Personal Information Protection Rules of the Setagaya
Arts Foundation
April 1, 2003 SAF
Regulation No. 13(Purpose)
Article 1 These rules shall stipulate necessary matters for implementing the Personal Information
Protection Regulations of the Setagaya Arts Foundation (April 1, 2003, SAF Regulations No. 8;
hereinafter referred to as the “Protection Regulations”).
(Personal information database, etc.)
Article 2 The personal information database, etc., stipulated in Article 2.2.2 of the Protection
Regulations shall be a collection of information arranged systematically by organizing the contained
personal information according to certain rules so that specific personal information can easily besearched for, and shall be something that includes a method for making searches easy such as a tableof contents or index.
(Things excluded from retained personal data)
Article 3 The following things shall be excluded from retained personal data stipulated in Article 2.4of the Protection Regulations.
(1) Things that may harm the life, body, or property of the owner or a third party if it is revealed
whether the relevant personal data exists(2) Things that may promote or induce illegal or unjust actions if it is revealed whether the relevant
personal data exists(3) Things that may endanger national security, damage the relationship of trust with other countries orinternational organizations, or create a disadvantage when negotiating with other countries orinternational organizations if it is revealed whether the relevant personal data exists(4) Things that may hinder the prevention, suppression, or investigation of crimes, and the maintainingof public safety and order if it is revealed whether the relevant personal data exists(Period until items excluded from retained personal data are deleted)
Article 4 The period specified in Article 2.4 of the Protection Regulations shall be six months.
(Necessary matters for ensuring the proper handling of retained personal data)
Article 5 As a necessary matter in Article 13.1.4 of the Protection Regulations, complaints related to thehandling of personal data retained by the Setagaya Arts Foundation (hereinafter referred to as the“Foundation”) shall be submitted to the secretariat of the Foundation.
(Method of disclosing personal data)
Article 6 The method for the provision in Article 14.1 of the Protection Regulations shall be the deliveryof a written document.
(Proxies with authority to request disclosure, etc.)
Article 7 Proxies with authority to request disclosure, etc., according to the provision in Article 18.3of the Protection Regulations shall be the following proxies:
Group 3 4-1

(1) A legal representative of a minor or adult ward(2) A proxy entrusted by the owner to make requests for disclosure, etc.
2The legal representative shall submit documents necessary for proving they are the legal

representative of the owner including a copy of his or her family register and other documents thatprove he or she is qualified as a legal representative.
3

The proxy shall submit a power of attorney letter to prove that he or she is the proxy of theowner.

4If the request for disclosure, etc., is made by the legal representative of a minor, the Foundation
may seek the opinion of the relevant minor if necessary.

(Method for accepting requests for disclosure, etc.)
Article 8 A person requesting disclosure, etc., according to the provision in Article 18.1 of the Protection
Regulations (hereinafter referred to as the “claimant”) shall do so using Form 1 mentioned separately(Request for Disclosure of Retained Personal Data, etc.).
2 When requesting disclosure, the claimant shall produce their driver's license, passport, healthinsurance card, or other document certifying the identity of the claimant.
3 If a proforma deficiency in the Request for Disclosure of Retained Personal Data, etc., (hereinafterreferred to as “Request for Disclosure, etc.”) is discovered, the Foundation may provide reference
information for making corrections to the claimant, and may determine a considerable period of timefor corrections.
(Deadline for decisions for requests)
Article 9 Regarding requests for disclosure, etc., according to the provision in Article 18.1 of theProtection Regulations, the feasibility of the relevant request shall be determined according thefollowing deadlines calculated starting from the date that the request for disclosure, etc., is received,
and this fact must be promptly notified to the claimant using Form 2 specified separately (Notice ofDecision for the Disclosure, etc., of Retained Personal Data). However, if a correction is requested
according to the provision in paragraph 3 of the preceding Article, the number of days required forthe relevant correction shall not be included in the relevant period.
(1) For notifying the usage purpose and for disclosure requests, within 15 days
(2) For requests for revision, addition and deletion, suspension of use, removal, and suspension ofprovision to third parties (hereinafter referred to as, "revision, etc."), within 20 days
2 Notwithstanding the provision in the said paragraph, if it is not possible to determine whether toapprove the relevant request within the period prescribed in the preceding paragraph due to someunavoidable reason, the period may be extended for a maximum period shown below calculated
starting from the date that the request for disclosure, etc., is received. In this case, the Foundation
shall promptly notify the reason for the relevant extension to the claimant and the time at which thedecision for approving the request may be made using Form 3 mentioned separately (Notice ofExtension of the Decision for the Disclosure, etc., of Retained Personal Data.).
(1) For notifying the usage purpose and for disclosure requests, within 30 daysGroup 3 4-2

(2) For requests for revision, etc., 60 days
3 Notwithstanding the provision in paragraph 1, if the making of all decisions for whether to approve
the relevant request within the period stipulated in the preceding paragraph interferes with theperforming of office work or when it is recognized that a special long period is required because theamount of personal data related to the relevant request is extremely large, the Foundation shall decide
whether to approve the relevant portion of the relevant request within the relevant period, and may
decide whether to approve the remaining portion within a considerable period.

In this case, the Foundation shall notify the following items to the claimant within the period specifiedin paragraph 1 using Form 4 mentioned separately (Special Notice of Extension of the Decision for
the Disclosure, etc., of Retained Personal Data).
(1) The fact that this paragraph applies and the reason(2) The period for making all decisions on whether to approve the relevant request(Disclosure of retained personal data)
Article 10 Persons who want to receive the disclosure of retained personal data shall present
documentation proving that they have received the decision for the relevant disclosure.
2 Disclosure of retained personal data according to the provision in Article 14.1 of the Protection
Regulations shall be through the reading or copying of documents, drawings or photographs, andthrough viewing/listening or copying of films (limited to microfilm).
3 For disclosing retained personal data by reading or viewing methods, it may be done via a copy of theretained personal data when it is recognized that there is the risk of interfering with the storage of therelevant retained personal data, or when there is another rational reason.
4 If the retained personal data is recorded to an electromagnetic record on a magnetic disk, etc., as analternative, reading or the issuing of copies of the portion related to the relevant retained personal
data from the things output from the relevant magnetic disk using a printer, etc., may be used.
5 The person who does the reading or viewing mentioned in paragraph 2 must handle the relevant
recorded material carefully and not cause damage, corruption, etc.
6 The Foundation may suspend or prohibit persons who violate or who are deemed to have violated
the provisions of the preceding paragraph from reading or viewing the recorded materials.
7 The number of copies provided in paragraph 2 shall be one copy per request.
8 If the retained personal data contains non-disclosed information or descriptions that can be used for
identifying someone other than the disclosure claimant, when it is recognized that there is no risk ofinterfering with the purpose of the disclosure claimant by removing the relevant portion, and it is also
recognized that there is no risk of interfering with the rights and interests of individuals other thanthe disclosure claimant, the portion outside the relevant portion must be disclosed.
(Revision, etc., of retained personal data)
Article 11 When a revision, etc., is made to the retained personal data according to the provisions in
Article 15.1 and Articles 16.1 and 16.2 of the Protection Regulations, that fact shall be notified to theclaimant using Form 5 mentioned separately (Notice of Revision, etc., to Retained Personal Data). In
cases where external provision is made, when request for revision, etc., is approved, this fact shallGroup 3 4-3

also be notified to the party that received the external provision of the relevant retained personal data.

(Personal information protection system)
Article 12 In order to properly handle personal information according to the provision in Article 3 of
the Protection Regulations, a personal information protection manager shall be appointed at thesecretariat and at each building, and this shall be supervised by the secretariat.
2 The personal information protection manager shall be the secretary general manager and thedirectors and office managers at each building.
3The personal information protection manager shall supervise and oversee the personnel under hisor her control and be in charge of raising awareness of the protection of personal information.

4

Under the direction of the secretariat, the personal information protection manager shall handle
responses to requests according to the provisions in Article 14, Article 15, and Article 16 of theProtection Regulations, and shall handle complaints according to the provision in Article 20 of thesaid regulations.

(Entrustment)
Article 13 Necessary matters related to the enforcement of these rules shall be specified separately.
Supplementary Provisions
These rules shall be in effect as of April 1, 2005.
Supplementary Provisions
These rules shall be in effect as of April 1, 2019.

Group 3 4-4

Group 3 45