Home | Databases | WorldLII | Search | Feedback Privacy Law Resources

Cabinet Order for the enforcement of the Act on the Protection of Personal Information (Japan) [2003] PrivLRes 2 (10 December 2003)

	[Home] [Databases] [Search] [Feedback] [Help]

Cabinet Order for the enforcement of the Act on the Protection of Personal Information (Japan) - [2003] PrivLRes 2

Cabinet Order stipulating the date of enforcement of a part of

the Act on the Protection of Personal Information

(Tentative Translation)

[Cabinet Order 506, 2003]

[Promulgated on December 10, 2003]

[Enforced on December 10, 2003]

The Cabinet hereby enacts this Cabinet Order pursuant to the provision of the proviso to Article 1 of the Supplementary Provisions of the Act on the Protection of Personal Information (Law No. 57 of 2003).

The date of enforcement of the provision set forth in the proviso to Article 1 of the Supplementary Provisions of the Act on the Protection of Personal Information shall be April 1, 2005.

Cabinet Order for the enforcement of

the Act on the Protection of Personal Information

(Tentative Translation)

[Cabinet Order 507, 2003]

[Promulgated on December 10, 2003]

[Enforced on December 10, 2003]

The Cabinet hereby enacts this Cabinet Order pursuant to Item 2 of Paragraph 2, Item 4 of Paragraph 3 and Paragraph 5 of Article 2, Item 4 of Paragraph 1 of Article 24, Paragraph 1 of Article 25, Paragraph 1 and Paragraph 3 of Article 29, Paragraph 2 of Article 37, Paragraph 1 of Article 40, Article 51, Article 52, and Article 55 of the Act on the Protection of Personal Information (Law No. 57 of 2003).

Article 1 (Personal Information Database, etc.)

The category of information designated by a Cabinet Order under Item 2 of Paragraph 2 of Article 2 of the Act on the Protection of Personal Information (hereinafter called the “Act”) is a set of information systematically arranged in such a way that specific personal information can be easily retrieved by organizing personal information contained therein according to certain rules, and has a table of contents, an index, or other arrangements that aids in retrieval.

Article 2 (Exclusions from Entities Handling Personal Information)

An entity specified by a Cabinet Order under Item 5 of Paragraph 3 of Article 2 of the Act shall be an entity that has a total number of specific individuals identified by personal information that makes up personal information databases, etc. used for its business (if all or part of the personal information databases, etc. concerned arranged by another entity only incorporate names, addresses, whereabouts (including any indication on maps or computer displays to locate addresses or whereabouts) or telephone numbers as personal information and is used for its business without editing or processing, the number of specific individuals identified by the personal information that makes up all or part of the personal information databases, etc. concerned shall be excluded) not exceeding 5,000 on every single day in the last six months.

Article 3 (Exclusions from Retained Personal Data)

Personal data specified by a Cabinet Order under Paragraph 5 of Article 2 of the Act shall be any of the cases as set forth below:

(1) Cases in which the life, body, or property of a person or a third party might be threatened if presence or absence of the personal data concerned is revealed.

(2) Cases in which illegal or unjust acts might be prompted or triggered if the presence or absence of the personal data concerned is revealed.

(3) Cases in which national security might be undermined, mutual trust with foreign countries or international organizations might be damaged, or disadvantages when negotiating with other countries or international organizations might be brought about if the presence or absence of the personal data concerned is revealed.

(4) Cases in which crime prevention, control, investigation or other maintenance of public safety and order might be impeded if the presence or absence of the personal data concerned is revealed.

Article 4 (Period up to the Erasure of Data Excluded from Retained Personal Data)

The period specified by a Cabinet Order under Paragraph 5 of Article 2 of the Act shall be six months.

Article 5 (Matters Necessary for Ensuring the Proper Handling of Retained Personal Data)

Matters specified by a Cabinet Order under Item 4 of Paragraph 1of Article 24 of the Act shall be the matters as set forth below:

(1) The place where a complaint concerning the handling of retained personal data by the entity handling personal information concerned is lodged.

(2) If the entity handling personal information concerned is a target entity of an authorized personal information protection organization, the name of the authorized personal information protection organization concerned and the place where settlement of the complaint is lodged.

Article 6 (Methods of Disclosing Retained Personal Data by Entities Handling Personal Information)

The method specified by a Cabinet Order under Paragraph 1 of Article 25 of the Act shall be the provision of documents (or the method agreed upon by the person requesting disclosure, if any).

Article 7 (Procedures for Receiving Requests for Disclosure and Others)

Matters concerning procedures for receiving requests for disclosure and others that an entity handling personal information may determine pursuant to the provision of Paragraph 1 of Article 29 of the Act shall be as set forth below:

(1) The place where requests for disclosure and others are to be filed

(2) Format of the documents (including records made by an electronic method, magnetic method or any other methods not recognizable to human senses) to be submitted and other methods of making requests for disclosure and others at the time of making requests for disclosure and others

(3) Methods of identifying a person making requests for disclosure and others as the principal or representative prescribed in the following article

(4) Methods of collecting charges set forth in Paragraph 1 of Article 30 of the Act

Article 8 (Representative Eligible for Making Requests for Disclosure and Others)

The representative who may make requests for disclosure and others pursuant to the provision of Paragraph 3 of Article 29 of the Act shall be a representative set forth below:

(1) Attorney-in-fact of a minor or an adult ward

(2) Representative delegated by the person with making requests for disclosure and others.

Article 9 (Application for Authorization as an Authorized Personal Information Protection Organization)

1. An application pursuant to the provisions of Paragraph 2 of Article 37 of the Act must be submitted to the competent minister in writing, stating the following matters:

(1) Name and address of the applicant entity and the name of the representative or manager

(2) The location of the business to be conducted pertaining to the application for authorization

(3) An outline of the business pertaining to the application for authorization

2. Written applications under the preceding paragraph must be accompanied by the documents enumerated below:

(1) The articles of association, endowment and other fundamental provisions

(2) Written pledges that the entity applying for authorization is not under the provisions of each item of Article 38 of the Act

(3) Documents describing the methods of conducting the business pertaining to the application for authorization

(4) Documents demonstrating the fact that the applicant entity has sufficient knowledge and capability to properly and securely conduct the business pertaining to the application for authorization

(5) Business reports, balance sheets, inventories of property and other documents demonstrating the fact that the applicant entity has an accounting base for the recent business years (for a corporation founded in the business year the application was submitted, an inventory of property as of the time of foundation)

(6) Documents stating the names, addresses, and curriculum vitae of the officers

(7) Documents stating the names of the target entities and documents verifying that the target entities concerned are the members of the entity applying for authorization or those who have agreed to become the targets of the business pertaining to the application for authorization

(8) If the applicant entity conducts businesses other than that pertaining to the application for authorization, documents describing the types and outlines of the businesses

(9) Documents stating other matters for reference

3. If a change is made to any matters enumerated in Item 1 or Item 2 of Paragraph 1 or any matters entered in any of the documents enumerated in Item 2 to Item 4, Item 6 or Item 8 of the preceding paragraph, an authorized personal information protection organization must submit a notice of that effect (for changes made to any matters entered in documents enumerated in Item 3 of the same paragraph, the reason for the change shall be included) to the competent minister without delay.

Article 10 (Notice of Discontinuation of Authorized Business)

If an authorized personal information protection organization intends to discontinue its authorized business, it must submit a notice stating the following matters to the competent minister three months prior to the date it plans to discontinue the business:

(1) Name and address of the organization and the name of the representative or manager

(2) The last date the organization plans to receive requests under Paragraph 1 of Article 42 of the Act

(3) The date the organization plans to discontinue its authorized business

(4) Reasons for discontinuing the authorized business

Article 11 (Operations Handled by Heads of Local Public Bodies, etc.)

1. The operations belonging to the authority of a competent minister set forth in Article 32 to Article 34 of the Act shall, if it is specified in the provision of other laws that a part or all of the operations belonging to the authority pertaining to the collection of a report, an inspection, a recommendation, and other supervisions concerning the business conducted by an entity handling personal information that falls under the jurisdiction of the competent minister concerned shall be conducted by the heads of local public bodies or other executive agencies (hereinafter called the “heads of local public bodies, etc.” in this article), be conducted by the heads of the local public bodies, etc. concerned. In such cases, if more than one heads of local public bodies, etc. are supposed to conduct the operations concerned, nothing shall prevent each heads of local public bodies, etc. from independently conducting the operations belonging to the authority of the competent minister set forth in Article 32 and Article 33 of the Act.

2. The operations belonging to the authority of a competent minister set forth in Article 37, Article 40, and Article 46 to Article 48 of the Act shall, if it is specified in the provisions of other laws that the operations belonging to the authority of a competent minister pertaining to the permission or approval of the foundation of an authorized personal information protection organization (including an entity that intends to be authorized under Paragraph 1 of Article 37 of the Act) shall be conducted by the heads of local public bodies, etc., be conducted by the heads of local public bodies, etc. concerned.

3. The provision of Paragraph 1 shall not prevent the competent minister from conducting the operations set forth in the same paragraph on his or her own.

4. The heads of local public bodies, etc. who has conducted the operations belonging to the authority of a competent minister set forth in Paragraph 1 pursuant to the same paragraph shall promptly report the result to the competent minister.

5. In the cases as set forth in Paragraph 1 and Paragraph 2, the provisions for a competent minister pertaining to the operations set forth in these provisions under the Act and this Cabinet Order shall apply to the heads of local public bodies, etc. as the provisions for the head of local public bodies, etc..

Article 12 (Delegation of Authority or Operations)

1. A competent minister may, pursuant to the provision of Article 52 of the Act, delegate a portion of the authority or operations set forth in Article 32 to Article 34, Article 37, Article 39, Article 40, and Article 46 to Article 48 of the Act to the heads of agencies prescribed in Paragraph 1 of Article 49 of the Cabinet Office Establishment Law (Law No. 89 of 1999), the heads of agencies prescribed in Paragraph 2 of Article 3 of the National Government Organization Law (Law No. 120 of 1948) or the Commissioner General of the National Police Agency within his or her jurisdiction.

2. A competent minister (if the authority or operations are delegated pursuant to the provisions of the preceding paragraph to the heads of agencies prescribed in Paragraph 1 of Article 49 of the Cabinet Office Establishment Law or the heads of agencies prescribed in Paragraph 2 of Article 3 of the National Government Organization Law, the heads of the agencies) may, pursuant to the provision of Article 52 of the Act, delegate a portion of the authority or operations set forth in Article 32 to Article 34, Article 37, Article 39, Article 40, and Article 46 to Article 48 of the Act to the heads of the secretariats, bureaus or departments prescribed in Article 17 or Article 53 of the Cabinet Office Establishment Law, offices prescribed in Paragraph 1 of Article 17 or Paragraph 1 or Paragraph 2 of Article 62 of the same law, the heads of local branch offices prescribed in Article 43 or Article 57 of the same law, or the heads of the secretariat, bureaus or departments prescribed in Article 7 of the National Government Organization Law, the heads of local branch offices prescribed in Article 9 of the same law, or offices prescribed in Paragraph 1 or Paragraph 2 of Article 20 of the same law within his or her jurisdiction.

3. The Commissioner General of the National Police Agency may, pursuant to the provision of Article 52 of the Act, delegate the authority or operations delegated pursuant to Paragraph 1 to the heads of the Commissioner General’s Secretariat, bureaus prescribed in Paragraph 1 of Article 19 of the Police Law (Law No. 162 of 1954), departments prescribed in Paragraph 2 of the same article or regional institutions prescribed in Paragraph 1 of Article 30 of the same law.

4. A competent minister, the heads of agencies prescribed in Paragraph 1 of Article 49 of the Cabinet Office Establishment Law, the heads of agencies prescribed in Paragraph 2 of Article 3 of the National Government Organization Law, or the Commissioner General of the National Police Agency must publicly announce the office of the personnel to be delegated, the authority or operations to be delegated, and the date the delegation comes into effect when he or she intends to delegate the authority or the operations pursuant to the provisions of the preceding three paragraphs.

Article 13 (Exercise of Authority by the Competent Minister)

1. If more than one competent minister have jurisdiction over the handling of personal information conducted by an entity handling personal information pursuant to the provision of Paragraph 1 of Article 36 of the Act, nothing shall prevent each competent minister from independently exercising the authority prescribed in Article 32 and Article 33 of the Act.

2. The competent minister who has independently exercised his or her authority pursuant to the provision of the preceding paragraph shall promptly report the result to other competent ministers.

Supplementary Provisions

This Cabinet Order shall be enforced as of the date of promulgation. However, the provisions of Article 5 to Article 13 shall be enforced as of April 1, 2005.

Supplementary Provisions (Cabinet Order 389 of 2004)

This Cabinet Order shall be enforced as of the date of promulgation and the provision of article 2 of the Cabinet Order for the enforcement of the Act on the Protection of Personal Information revised by this Cabinet Order is applied as of October 1, 2004.