Personal Information Protection Regulations of the Setagaya Arts
Foundation
April 1, 2003
SAF Regulations No. 8(Purpose)
Article 1 These regulations are hereby established to ensure that the personal information
handled by the Setagaya Arts Foundation (hereinafter referred to as the “Foundation”) is
collected, managed, used, and provided in the proper way.
(Definitions)
Article 2 In these regulations, “personal information” shall refer to information about a living
individual that can identify a specific individual either by name, date of birth, or otherdescriptions contained in the information (including things that can easily be compared withother information allowing a specific individual to be identified).
2

In these regulations, “personal information database, etc.,” shall refer to a collectionof information containing personal information and that are listed below:(1) Things with a systematic structure that allows specific personal information to be searchedfor via a computer(2) In addition to things mentioned in the preceding item, things specified separately as
something with a systematic structure that allows specific personal information to be searched
for easily
3

In these regulations, “personal data” shall refer to the personal information that

constitutes a personal information database, etc.
4In these regulations, “retained personal data” shall refer to personal data that theFoundation has the authority to disclose, revise, add or delete, suspend usage of, remove, or stop
providing to third parties, and shall refer to things determined separately as things that could
harm public interests or other interests if its existence were revealed, or to things other thanthings that will be removed within a period specified to within one year.
5In these regulations, the “owner” with respect to personal information shall refer tothe specific individual that is identified by the personal information.
(Responsibilities of the Foundation)
Article 3 The Foundation shall work to ensure that personal information is handled carefully inharmony with the philosophy of respect for individuality.

Group3 3-1

(Specification of the Usage Purpose)
Article 4 In handling personal information, the Foundation shall specify the usage purpose(hereinafter referred to as the “usage purpose”) to the extent possible.
2If the Foundation changes the usage purpose, it shall be changed to a scope deemed

to be reasonably relevant to the original usage purpose.
(Restrictions according to the Usage Purpose)
Article 5 The Foundation shall not use personal information without the prior consent of theowner beyond the scope necessary to achieve the usage purpose specified in the precedingarticle.
2 If personal information is acquired by taking over the business of another foundation due toa merger or other reason, the Foundation shall not use the relevant personal information beyond
the scope necessary to achieve the usage purpose of the relevant personal information before
taking it over without obtaining the prior consent of the owner.
3The provisions in the preceding two paragraphs shall not apply in the following

cases:(1) If required by law(2) When it is necessary in order to protect a life, body, or property of a person and it is difficult
to obtain the consent of the owner.
(3) When it is especially necessary in order to improve public health or promote the healthy
development of children and it is difficult to obtain the consent of the owner.
(4) If it is necessary in order to cooperate with a national institution, a local public organization,
or a person appointed by these to perform tasks specified by laws, and there is the risk ofinterfering with the fulfillment of the relevant task by acquiring the consent of the owner.
(Proper Acquisition)
Article 6 The Foundation shall not acquire personal information using deception or otherwrongful means.
(Notification, etc., of the Usage Purpose at the Time of Acquisition)
Article 7 Unless the usage purpose has already been disclosed in advance, when obtaining
personal information, the Foundation shall promptly notify the owner of the usage purpose orannounce it.
2

Notwithstanding the provision in the preceding paragraph, if personal information isacquired for the relevant owner described in a contract or other document (including records

Group3 3-2

created in digital form, magnetic form, or another method that cannot be recognized by humans;
the same shall apply hereinafter in this paragraph), and if the personal information of therelevant owner is written directly onto a document by the owner themselves, the Foundation
shall clearly indicate the usage purpose to the owner in advance.

However, this shall not apply to cases where there is an urgent need to protect the life, body, orproperty of a person.
3If the usage purpose is changed, the Foundation shall notify the owner or publicly

announce the changes to the usage purpose.
4The provisions in the preceding three paragraphs shall not apply in the following

cases:(1) If notifying the owner or announcing the usage purpose may result in harm to life, body,property, or other rights and interests of the owner or a third party(2) If notifying the owner or announcing the usage purpose may harm the rights or legitimate
interests of the Foundation.
(3) If it is necessary to cooperate with a national institution or a local public organization toperform tasks specified by laws, and when there is the risk of interfering with the fulfillment of
the relevant task by notifying the owner or announcing the usage purpose.
(4) If it is determined that the usage purpose is clear based on the acquisition circumstances(Ensuring the Accuracy of Data Contents)
Article 8 The Foundation shall endeavor to keep personal data accurate and up-to-date within
the scope necessary for achieving the usage purpose.
(Security Control Measures)
Article 9 The Foundation shall implement necessary and appropriate measures for controllingthe security of personal data such as preventing the leakage, loss, or damage of handled personaldata.
(Supervision of Employees)
Article 10 The Foundation shall provide necessary and appropriate supervision of relevant
employees when staff handle personal data in order to ensure that the relevent personal data is
managed safely.
2 Employees shall not disclose personal information obtained from their work duties to others
without permission or use it for any unjust purpose. The same shall apply after leaving theirGroup3 3-3

employment.
(Supervision of Consignees)
Article 11 If the handling of personal data is consigned in whole or in part, the Foundation shallcarry out necessary and appropriate supervision of the consigned party in order to ensure thatthe personal data they are entrusted with handling is managed safely.

(Restrictions on Provision to Third Parties)
Article 12

The Foundation shall not provide personal data to third parties without the priorconsent of the owner except in the following cases:(1) If required by law(2) When it is necessary in order to protect a life, body, or property of a person and it is difficult
to obtain the consent of the owner.
(3) When it is especially necessary in order to improve public health or promote the healthy
development of children and it is difficult to obtain the consent of the owner.
(4) If it is necessary in order to cooperate with a national institution, a local public organization,
or a person appointed by these to perform tasks specified by laws, and there is the risk ofinterfering with the fulfillment of the relevant task by acquiring the consent of the owner.
2Regarding the personal data provided to a third party, if it is stipulated that provisionof personal data that can identify the owner to a third party shall be suspended upon request of
the owner, the Foundation may provide the personal data to a third party regardless of theprovision in the preceding paragraph when the items listed below are notified to the owner inadvance or are otherwise made easily accessible to the owner.
(1) That provision to a third party is the usage purpose.
(2) Personal data items provided to a third party(3) Means or method of provision to a third party(4) Suspending provision of personal data that can identify the relevant owner to a third party atthe request of the owner.
3If the things listed in items 2 or 3 of the preceding paragraph are changed, theFoundation shall notify the changed contents to the owner in advance or otherwise make iteasily accessible to the owner.
4

Regarding the application of the preceding three paragraphs, in the following cases,

the party that receives the relevant personal data shall not be considered a third party.

Group3 3-4

(1) If the Foundation consigns the handling of personal data in whole or part to the extent
necessary for achieving the usage purpose(2) If the personal data is provided in connection with the taking over of business due to amerger or other reasons(3) If the personal data is used together with a specific party, when the jointly used personal
data items, the scope of the party jointly using it, the usage purpose of the party using it, and thename of the party responsible for managing the relevant personal data are notified to the ownerin advance or are otherwise made easily accessible to the owner.

5If the usage purpose of the user or the name of the party responsible for managing

the personal data mentioned in item 3 of the preceding paragraph is changed, the Foundation
shall notify the changed contents to the owner in advance or otherwise make it easily accessible
to the owner.
(Disclosure of Items related to Retained Personal Data)
Article 13 Regarding retained personal data, the Foundation shall keep the following items
easily accessible to the owner (including cases for responding to requests by the owner withoutdelay).
(1) Name of the Foundation(2) Usage purpose of all retained personal data (excluding cases to which items 1 to 3 of Article
7.4. apply)(3) Procedures in response to requests based on the provisions in the following paragraph,paragraph 1 of the following article, Article 15-1, or Articles 16-1 or 16-2 (when the fee amountis determined according to the provision in Article 19-2, the said fee shall be included)(4) In addition to the items listed in the preceding three items, other items determined separately
to be necessary for ensuring the proper handling of retained personal data.
2 If the owner requests notification of the usage purpose for retained personal data that canidentify the relevant owner, the Foundation shall notify this to the owner without delay.
However, this shall not apply to any of the following cases.
(1) If the usage purpose of the retained personal data that can identify the relevant owner basedon the provision in the preceding paragraph is obvious(2) Cases to which items 1 to 3 of Article 7.4 apply
3 If the Foundation decides not to notify the usage purpose of the retained personal data

Group3 3-5

requested based on the provision of the preceding paragraph, this shall be notified to the ownerwithout delay.
(Disclosure)
Article 14 When a request is made for the disclosure of retained personal data that can identify
the relevant owner (including notification of the fact that retained personal data that can identify
the relevant owner does not exist; the same shall apply hereinafter), the Foundation shalldisclose relevant retained personal data to the owner without delay in a manner to be determined
separately. However, if disclosure causes any of the following items to apply, it may not be
disclosed either in whole or in part.

(1) There is the risk of harm the life, body, property or other rights and interests of the owner ora third party(2) There is the possibility that it will significantly interfere with the proper execution of workby the Foundation(3) Doing so would lead to the violation of other laws and regulations
2

When the Foundation decides not to disclose the retained personal data requested

according to the provision of the preceding paragraph either in whole or part, this fact shall be
notified to the owner without delay.
3If provisions in other laws or regulations require the disclosure of retained personal

data that can identify the relevant owner either in whole or part to the owner via a mannerequivalent to the method stipulated the operative part of paragraph 1, the provision in the said
paragraph shall not apply to the relevant retained personal data either in whole or part.
(Revisions, etc.)
Article 15 If the owner requests the revision, addition, or deletion of the retained personal data
(hereinafter referred to as “revision, etc.” in this article) because the contents of the retained
personal data that can identify the relevant owner are not correct, the Foundation shall conduct anecessary investigation within the scope necessary for fulfilling the usage purpose without
delay, and shall execute revision, etc., of the retained personal data contents based on theresults, unless other laws and regulations stipulate special procedures for revision, etc., of thosecontents.
2 When revision, etc., is executed for the contents of the retained personal data either in wholeor part according to a request based on the provision of the preceding paragraph, or the decision

Group3 3-6

was made to not execute revision, etc., the Foundation shall notify this fact (including thecontents of the revision, etc., if such are made) to the owner without delay.
(Usage Suspension, etc.)
Article 16 If the owner requests that usage of the retained personal data be suspended or that it
be deleted (hereinafter referred to as “usage suspension, etc.” in this article) because theretained personal data that can identify the relevant owner is being handled in violation of theprovision in Article 5 or because it was obtained in violation of the provision in Article 6, andwhen the request is determined to be legitimate, the Foundation shall approve of usage
suspension, etc., of the relevant retained personal data within the limit necessary for correcting
the violation without delay. However, this shall not apply to cases where the usage suspension,etc., of the retained personal data requires a large expense, or usage suspension, etc., is difficult
to perform, and alternative measures are taken to protect the rights and interests of the owner.

2If the owner requests that the retained personal data not be provided to a third party

because the retained personal data that can identify the relevant owner is being provided to athird party in violation of the provision in Article 12.1, and when the request is determined to belegitimate, the Foundation shall suspend provision of the relevant retained personal data to third
parties without delay. However, this shall not apply to cases where suspending provision of theretained personal data requires a large expense, or suspending provision to third parties isdifficult, and alternatives measures are taken to protect the rights and interests of the owner.
3

When the Foundation executes usage suspension, etc., or decides not to execute

usage suspension, etc., of the retained personal data either in whole or part as requested
according to the provision of paragraph 1, or when the Foundation suspends provision of theretained personal data to third parties either in whole or part as requested according to theprovision of the preceding paragraph, or decides not to suspend provision to third parties, thisfact shall be notified to the owner without delay.
(Explanation of Reasons)
Article 17 If the owner is notified that no action will be taken or that action will be taken thatdiffers from the measures required by the owner as stipulated in Article 13.3, Article 14.2,Article 15.2, or paragraph 3 of the preceding article either in whole or part, the Foundation shallendeavor to explain the reason to the owner.
(Procedures for Responding to Requests for Disclosure, etc.)

Group3 3-7

Article 18 Regarding the requests stipulated in the provisions of Article 13.2, Article 14.1,Article 15.1, Article 16.1, or Article 16.2 (hereinafter referred to as a “request for disclosure,etc.” in this article), the Foundation may determine the method for accepting the request basedon separate determination. In this case, the owner must make a request for disclosure, etc.,
according to the relevant method.
2Regarding the request for disclosure, etc., the Foundation may request the owner tosubmit sufficient information for identifying the target retained personal data. In this case, thebusiness handling the personal information must take the proper measures taking into accountthe provision of information that contributes to the identification of the relevant retained
personal data and the convenience of the owner so that the owner can make a request fordisclosure, etc., easily and properly.
3

A request for disclosure, etc., may be made handled by a proxy according to separate

determination.
(Commission Fee)
Article 19 When a request is made to notify the usage purpose according to the provision in
Article 13.2 or for disclosure according to the provision in Article 14.1, the Foundation may
charge a fee for implementing relevant measures.
2

If a commission fee is collected according to the provision in the preceding

paragraph, the Foundation shall determine the amount of the commission fee within a range
deemed reasonable based on the actual costs.
(Grievances Process by the Foundation)
Article 20 The Foundation shall endeavor to handle complaints related to the handling of
personal information properly and swiftly.
(Entrustment)
Article 21 Necessary matters related to the enforcement of these regulations shall be specified
separately.
Supplementary Provisions
These regulations shall be in effect as of April 1, 2003.

Supplementary Provisions
1

These regulations shall be in effect as of April 1, 2005.

Group3 3-8

2

If consent is given by the owner regarding the handling of personal information prior

to the enforcement of these regulations, when that consent is equivalent to consent forauthorizing the handling of personal information for purposes other than the usage purpose
specified in the provision of Article 4.1, it shall be deemed that consent has been given as
specified in Article 5.1 or 5.2.
3

If consent is given by the owner regarding the handling of personal information prior

to the enforcement of this law, when that consent is equivalent to consent for authorizing theprovision of personal data to a third party as stipulated in the provision of Article 12.1, it shallbe deemed that consent has been given as specified in the said paragraph.
4Regarding items equivalent to items that must be notified to the owner or otherwise

be made easily accessible to the owner according to the provision in Article 12.2, when it has
been notified to the owner prior to the enforcement of these regulations, it shall be deemed thatthe relevant notification has been made according to the provision in the said paragraph.
5

Regarding items equivalent to items that must be notified to the owner or otherwise

be made easily accessible to the owner according to the provision in Article 12.4.3, when it hasbeen notified to the owner prior to the enforcement of these regulations, it shall be deemed thatthe relevant notification has been made according to the provision in the said item.

Group3 3-9