[Tentative translation]

The Amendment Act of the Act on the Protection of Personal Information, etc. (Overview)

 Based on “The Every-Three-Year Review” provisions, Article 12 of the Supplementary Provisions of the 2015 Amendment Act, the PPC had engaged in activities tounderstand actual circumstances and to overview current issues through interviewing experts and relevant organizations.
 From the perspectives of raised awareness about own personal information, the balance between protection and utilization taking into consideration the technologicalinnovation, and necessity to deal with emerging risks due to increased cross border data flow etc., the following measures will be taken by the amendment of the APPI.

1. Perspectives on Individual RightsWith regard to individual rights which can be requested in court including cease of utilizationand deletion, etc., requirements for the cease of utilization, etc. will be eased in cases in which
there is a possibility of violating individual rights or legitimate interests, although, under thecurrent act, these individual rights can be requested only when business operators violated
certain provisions, e.g. the case of improper acquisition of personal data.

Enabling a principal to choose the methods of disclosure of their retained personal data (*)
including provision of electromagnetic record.

4. Perspectives on Policies for Data Utilization


From the perspective of promoting innovation, "Pseudonymously Processed Information",
which deletes a person’s name etc. from personal information, will be introduced. Obligationsof dealing with demands such as for disclosure and cease of utilization will be eased based on
the premise including the limitation of utilization to business operators’ internal analyses.

Regarding information which does not fall under the definition of personal data on theprovider’s side but is supposed to become personal data on the recipient’s side, the provider
shall confirm a principal’s consent about the transfer to the recipient.

(*) Under the current act, the method of disclosure is to deliver written documents, as a general rule.

Enabling a principal to request disclosure of records of third party provision on transfer ofhis/her personal data.

The short-term data, which is deleted within 6 months, will be part of the retained personal dataand subject to demands for disclosure and cease of utilization, etc.

5. Perspectives on Penalties(*) Violation of an Order : Imprisonment with labor for not more than 6 months or a fine of not more than 300,000 yen→ Imprisonment with labor for not more than 1 year or a fine of not more than 1 million yen
False Submission of a Report, etc.: A fine of not more than 300,000 yen→ A fine of not more than 500,000 yen

Limiting the scope of personal data that can be provided to a third party without a principal’s
consent based on the opt-out provisions (*) by excluding (i) personal data which is illegallyobtained and (ii) personal data which is provided based on opt-out provision.
(*) The opt-out provisions: The system which can provide personal data to a third party without a principal’s consent,
upon publicly disclosing the item of personal data to be provided on the condition that it is ceased after a principal’sdemand.

Making it mandatory to report to the PPC and to notify a principal in case that an incident
including a leakage of the personal data occurs that may cause the violation of individual rights
and interests (*).
(*) In limited cases that fall under specific types, such that more than a certain number of personal data is leaked.



6. Perspectives on Extraterritorial Application of the APPI and Cross-Border TransferForeign business operators which supply goods or services in Japan and handle personal
information of an individual in Japan will be subject to collection of reports and orders, which
are enforced with a penalty.

When transferring personal data to a third party in a foreign country, a business operator will berequired to enrich the information provided to the principal regarding the handling ofpersonal information at a recipient business operator.

Clarifying that personal information should not be utilized in improper ways by potentiallyfacilitating illegal or unjustifiable conducts.

3. Perspectives on Frameworks to Encourage Voluntary Activities of Business Operators
With regard to Accredited Personal Information Protection Organization System,enabling the PPC to accredit an organization that focuses business operators’ specific businessdomain in addition to the current system (*).
(*) Accredited Personal Information Protection Organization under the current system focuses a covered business
operator’s all businesses.

Regarding fines for wrongful provision or utilization of personal information database etc. andviolation of an order issued by the PPC, considering the difference of solvency between legal
entities and individuals, fines for legal entities will be reinforced to be severer than those forindividuals.
(*) Fines equivalent in amount to those for individuals (not more than 500,000 yen or 300,000 yen)
→ A fine of not more than 100 million yen

2. Perspectives on Obligations that Business Operators Should Abide byPenalties for violation of an order issued by the PPC and false submission of a report, etc. to thePPC will be reinforced.

* In addition to the above, this Act includes amendment to “Act on the Use of Numbers to Identify a Specific
Individual in Administrative Procedures” and “Act on Anonymized Medical Data That Are Meant to Contribute toResearch and Development in the Medical Field” to take necessary measures as a consolidated act (including
mandatory reporting of an incident including a leakage of personal data and reinforcement of penalties, etc.).