United States of America (California)
Existence or non-existence of a system forthe protection of personal information

As comprehensive legislation, the following laws exist:■California Consumer Privacy Act (Hereinafter referred to as "CCPA")- URL：https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.5.&part=4.&chapter=&article=- Enforcement status: Enacted on January 1, 2020
- Target institutions: Private for-profit enterprises that collect or process consumer personal information andmeet one of the following criteria: (1) Companies with annual gross revenue exceeding $25 million, (2)Companies that annually purchase, receive, sell, or share personal information of 50,000 or more consumers,households, or (3) derive 50% or more of their annual revenues from the sale of consumers' personalinformation.
- Information covered: Information that identifies, relates to, describes, can be reasonably associated with, orcan be reasonably linked directly or indirectly to a specific consumer or household

Information that could serve as an indicator EU Sufficiency Certification*1: Noneabout the system for the protection ofAPEC's CBPR System *2: The United States joined on July 25, 2012.
personal information
The obligations of businesses and otheretities or rights of the individual comply
with the eight principles of the OECD
privacy guidelines*3

In the case of economies participating in the APEC CBPR system, for the private sector, it is not necessary toprovide information on this item, since a certain degree of predictability for the individual regarding the risks
associated with the provision of personal data to third parties located abroad is considered to be guaranteed toa certain degree. Therefore, it is not necessarily required to provide information regarding this matter; however,
the above laws are state laws, therefore, information provision regarding this item will be conducted.
The obligations of business operators, etc. or the rights of the individual corresponding to the eight principles of
the OECD Privacy Guidelines are described below.

(1) Principle of collection restriction

Other systems that may have a significant
impact on the rights and interests of theindividual

The above statutes provide.

(2) Principle of data content

The above statutes provide.

(3) Principle of clarification ofpurposeThe above statutes provide.

(4) Principle of Restrictions on Use

The above statutes provide.

(5) Principles of Safety andProtection

The above statutes provide.

(6) Principle of Publicity

The above statutes provide.

(7) Principle of IndividualParticipation

The above statutes provide.

(8) Principle of Accountability

The relevant provision is inapplicable Systems related to the obligation to preserve personal information intrastate, which may have a significant
impact on the rights and interests of the individual.
 A system that imposes an obligation on businesses to cooperate with government information collection
activities, which may have a significant impact on the rights and interests of the individual.

1. The countries or regions that have obtained the EU Sufficiency Certification are those countries or regions that have been determined by the European
Commission to have an adequate level of data protection based on the GDPR or its predecessor, the Data Protection Directive, which is a system for theprotection of personal information in the EU (EU Member States and Iceland, Norway and Liechtenstein, which are part of the European Economic Area),
which the Commission has designated as countries or regions with systems for the protection of personal information that are deemed to have an equivalentlevel of protection to our country.
In this sense, the fact that a country or region has obtained EU adequacy certification constitutes "information that may serve as an indicator regarding thesystem for the protection of personal information".

2. As a prerequisite for participation in the APEC CBPR system, it is stipulated that, like our country, has legislation that conforms to the APEC Privacy
Framework and has enforcement authorities to investigate and rectify complaints or issues that cannot be resolved by CBPR-certified businesses oraccountability agents. Therefore, economies participating in the APEC CBPR system, like our coutry, have laws that conform to the APEC Privacy Frameworkand enforcement authorities to enforce such laws, thus generally expecting protection of personal information similar to that in our country.
In this sense, the fact that an economy participates in APEC's CBPR system constitutes "information that can be used as an indicator of a system for theprotection of personal information". The APEC CBPR system covers the private sector.

3. The eight principles of the OECD Privacy Guidelines serve as fundamental principles referenced by OECD member countries as well as internationally intheir efforts to protect personal information. They are used as global standard effectively when countries develop their personal information protection
systems.
[Items to be noted]■Act on the Protection of Personal Data (Act No. 57 of 2003) (hereinafter referred to as the "Personal Data Protection Act"). The purpose of Article 28,
Paragraph 2 of the Act on the Protection of Personal Information is not only to increase the predictability of risks associated with the provision of personal
data to third parties in foreign countries to the individual concerned, but also to encourage business operators who provide personal data to third parties inforeign countries to be more aware than before of the business environment at the third parties in the foreign countries to which they provide the data.
The provision of personal data to a third party in a foreign country also includes the point of encouraging the business operator to be more aware of thebusiness environment of the third party in the foreign country to which the personal data is provided.
In addition, the specific content of the information to be provided by the business operator to the individual in accordance with the said paragraph may varydepending on the individual case.
Therefore, confirmation of the system for the protection of personal data in a foreign country should be the responsibility of the business operator providing
personal data to a third party in a foreign country, and the above reference information provided by the Committee should be referenced only as asupplement.

■The above reference information provided by the Committee is based on the results of the "Survey of Systems for the Protection of Personal Information in
Foreign Countries" conducted by the Committee, and is based solely on information as of October 2021, when the survey was conducted. After the date of
the survey, there may be changes in the system for the protection of personal information in foreign countries, and the content of information that should
be provided to the individual by a business entity that provides personal data to a third party in a foreign country may have been changed.

■The above reference information provided by the Committee is based on the results of the "Survey of Systems for the Protection of Personal Information in
Foreign Countries" conducted by the Committee. It should be noted that the investigation was conducted with limited scope regarding the applicable laws
and regulations from the following perspective, and is not necessarily exhaustive. If an entity that provides personal data to a third party in a foreign country
possesses relevant information other than the above reference information, such information must also be provided to the individual in accordance withArticle 28, Paragraph 2 of the Act on the Protection of Personal Information and Article 17, Paragraph 2 of the Enforcement Regulations of the Act on theProtection of Personal Information (the Rules of the Personal Information Protection Commission, No. 3 of 2016). The information must also be provided tothe person in question.
- The following laws and regulations shall be covered by the survey, which are listed as representative by the consignor or subcontractor for the above
survey.
- The laws on the protection of personal information applicable to specific sectors in foreign countries that do not have comprehensive legislation on theprotection of personal information- Laws and regulations concerning the system related to the obligation to preserve personal information in the territory- Laws and regulations concerning a system imposing on businesses the obligation to cooperate with government information gathering activities- With respect to laws and regulations concerning systems that impose an obligation on business operators to cooperate with government informationcollection activities, the survey shall cover systems in which foreign governments have access to personal information held by business operators for both oreither criminal law enforcement purposes or national security purposes and in which the business operators are required under such laws and regulations toprovide personal information to the foreign government. The survey shall cover those that are required by such laws and regulations to provide personal
information to foreign governments.

(Updated January 25, 2022)