Order for enforcement of the Act on the Protection of Personal Information

Link to law: http://www.japaneselawtranslation.go.jp/law/detail_download/?ff=08&id=2263
Published: 2008

Subscribe to a Global-Regulation Premium Membership Today!

Key Benefits:

Subscribe Now
Order for enforcement of the Act on the Protection of Personal Information (Tentative translation)

The Cabinet hereby enacts this Cabinet Order pursuant to item (ii) of paragraph (2), item (iv) of paragraph (3) and paragraph (5) of Article 2, item (iv) of paragraph (1) of Article 24, paragraph (1) of Article 25, paragraph (1) and paragraph (3) of Article 29, paragraph (2) of Article 37, paragraph (1) of Article 40, Article 51, Article 52, and Article 55 of the Act on the Protection of Personal Information (Act No. 57 of 2003).

(Personal Information Database, etc.)

Article 1 The category of information designated by a Cabinet Order under item (ii) of paragraph (2) of Article 2 of the Act on the Protection of Personal Information (hereinafter called the "Act") is a set of information systematically arranged in such a way that specific personal information can be easily retrieved by organizing personal information contained therein according to certain rules, and has a table of contents, an index, or other arrangements that aids in retrieval.

(Exclusions from business operators handling personal information)

Article 2 An entity specified by a Cabinet Order under item (v) of paragraph (3) of Article 2 of the Act shall be an entity that has a total number of specific individuals identified by personal information constituting a personal information database, etc. used for its business (if all or part of the personal information databases, etc. concerned is arranged by another entity and is used for its business without editing or processing any of the information below, the number of specific individuals identified by the personal information that makes up all or part of the personal information databases, etc. concerned shall be excluded) not exceeding 5,000 on every single day in the last six months.

(i) Information which only contains the following as personal information

(a) name

(b) address or residence (including any indication on maps or the screen of a computer to locate address or residence)

(c) telephone number

(ii) Information published for the purpose of sale to many and unspecified persons that is or was available for purchase by many and unspecified persons as needed.

(Exclusions from Retained Personal Data)

Article 3 Personal data specified by a Cabinet Order under paragraph (5) of Article 2 of the Act shall be any of the cases as set forth below:

(i) Cases in which the life, body, or property of a person or a third party is likely to be threatened if the presence or absence of the personal data concerned is known.

(ii) Cases in which illegal or unjust acts is likely to be prompted or triggered if its presence or absence of the personal data concerned is known.

(iii) Cases in which national security is likely to be undermined, mutual trust with foreign countries or international organizations is likely to be damaged, or disadvantages when negotiating with other countries or international organizations is likely to be brought about if the presence or absence of the personal data concerned is known.

(iv) Cases in which crime prevention, control, investigation or other maintenance of public safety and order is likely to be impeded if the presence or absence of the personal data concerned is known.

(Period up to the Erasure of Data Excluded from Retained Personal Data)

Article 4 The period specified by a Cabinet Order under paragraph (5) of Article 2 of the Act shall be six months.

(Matters Necessary for Ensuring the Proper Handling of Retained Personal Data)

Article 5 Matters specified by a Cabinet Order under item (iv) of paragraph (1) of Article 24 of the Act shall be the matters as set forth below:

(i) The place where a complaint concerning the handling of retained personal data by the entity handling personal information concerned is lodged.

(ii) If the entity handling personal information concerned is a target entity of an authorized personal information protection organization, the place where the name of the authorized personal information protection organization concerned and the settlement of the complaint are lodged.

(Methods of Disclosing Retained Personal Data by Entities Handling Personal Information)

Article 6 The method specified by a Cabinet Order under paragraph (1) of Article 25 of the Act shall be the delivery by means of documents (or the method agreed upon by the person requesting disclosure, if any).

(Procedures for Receiving Requests for Disclosure and Others)

Article 7 Matters concerning procedures for receiving requests for disclosure and others that an entity handling personal information may determine pursuant to the provision of paragraph (1) of Article 29 of the Act shall be as set forth below:

(i) The place where requests for disclosure and others are to be filed

(ii) The format of the documents (including records made by an electronic method, magnetic method or any other method not recognizable to human senses) to be submitted and other methods of making requests for disclosure and others at the time of making requests for disclosure and others

(iii) Methods of checking a person making requests for disclosure and others as the individual or representative prescribed in the following article

(iv) Methods of collecting charges set forth in paragraph (1) of Article 30 of the Act

(Representative Eligible for Making Requests for Disclosure and Others)

Article 8 The representative who may make requests for disclosure and others pursuant to the provision of paragraph (3) of Article 29 of the Act shall be a representative set forth below:

(i) Statutory agent of a minor or an adult ward

(ii) Representative delegated by the person with making requests for disclosure and others.

(Application for Authorization as an Authorized Personal Information Protection Organization)

Article 9 (1) An application pursuant to the provisions of paragraph (2) of Article 37 of the Act must submit a written application to the competent minister, stating the following matters:

(i) Name and address of the applicant entity and the name of the representative or manager

(ii) The location of the business to be conducted pertaining to the application for authorization

(iii) An outline of the business pertaining to the application for authorization

(2) Written applications under the preceding paragraph must be accompanied by the documents enumerated below:

(i) The articles of incorporation, endowment and other memorandums of association

(ii) Written pledges that the entity applying for authorization is not under the provisions of each item of Article 38 of the Act

(iii) Documents describing the methods of conducting the business pertaining to the application for authorization

(iv) Documents demonstrating the fact that the applicant entity has sufficient knowledge and capability to properly and securely conduct the business pertaining to the application for authorization

(v) Business reports, balance sheets, inventories of assets and other documents demonstrating the fact that the applicant entity has an accounting base for the recent business years (for a corporation founded in the business year the application was submitted, an inventory of property as of the time of formation)

(vi) Documents stating the names, addresses, and brief biographical outlines of officers

(vii) Documents stating the names of the target entities and documents verifying that the target entities concerned are the members of the entity applying for authorization or those who have agreed to become the targets of the business pertaining to the application for authorization

(viii) If the applicant entity conducts businesses other than that pertaining to the application for authorization, documents describing the types and outlines of the businesses

(ix) Documents stating other matters for reference

(3) If a change is made to any matters enumerated in item (i) or item (ii) of paragraph (1) or any matters entered in any of the documents enumerated in item (ii) to item (iv), item (vi) or item (viii) of the preceding paragraph, an authorized personal information protection organization must submit a notice of that effect (for changes made to any matters entered in documents enumerated in item (iii) of the same paragraph, the reason for the change shall be included) to the competent minister without delay.

(Notification of Abolishment of Authorized Business)

Article 10 If an authorized personal information protection organization intends to discontinue its authorized business, it shall submit a notice stating the following matters to the competent minister three months prior to the date it plans to discontinue the business:

(i) Name and address of the organization and the name of the representative or manager

(ii) The last date the organization plans to receive requests under paragraph (1) of Article 42 of the Act

(iii) The date the organization plans to discontinue its authorized business

(iv) Reasons for discontinuing the authorized business

(Operations Handled by Heads of Local Governments, etc.)

Article 11 (1) The operations belonging to the authority of a competent minister set forth in Article 32 to Article 34 of the Act shall, if it is specified in the provision of other laws that a part or all of the operations belonging to the authority pertaining to the collection of a report, an inspection, a recommendation, and other supervisions concerning the business conducted by an entity handling personal information that falls under the jurisdiction of the competent minister concerned shall be conducted by the heads of local governments or other executive agencies (hereinafter called the "heads of local governments, etc." in this article), be conducted by the heads of the local governments, etc. concerned. In such cases, if more than one heads of local governments, etc. are supposed to conduct the operations concerned, nothing shall prevent each heads of local governments, etc. from independently conducting the operations belonging to the authority of the competent minister set forth in Article 32 and Article 33 of the Act.

(2) The operations belonging to the authority of a competent minister set forth in Article 37, Article 40, and Article 46 to Article 48 of the Act shall, if it is specified in the provisions of other laws that the operations belonging to the authority of a competent minister pertaining to the permission or approval of the foundation of an authorized personal information protection organization (including an entity that intends to be authorized under paragraph (1) of Article 37 of the Act) shall be conducted by the heads of local governments, etc., be conducted by the heads of local governments, etc. concerned.

(3) The provision of paragraph (1) shall not prevent the competent minister from conducting the operations set forth in the same paragraph on his/her own.

(4) The heads of local governments, etc. who has conducted the operations belonging to the authority of a competent minister set forth in paragraph (1) pursuant to the same paragraph shall promptly report the result to the competent minister.

(5) In the cases as set forth in paragraph (1) and paragraph (2), the provisions for a competent minister pertaining to the operations set forth in these provisions under the Act and this Cabinet Order shall apply to the heads of local governments, etc. as the provisions for the head of local governments, etc.

(Delegation of Authority or Operations)

Article 12 (1) A competent minister may, pursuant to the provision of Article 52 of the Act, delegate a portion of the authority or operations set forth in Article 32 to Article 34, Article 37, Article 39, Article 40, and Article 46 to Article 48 of the Act to the heads of agencies prescribed in paragraph (1) of Article 49 of Act for Establishment of the Cabinet Office (Act No. 89 of 1999), the heads of agencies prescribed in paragraph (2) of Article 3 of the National Government Organization Act (Act No. 120 of 1948) or the Commissioner General of the National Police Agency within his/her jurisdiction.

(2) A competent minister (if the authority or operations are delegated pursuant to the provisions of the preceding paragraph to the heads of agencies prescribed in paragraph (1) of Article 49 of Act for Establishment of the Cabinet Office or the heads of agencies prescribed in paragraph (2) of Article 3 of the National Government Organization Act, the heads of the agencies) may, pursuant to the provision of Article 52 of the Act, delegate a portion of the authority or operations set forth in Article 32 to Article 34, Article 37, Article 39, Article 40, and Article 46 to Article 48 of the Act to the heads of the secretariats, bureaus or departments prescribed in Article 17 or Article 53 of the Cabinet Office Establishment Law, offices prescribed in paragraph (1) of Article 17 or paragraph (1) or paragraph (2) of Article 62 of the same law, the heads of local branch offices prescribed in Article 43 or Article 57 of the same law, or the heads of the secretariat, bureaus or departments prescribed in Article 7 of the National Government Organization Act, the heads of local branch offices prescribed in Article 9 of the same law, or offices prescribed in paragraph (1) or paragraph (2) of Article 20 of the same law within his/her jurisdiction.

(3) The Commissioner General of the National Police Agency may, pursuant to the provision of Article 52 of the Act, delegate the authority or operations delegated pursuant to paragraph (1) to the heads of the Commissioner General's Secretariat, bureaus prescribed in paragraph (1) of Article 19 of the Police Act (Act No. 162 of 1954), departments prescribed in paragraph (2) of the same article or regional institutions prescribed in paragraph (1) of Article 30 of the same law.

(4) The competent minister, the heads of agencies prescribed in paragraph (1) of Article 49 of Act for Establishment of the Cabinet Office, the heads of agencies prescribed in paragraph (2) of Article 3 of the National Government Organization Act, or the Commissioner General of the National Police Agency must publicly announce the office of the personnel to be delegated, the authority or operations to be delegated, and the date the delegation comes into effect when he or she intends to delegate the authority or the operations pursuant to the provisions of the preceding three paragraphs.

(Exercise of Authority by the Competent Minister)

Article 13 (1) If more than one competent minister have jurisdiction over the handling of personal information conducted by an entity handling personal information pursuant to the provision of paragraph (1) of Article 36 of the Act, nothing shall prevent each competent minister from independently exercising the authority prescribed in Article 32 and Article 33 of the Act.

(2) The competent minister who has independently exercised his/her authority pursuant to the provision of the preceding paragraph shall promptly report the result to other competent ministers.

Supplementary Provisions

This Cabinet Order shall be enforced as of the date of promulgation. However, the provisions of Article 5 to Article 13 shall be enforced as of April 1, 2005.

Supplementary Provisions [Cabinet Order No. 389 of December 10, 2004]

This Cabinet Order shall be enforced as of the date of promulgation and the provision of Article 2 of the Cabinet Order for the enforcement of the Act on the Protection of Personal Information revised by this Cabinet Order is applied as of October 1, 2004.

Supplementary Provisions [Cabinet Order No. 166 of May 1, 2008]

(Effective Date)

(1) This Cabinet Order shall be enforced as of the date of promulgation.

(Transitional Measures)

(2) For the request of reports or orders and the application of penal provisions over violations of Article 57 or 58 of the Act, pertaining to entities handling personal information that were requested for reports pursuant to Article 32 of the Personal Information Protection Act or received orders pursuant to paragraph (2) or paragraph (3) of Article 34 before this Cabinet Order was promulgated, and that became not to fall into entities handling personal information by applying the revised item (ii) of Article 2 of this Cabinet Order, remain applicable.