provisions of Article 49, paragraph (3) of the Act for Establishment of the Cabinet Office.

②The Commission belongs to the jurisdiction of the Prime Minster.

The Commission is to assume the duties of pursuing ensuring the proper handling of personal information (including taking measures such as giving guidance and advice to a person in charge of a process using an individual number, etc. (meaning a person in charge of a process using an individual number, etc. as prescribed in Article 12 of the Act on the Use of Numbers to Identify a Specific Individual in the Administrative Procedure (Act No.27 of 2013; hereinafter referred to as the "Number Use Act"))) in order to protect individual rights and interests while ensuring smooth and proper management of the processes or services of administrative entities as well as ensuring due consideration of the value of personal information, and the fact that the proper and effective application of personal information contributes to the creation of new industries and the realization of a vibrant economic society and enriching quality of life for the Japanese public.

The Commission is to administer the following affairs in order to fulfil the duties referred to in the preceding Article:

A chairperson and commissioners of the Commission exercise their official authority independently.

①The Commission is to be composed of a chairperson and eight commissioners.

②Four of the commissioners are to serve on a part-time basis.

③A chairperson and a commissioner are to be appointed by the Prime Minister with consent of both Houses of the Diet from among those with high character and deep insight.

④A chairperson and commissioners are to encompass a person who has relevant expertise on protection of personal information, and its proper and effective application; a person who has sufficient knowledge and experience to protect consumers; a person who has relevant expertise on information processing technologies; a person who has relevant expertise in public administrative fields; a person who has sufficient knowledge and experience on private-sector business practices; and a person recommended by a federate organization (meaning a federate organization under Article 263-3, paragraph (1) of the Local Autonomy Act that has given a notification under that paragraph).

①The term of office for a chairperson or commissioner is to be five years; provided, however, that the term of office of a chairperson or commissioner appointed to fill a vacancy is to be the remaining term of office of the predecessor.

②A chairperson or commissioner may be reappointed.

③When the term of office for a chairperson or commissioner has expired, the chairperson or commissioner is to continue to fulfil their duties until their successor is appointed.

④Notwithstanding the provisions of paragraph (3) of the preceding Article, if the term of office of a chairperson or commissioner has expired or a vacancy has occurred, but the consent of both Houses of the Diet is not able to be obtained due to the closing of the Diet or the dissolution of the House of Representatives, the Prime Minister may appoint a chairperson or commissioner from among those who have those qualifications prescribed in that paragraph.

⑤In the case referred to in the preceding paragraph, subsequent approval by both Houses of the Diet must be obtained in the first Diet session after the appointment. In this case, if the subsequent approval by both Houses of the Diet is not able to be obtained, the Prime Minister must immediately dismiss the chairperson or commissioner.

Neither a chairperson nor a commissioner may be dismissed against their will while in office, except cases falling under one of the following items:

If a chairperson or commissioner falls under one of the items of the preceding Article, the Prime Minister must dismiss the chairperson or commissioner.

①A chairperson is to preside over rules and proceedings of the Commission and represent the Commission.

②The Commission must designate in advance from among full-time commissioners an acting chairperson in cases in which the chairperson is unavailable.

①A meeting of the Commission is to be called by a chairperson.

②The Commission may neither hold a meeting nor make a decision, unless a chairperson and four or more commissioners are present.

③A decision of the Commission is to be adopted by a majority of attendees, and when in a tie, a chairperson is to make a decision.

④Notwithstanding the provisions of the preceding paragraph, there must be an unanimous concurrence of all commissioners on the recognition under Article 136, item (iv), except for the commissioner concerned.

⑤In applying the provisions of paragraph (2) in cases in which a chairperson is unavailable, an acting chairperson as prescribed in paragraph (2) of the preceding Article is deemed as a chairperson.

①A specialist commissioner may be assigned to the Commission in order to investigate specialized matters.

②A specialist commissioner is to be appointed by the Prime Minister based on a proposal made by the Commission.

③A specialist commissioner is to be dismissed when they finish their investigation into the specialized matters.

④A specialist commissioner is to serve on a part-time basis.

①The secretariat is to be established for the purpose of administrating the Commission's affairs.

②The secretary general and other staff are to be assigned to the secretariat.

③The secretary general is to administer the secretariat's affairs in accordance with the order of the chairperson.

①Neither a chairperson nor a commissioner may become an officer of a political party or other political organization or actively conduct a political campaign, while in office.

②Except cases in which there has been permission from the Prime Minister, a chairperson or full-time commissioner, while in office, must not engage in any other jobs with remuneration, run a profit-making business, or perform other services for the purpose of gaining monetary profit.

The chairperson, commissioners, specialist commissioners, and secretarial staff must not divulge or misappropriate any secret that have come to their knowledge in the course of duties. The same also applies after they have left their position.

The remuneration of the chairperson and commissioners is prescribed separately by law.

The Commission may establish the Order of the Personal Information Protection Commission regarding its function under the jurisdiction in order to enforce a law or Cabinet Order, or on the basis of a special delegation under a law or Cabinet Order.

①The Commission may require a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, a business handling information related to personal information (hereinafter referred to as a "business handling personal or other related information" in this Subsection), or other concerned person to submit necessary information or material relating to the handling of personal information, pseudonymized personal information, anonymized personal information, or information related to personal information (hereinafter referred to as "personal or other related information" in this Subsection and Subsection 3), or have its officials enter a business office or other necessary place of a business handling personal or other related information or other concerned person, inquire about the handling of personal or other related information, or inspect a book, document, or other item, to the extent necessary to implement the provisions of Chapter IV (excluding Section 5; the same applies in the following Article and Article 151).

②An official who conducts an on-site inspection pursuant to the provisions of the preceding paragraph must carry a certificate for identification, and present it when requested by a person concerned.

③An on-site inspection authority under paragraph (1) must not be construed as granted for a criminal investigation.

The Commission may provide a business handling personal or other related information with necessary guidance and advice on the handling of personal or other related information, to the extent necessary to implement the provisions of Chapter IV.

①The Commission may recommend a business handling personal or other related information to stop committing the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need for protecting individual rights and interests in cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Article 21 (including the cases in which the provisions of paragraphs (1), (3) and (4) are applied pursuant to the Article 41, paragraph (4) following the deemed replacement of terms), Articles 23 through 26, Article 27 (excluding paragraph (4), and including the cases in which the provisions of paragraphs (5) and (6) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 28, Article 29 (including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 30 (excluding paragraph (2), and including the cases in which the provisions of the proviso of paragraph (1) are applied pursuant to Article 41, paragraph (6) following the deemed replacement of terms), Article 32, Article 33 (excluding paragraph (1) (including as applied mutatis mutandis pursuant to paragraph (5))), Article 34, paragraph (2) or paragraph (3), Article 35 (excluding paragraphs (1), (3) and (5)), Article 38, paragraph (2), Article 41 (excluding paragraphs (4) and (5)) or Article 43 (excluding paragraph (6)); in cases in which a business handling information related to personal information has violated the provisions of Article 31, paragraph (1), has violated the provisions of Article 28, paragraph (3) as applied mutatis mutandis pursuant to Article 31, paragraph (2) following the deemed replacement of terms, or has violated the provisions of Article 30, paragraph (3) or paragraph (4) as applied mutatis mutandis pursuant to Article 31, paragraph (3) following the deemed replacement of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of Article 42, paragraph (1), has violated Article 27, paragraph (5) or paragraph (6) as applied mutatis mutandis pursuant to Article 42, paragraph (2) following the deemed replacement of terms, or has violated the provisions of Articles 23 through 25 or Article 41, paragraph (7) or paragraph (8) as applied mutatis mutandis pursuant to Article 42, paragraph (3) following the deemed replacement of terms; or in cases in which a business handling anonymized personal information has violated the provisions of Article 44 or Article 45.

②If a business handling personal or other related information has received a recommendation under the preceding paragraph but has not taken measures in line with the recommendation without legitimate grounds, and the Commission finds that a serious infringement of individual rights and interests is impending, the Commission may order the business handling personal or other related information to take measures in line with the recommendation.

③Notwithstanding the provisions of the preceding two paragraphs, the Commission may order a business handling personal or other related information to stop the following violations or take other necessary measures to rectify the violation, if the Commission finds that there is a need to take urgent measures because there is a fact that seriously prejudices individual rights and interests in cases in which a business handling personal information has violated the provisions of Articles 18 through 20, Articles 23 through 26, Article 27, paragraph (1), Article 28, paragraph (1) or paragraph (3), Article 41, paragraphs (1) through (3), or paragraphs (6) through (8), or Article 43, paragraph (1), paragraph (2) or paragraph (5); in cases in which a business handling information related to personal information has violated the provisions of Article 31, paragraph (1), or has violated the provisions of Article 28, paragraph (3) as applied mutatis mutandis pursuant to Article 31, paragraph (2) following the deemed replacement of terms; in cases in which a business handling pseudonymized personal information has violated the provisions of Article 42, paragraph (1), or has violated the provisions of Articles 23 through 25 or Article 41, paragraph (7) or paragraph (8) as applied mutatis mutandis pursuant to Article 42, paragraph (3) following the deemed replacement of terms; or in cases in which a business handling anonymized personal information has violated the provisions of Article 45.

④If the Commission has issued an order under the preceding two paragraphs and the business handling personal or other related information that has received the order has violated the order, the Commission may make public announcement to that effect.

①When requiring a business handling personal or other related information to submit a report or material, conducting its on-site inspection, or giving a guidance, advice, recommendation or order to it, pursuant to the provisions of the preceding three Articles, the Commission must not preclude the freedom of expression, freedom of academia, freedom of religion, and freedom of political activity.

②In light of the purport of the provisions of the preceding paragraph, the Commission is not to exercise its authority when a business handling personal or other related information provides personal or other related information to a person set forth in one of the items of Article 57, paragraph (1) (limited to cases in which the person handles personal or other related information for the purpose prescribed in those items).

①If the Commission finds that there is a need for effectively giving a business handling personal or other related information a recommendation under Article 148, paragraph (1) or order under Article 148, paragraph (2) or paragraph (3) because there is a need to urgently and intensively ensure the proper handling of personal or other related information or similar other circumstances prescribed by Cabinet Order, the Commission may delegate an authority under Article 26, paragraph (1); under Article 146, paragraph (1); under Article 100, paragraph (1), Article 101, Article 102-2, Article 103, Article 105, Article 106 or Article 108 of the Code of Civil Procedure (Act No. 109 of 1996) as applied mutatis mutandis pursuant to the provisions of Article 162 following the deemed replacement of terms; under Article 163; and under Article 164 to the competent minister for the business, as prescribed by Cabinet Order.

②When having exercised an authority delegated pursuant to the provisions of the preceding paragraph, the competent minister for the business is to report its results to the Commission as prescribed by Cabinet Order.

③The competent minister for the business may delegate all or part of an authority delegated pursuant to the provisions of paragraph (1) or all or part of an authority under the preceding paragraph to the head of a local branch bureau under Article 43 of the Act for Establishment of the Cabinet Office or other bureau or organ prescribed by Cabinet Order, pursuant to the provisions of Cabinet Order.

④The Prime Minister delegates an authority delegated pursuant to the provisions of paragraph (1) and an authority under paragraph (2) (limited to those relating to the Financial Services Agency's jurisdiction and excluding those prescribed by Cabinet Order) to the Commissioner of the Financial Services Agency.

⑤The Commissioner of the Financial Services Agency may delegate a part of an authority delegated pursuant to the provisions of the preceding paragraph to the Securities and Exchange Surveillance Commission, pursuant to the provisions of Cabinet Order.

⑥The Commissioner of the Financial Services Agency may delegate a part of an authority delegated pursuant to the provisions of paragraph (4) (excluding those delegated to the Securities and Exchange Surveillance Commission pursuant to the provisions of the preceding paragraph) to the director-general of a local finance bureau or local finance branch bureau, pursuant to the provisions of Cabinet Order.

⑦The Securities and Exchange Surveillance Commission may delegate a part of an authority delegated pursuant to the provisions of paragraph (5) to the director-general of a local finance bureau or local finance branch bureau, pursuant to the provisions of Cabinet Order.

⑧As for administrative affairs relating to an authority delegated to the director-general of a local finance bureau or local finance branch bureau pursuant to the provisions of the preceding paragraph, the Securities and Exchange Surveillance Commission directs and supervises the director-general of a local finance bureau or local finance branch bureau.

⑨In the case referred to in paragraph (5), an appeal for review concerning the Securities and Exchange Surveillance Commission's requiring the submission of a report or material (including cases in which the director-general of a local finance bureau or local finance branch bureau does so pursuant to the provisions of paragraph (7)) may only be filed against the Securities and Exchange Surveillance Commission.

If the competent minister for the business finds that a business handling personal or other related information has committed an act violating the provisions of Chapter IV, or there is a need for ensuring the proper handling of personal or other related information by a business handling personal or other related information, the minister may request that the Commission take appropriate measures in accordance with the provisions of this Act.

The competent minister for the business in the provisions of this Subsection is as follows:

The Commission may call for a certified personal information protection organization to report on its certified services, to the extent necessary to implement the provisions of Section 5 of Chapter IV.

The Commission may order a certified personal information protection organization to improve a method of rendering certified services, alter personal information protection guidelines, or take any other necessary measures, to the extent necessary to implement the provisions of Section 5 of Chapter IV.

①If a certified personal information protection organization falls under one of the following items, the Commission may rescind the certification:

②When having rescinded a certification pursuant to the provisions of the preceding paragraph, the Commission must announce to the public to that effect.

If the Commission finds it necessary for smooth application of the provisions of the preceding Chapter, the Commission may request an administrative organ's head or administrative entity (excluding the President of the Board of Audit; hereinafter the same applies in this Subsection) to submit materials on and explain the state of implementation concerning the handling of personal or other related information by an administrative entity, or may have its employees conduct firsthand inspection.

If the Commission finds it necessary for smooth application of the provisions of the preceding Chapter, the Commission may give necessary guidance and advice to an administrative organ's head or administrative entity concerning the handling of personal or other related information by an administrative entity.

If the Commission finds it necessary for smooth application of the provisions of the preceding Chapter, the Commission may give recommendations to an administrative organ's head or administrative entity concerning the handling of personal or other related information by an administrative entity.

When the Commission gives recommendations to an administrative organ's head or administrative entity pursuant to the provisions of the preceding Article, the Commission may request that head or entity to report on measures that they have taken based on the recommendations.

In light of the purpose of the provisions of Article 149, paragraph (1), the Commission is not to exercise its authority when an administrative organ's head or administrative entity provides personal or other related information to a person set forth in one of the items of Article 57, paragraph (1) (limited to the case in which the person handles personal or other related information for the purpose specified in those items).

①For a requirement to submit a report or material under Article 146, paragraph (1), a recommendation under Article 148, paragraph (1), an order under paragraph (2) or paragraph (3) of that Article, a call for a report under Article 153, an order under Article 154, or a rescission under Article 155, paragraph (1), a document specified by Order of the Personal Information Protection Commission must be served.

②For an order under Article 148, paragraph (2) or paragraph (3), or Article 154, or a notice under Article 15, paragraph (1) or Article 30 of the Administrative Procedure Act (Act No. 88 of 1993) relating to a rescission under Article 155, paragraph (1), a document referred to in Article 15, paragraphs (1) and (2) or Article 30 of that Act must be served. In this case, the provisions of Article 15, paragraph (3) of that Act (including as applied mutatis mutandis pursuant to Article 31 of that Act following the deemed replacement of terms) do not apply.

The provisions of Article 100, paragraph (1), Article 101, Article 102-2, Article 103, Article 105, Article 106, and Article 108 of the Code of Civil Procedure apply mutatis mutandis to the service under the preceding Article. In this case, the term "court" in Article 100, paragraph (1) of the Code and the term "presiding judge" in Article 108 of the Code are deemed to be replaced by "Personal Information Protection Commission", and the term "court execution officer" in Article 101, paragraph (1) of the Code is deemed to be replaced by "official of the Personal Information Protection Commission".

①The Commission may effect service by publication in the following cases:

②A posting to the effect that the documents to be served will be delivered at any time to the person to be served is made on the notice board of the Commission to effect service by publication.

③Service by publication becomes effective once two weeks have elapsed since the date on which the posting under the preceding paragraph was commenced.

④Regarding service by publication in lieu of service to be made in a foreign country, the period referred to in the preceding paragraph is six weeks.

When an official of the Commission has, pursuant to Article 7, paragraph (1) of the Act on the Advancement of Government Administration Processes That Utilize Information and Communications Technology (Act No. 151 of 2002), used the electronic data processing system prescribed in Article 6, paragraph (1) of that Act for administrating affairs related to a disposition notice, etc. prescribed in Article 3, item (ix) of that Act for which a document under Article 161 of this Act is to be served, the official must use that electronic data processing system to record the particulars of the service under Article 100, paragraph (1) of the Code of Civil Procedure as applied mutatis mutandis pursuant to Article 162 following the deemed replacement of terms, in a file that is stored on a computer (including input or output device) used by the Commission, instead of preparing and submitting a document that states those particulars.

①The Commission may request an administrative organ's head or administrative entity to report on the status of enforcement of this Act.

②Each year the Commission is to compile reports referred to in the preceding paragraph and make a summary of those reports public.

①When a local government finds it necessary for ensuring the proper handling of personal information by a local government organ, a local incorporated administrative agency or a business, the local government may request the Commission to provide it with necessary information or technical advice.

②When requested pursuant to the provisions of the preceding paragraph, the Commission is to provide necessary information or technical advice.

①When the head of a local government has prescribed the local ordinance pursuant to the provisions of this Act, that head must notify the Commission of this and the content of that ordinance pursuant to Order of the Personal Information Protection Commission without delay.

②When a notification under the preceding paragraph has been given, the Commission must disclose the matters relating to that notification through the use of the Internet or other appropriate means.

③The provisions of the preceding two paragraphs apply mutatis mutandis to any alteration to matters relating to the notification under paragraph (1).

The Commission must annually report to the Diet through the Prime Minister on the current status of administering function under the jurisdiction, and disclose its summary.

The Commission is to establish a comprehensive information center for ensuring the smooth implementation of the provisions of this Act.

Administrative affairs under the Commission's authority prescribed in this Act or under an authority that has been delegated to the competent minister for the business or to the Commissioner of the Financial Services Agency pursuant to the provisions of Article 150, paragraph (1) or paragraph (4) may be managed by the head of a local government or other executive agency as prescribed by Cabinet Order.