①By the Effective Date, the Government is to, in light of the purpose of the provisions of the New Act on the Protection of Personal Information, review how the handling of the personal information as set forth in Article 2, paragraph (2) of the Act on the Protection of Personal Information Held by Administrative Organs that is held by administrative organs as set forth in paragraph (1) of that Article and of the personal information as set forth in Article 2, paragraph (2) of the Act on the Protection of Personal Information Held by Incorporated Administrative Agencies, etc. (Act No. 59 of 2003) that is held by incorporated administrative agencies or other prescribed corporations as set forth in paragraph (1) of that Article (hereinafter collectively referred to as "personal information held by administrative organs, etc." in this Article) should be regulated, including having the Personal Information Protection Commission give guidance, advice, etc. in a unified and cross-cutting manner concerning the handling of anonymized personal information the administrative entity holds, from the perspective of promoting the smooth and prompt use of anonymized personal information (meaning anonymized personal information as set forth in Article 2, paragraph (9) of the New Act on the Protection of Personal Information, and including anonymized personal information the administrative entity holds (meaning anonymized personal information obtained by processing personal information held by administrative organs, etc.; the same applies hereinafter in this paragraph)), and take required measures based on the results.

②The Government is to, around three years after this Act comes into effect, review the improvement of the formulation and promotion of the basic policy on the protection of personal information and the other functions under the jurisdiction of the Personal Information Protection Commission, taking into consideration the status of the development of the personnel structure, the securing of financial resources and other measures necessary to carry out those functions effectively, and, if it finds it necessary, take required measures based on the results.

③In addition to the matters provided for in the preceding paragraph, the Government is to, around three years after this Act comes into effect, review the status of the enforcement of the New Act on the Protection of Personal Information, taking into consideration international trends concerning the protection of personal information, the advancement of information and communications technology, the status of the creation and development of new industries utilizing personal information that accompany that advancement, etc., and, if it finds it necessary, take required measures based on the results.

④The Government is to, around three years after the provisions set forth in Article 1, item (vi) of the Supplementary Provisions come into effect, review measures for financial institutions as set forth in Article 2, paragraph (1) of the Deposit Insurance Act (Act No. 34 of 1971) to be appropriately provided with Individual Numbers by depositors, etc. as set forth in paragraph (3) of that Article, or for agricultural and fishery cooperatives as set forth in Article 2, paragraph (1) of the Agricultural and Fishery Cooperatives Savings Insurance Act (Act No. 53 of 1973) to be appropriately provided with Individual Numbers by savers, etc. as set forth in paragraph (3) of that Article, and the status of the enforcement of the Number Use Act as amended by Article 7, and, if it finds it necessary, take required measures based on the results while gaining citizens' understanding.

⑤In view of the importance of the precise formulation and implementation of measures concerning cybersecurity (meaning cybersecurity as set forth in Article 2 of the Basic Act on Cybersecurity (Act No. 104 of 2014)) in ensuring the security of personal information held by national administrative entities, the Government is to review the development, etc. of systems for the formulation and implementation of measures at national administrative entities based on the standards set forth in Article 13 of that Act, and take required measures based on the results.

⑥The Government is to, in light of the status of the enforcement of the New Act on the Protection of Personal Information, the status of the implementation of the measures referred to in paragraph (1), and other circumstances, review what the legal system concerning the protection of personal information should be, including consolidating the provisions concerning the protection of personal information as set forth in Article 2, paragraph (1) of the New Act on the Protection of Personal Information and of personal information held by administrative organs, etc., and providing for them in an integrated manner.