Ver.1 December, 2016
Personal Information Protection Commission, Japan

Amendment to the Cabinet Order to Enforce the Act on the Protection of
Personal Information（Tentative Translation）

This is an English translation of the Amendment to the Cabinet Order to Enforce the Act on theProtection of Personal Information, to be put into full effect on May 30, 2017.
NOTICE*This translation has neither had its texts checked by a native English speaker nor legal

language editor, and thus may be subject to change.
*The Japanese original legal texts only shall remain in force, while their English translation ispresented for ease of non-Japanese speakers’ understanding and reference.

(Individual Identification Code)

Article 1 Those character, letter, number, symbol or other codes prescribed bycabinet order under Article 2, paragraph (2) of the Act on the Protection of Personal
Information (hereinafter referred to as the “Act”) shall be those set forth in thefollowing.

(i) Those character, letter, number, symbol or other codes produced by having
converted any of the following bodily features thereinto so as to be provided foruse in computers which conform to standards prescribed by rules of the
Personal Information Protection Commission as sufficient to identify a specificindividual.

(a) base sequence constituting Deoxyribonucleic Acid (alias DNA) taken from a
cell;(b) appearance decided by facial bone structure and skin color as well as the
position and shape of eyes, nose, mouth or other facial elements;(c) a linear pattern formed by an iris’ surface undulation;1Ver.1 December, 2016
Personal Information Protection Commission, Japan(d) vocal cords’ vibration, glottis’ closing motion as well as the shape of vocal
tract and its change when uttering;(e) bodily posture and both arms’ movements, step size and other physicalappearance when walking;(f) Intravenous shape decided by the junctions and endpoints of veins lying
under the skin of the inner or outer surface of hands or fingers;(g) a finger or palm print.

(ii) Number of passport set forth in Article 6, paragraph (1), item (i) of the Passport
Act (Act No. 267 of 1951)(iii) Basic pension number set forth in Article 14 of the National Pension Act (ActNo. 141 of 1959)(iv) Number of a driver’s license set forth in Article 93, paragraph (1), item (i) of theRoad Traffic Act (Act No. 105 of 1960)(v) Resident record code set forth in Article 7, item (xiii) of the Basic Resident
Registration Act (Act No. 81 of 1967)(vi) Individual number set forth in Article 2, paragraph (5) of the Act on the Use of
Numbers to Identify a Specific Individual in the Administrative Procedure (ActNo. 27 of 2013)(vii) Those character, letter, number, symbol or other codes prescribed by rules of
the Personal Information Protection Commission which are stated on acertificate set forth in the following in a way to give each person who receives
its issuance a different one.

(a) A health insurance card under Article 9, paragraph (2) of the National
Health Insurance Act (Act No. 192 of 1958);
2

Ver.1 December, 2016
Personal Information Protection Commission, Japan(b) An insured person’s certificate under Article 54, paragraph (3) of the Act on
Assurance of Medical Care for Elderly People (Act No. 80 of 1982)(c) An insured person’s certificate under Article 12, paragraph (3) of the LongTerm Care Insurance Act (Act No. 123 of 1997)(viii) Any other character, letter, number, symbol or other codes prescribed by rulesof the Personal Information Protection Commission as equivalent to eachpreceding item.

(Special care-required personal Information)

Article 2 Those descriptions etc. prescribed by cabinet order under Article 2,paragraph (3) of the Act shall be those descriptions etc. which contain any of thosematters set forth in the following (excluding those falling under a principal’s medical
record or criminal history)(i) the fact of having physical disabilities, intellectual disabilities, mental disabilities(including developmental disabilities), or other physical and mental functional
disabilities prescribed by rules of the Personal Information Protection
Commission;(ii) the results of a medical check-up or other examination (hereinafter referred toas a “medical check-up etc.” in the succeeding item) for the prevention andearly detection of a disease conducted on a principal by a medical doctor orother person engaged in duties related to medicine (hereinafter referred to as a“doctor etc.” in the succeeding item);(iii) the fact that guidance for the improvement of the mental and physicalconditions, or medical care or prescription has been given to a principal by adoctor etc. based on the results of a medical check-up etc. or for reason of
disease, injury or other mental and physical changes;(iv) the fact that an arrest, search, seizure, detention, institution of prosecution orother procedures related to a criminal case have been carried out against a
principal as a suspect or defendant;
3Ver.1 December, 2016
Personal Information Protection Commission, Japan(v) the fact that an investigation, measure for observation and protection, hearing
and decision, protective measure or other procedures related to a juvenile
protection case have been carried out against a principal as a juvenile
delinquent or a person suspected thereof under Article 3, paragraph (1) of theJuvenile Act.

(Personal Information Database etc.)

Article 3 Those prescribed by cabinet order as having little possibility of harming an
individual’s rights and interests considering their utilization method under Article 2,paragraph (4) of the Act shall be those falling under all of each following item.

(i) those which have been issued for the purpose of being sold to a large number ofunspecified persons and the issuance of which has not been conducted inviolation of the provisions of a law or order based thereon;(ii) those which can be, or could have been, purchased at any time by a large
number of unspecified persons;(iii) those which are being provided for their original purpose without adding otherinformation relating to a living individual.

(2) Those prescribed by cabinet order under Article 2, paragraph (4), item (ii) of the
Act shall be a collective body of information including a table of contents, index orsimilar others to facilitate search of information that has been systematicallyorganized by arranging personal information contained in the database according
to a certain rule that enables specified personal information to be readily
searched for.

(Those Excluded from Retained Personal Data)

Article 4 Those prescribed by cabinet order under Article 2, paragraph (7) shall bethose set forth in the following.

(i) those in relation to which there is a possibility that if the presence or absence of4Ver.1 December, 2016
Personal Information Protection Commission, Japanthe said personal data is made known, it would harm a principal or third party’s
life, body or fortune;(ii) those in relation to which there is a possibility that if the presence or absence ofthe said personal data is made known, it would encourage or induce an illegal
or unjust act;(iii) those in relation to which there is a possibility that if the presence or absence ofthe said personal data is made known, it would undermine national security,
destroy a trust relationship with a foreign country or international organization,or suffer disadvantage in negotiations with a foreign country or internationalorganization;(iv) those in relation to which there is a possibility that if the presence or absence ofthe said personal data is made known, it would hinder the maintenance of
public safety and order such as the prevention, suppression or investigation of acrime.

(Period within Which Those Exempted from Retained Personal Data are Deleted)

Article 5 A period prescribed by cabinet order under Article 2, paragraph (7) of the
Act shall be six months.

(Anonymously Processed Information Database etc.)

Article 6 Those prescribed by cabinet order under Article 2, paragraph (10) of the
Act mean a collective body of information including a table of contents, index orsimilar others to facilitate search of information that has been systemicallyorganized by arranging anonymously processed information contained in the
database etc. according to a certain rule that enables specified anonymously
processed information to be readily searched for.

5

Ver.1 December, 2016
Personal Information Protection Commission, Japan(Cases in which special care-required personal information may be acquired withouta principal’s consent)

Article 7 Those cases prescribed by cabinet order under Article 17, paragraph (2),item (vi) of the Act shall be those cases set forth in the following.

(i) cases in which seemingly-clear special care-required personal information is
acquired by visual observation, filming or photographing of a principal;(ii) when receiving the provision of special care-required personal information
organized as personal data in those cases set forth in each item of Article 23,
paragraph (5) of the Act.

(Necessary Matter relating to Ensuring the Proper Handling of Retained Personal
Data)

Article 8 Those prescribed by cabinet order under Article 27, paragraph (1), item(iv) of the Act shall be those set forth in the following;(i) where to lodge a complaint about the handling of retained personal data by thesaid personal information handling business operator;(ii) In those cases where the said personal information handling business operator
is a covered business operator of an accredited personal information
protection organization, the appellation of the accredited personal information
protection organization and where to lodge a petition for resolving a complaint.

(Personal Information Handling Business Operator’s Method of Disclosing Retained
Personal Data)

Article 9 A method prescribed by cabinet order under Article 28, paragraph (2) ofthe Act shall be the one by delivering a written document (when there is a method
agreed on by a person having requested disclosure, that method).

6

Ver.1 December, 2016
Personal Information Protection Commission, Japan(Method of Receiving a Demand etc. for Disclosure etc.)

Article10 Those matters which a personal information handling business operator
may prescribe as a method of receiving a demand etc. for disclosure etc. pursuant
to the provisions of Article 32, paragraph (1) of the Act, shall be as set forth in thefollowing:(i) where to file a demand etc. for disclosure etc.;(ii) a format of a document (including an electromagnetic record; the same shallapply in Article 14, paragraph (1) and Article 21, paragraph (3)) to be submitted
at the time of making a demand etc. for disclosure etc. and other forms whereina demand etc. for disclosure etc. may be made;(iii) a method of confirming that a person making a demand etc. for disclosure etc.
is a principal or an agent prescribed in the following Article;(iv) a method of collecting a fee under Article 33, paragraph (1) of the Act.

(Agent who may Make a Demand etc. for Disclosure etc.)

Article 11 An agent who may make a demand etc. for disclosure etc. pursuant to
the provisions of Article 32, paragraph (3) of the Act shall be an agent set forth in
the following:(i) a statutory agent of a minor or adult ward;(ii) an agent entrusted by a principal with making a demand etc. for disclosure etc.

(Circumstances Prescribed by Cabinet Order under Article 44, paragraph (1) of theAct)

Article 12 Circumstances prescribed by cabinet order under Article 44, paragraph(1) of the Act shall be those circumstances falling under any of each following item;7

Ver.1 December, 2016
Personal Information Protection Commission, Japan(i) there is a need to urgently and intensively ensure the proper handling of
personal information etc.;(ii) besides the preceding item, there is a particular need to apply expert knowledge
gained by a business jurisdictional minister in order to effectively and efficiently
ensure the proper handling of personal information etc.

(Delegation of an Authority to a Business Jurisdictional Minister)

Article 13 The Personal Information Protection Commission shall, in case ofdelegating an authority under the provisions of Article 40, paragraph (1) of the Act,
pursuant to the provisions of Article 44, paragraph (1) of the Act, delegate theauthority to a business jurisdictional minister by deciding a scope of administrative
affairs to be delegated and an applicable term for delegation. This, however, shallnot preclude the Personal Information Protection Commission from solely
exercising the authority.

(2) The Personal Information Protection Commission shall, when deciding a scope ofadministrative affairs to be delegated and an applicable term for delegation
pursuant to the provisions of the preceding paragraph, consult in advance with abusiness jurisdictional minister.

(3) The Personal Information Protection Commission shall, when delegating an
authority pursuant to the provisions of paragraph (1), announce to the public abusiness jurisdictional minister to whom the authority is delegated, a scope ofadministrative affairs to be delegated, and an applicable term for delegation.

(Report on the Results of an Exercised Authority)

Article 14 A report pursuant to the provisions of Article 44, paragraph (2) of the Act
shall be made in a document which states or records a matter set forth in thefollowing regarding the results of an exercised authority at every time when a term
set by the Personal Information Protection Commission has passed during anapplicable term for delegation set forth in paragraph (1) of the preceding Article (orimmediately if it has been recognized that a personal information handlingbusiness operator etc. committed a violating act of the provisions under Chapter IV
Section 1 or Section 2).
8

Ver.1 December, 2016
Personal Information Protection Commission, Japan(i) facts ascertained as a result of an ordered submission of a report or material ora conducted onsite inspection;(ii) other referential matters(2) The Personal Information Protection Commission shall, when deciding a reporting
term pursuant to the provisions of the preceding paragraph, consult in advancewith a business jurisdictional minister.

(Delegation of an Authority to Head etc. of a Local Branch Bureau etc.)

Article 15 A business jurisdictional minister may delegate an authority delegatedpursuant to the provisions of Article 44, paragraph (1) and an authority under theprovisions of paragraph (2) of the said Article to a head of an agency under Article
49, paragraph (1) of the Act for Establishment of the Cabinet Office (Act No. 89 of
1999) (excluding a Commissioner of the Financial Services Agency; the same shallapply hereinafter in this Article.), to a head of an agency under Article 3, paragraph(2) of the National Government Organization Act (Act No. 120 of 1948), or to a
Commissioner General of the National Police Agency.

(2) A business jurisdictional minister (or a head of an agency in cases where, anauthority has been delegated pursuant to the provisions of the preceding
paragraph to the head of an agency under Article 49, paragraph (1) of the Act for
Establishment of the Cabinet Office or to the head of an agency under Article 3,
paragraph (2) of the National Government Organization Act) may delegate an
authority delegated pursuant to the provisions of Article 44, paragraph (1) (or an
authority delegated pursuant to the provisions of the preceding paragraph in thesaid case (excluding an authority pursuant to the provisions of paragraph (2) ofthat Article)) to a head of a secretariat, bureau, or department under Article 17 or
Article 53 of the Act for Establishment of the Cabinet Office; to an official under
Article 17, paragraph (1) or Article 62, paragraph (1) or paragraph (2) of that Act;to a head of a local branch bureau under Article 43 or Article 57 of that Act; to ahead of a secretariat, bureau, or department under Article 7 of the National
Government Organization Act; to a head of a local branch bureau under Article 9of that Act; or to an official under Article 20, paragraph (1) or paragraph (2) of thatAct.

9

Ver.1 December, 2016
Personal Information Protection Commission, Japan(3) A Commissioner General of the National Police Agency may delegate an
authority delegated pursuant to the provisions of paragraph (1) (excluding an
authority under the provisions of Article 44, paragraph (2) of the Act) to a head of
the Commissioner General's Secretariat or a bureau under Article 19, paragraph(1) of the Police Act (Act No. 162 of 1954); a department under paragraph (2) ofthat Article; or a regional institution under Article 30, paragraph (1) of that Act.

(4) A business jurisdictional minister, a head of an agency under Article 49,
paragraph (1) of the Act for Establishment of the Cabinet Office, a head of anagency under Article 3, paragraph (2) of the National Government Organization
Act, or a Commissioner General of the National Police Agency shall, whendelegating an authority pursuant to the provisions of the preceding threeparagraphs, announce to the public the governmental position of an official
granted delegation, a scope of administrative affairs subject to delegation and an
applicable term for delegation.

(Delegation etc. of an Authority to the Securities and Exchange SurveillanceCommission)

Article 16 A Commissioner of the Financial Services Agency delegates an authority
delegated pursuant to the provisions of Article 44, paragraph (4) (except for an
authority under the provisions of paragraph (2) of the said Article and limited tothose matters made to belong to the authority of the Securities and Exchange
Surveillance Commission pursuant to the provisions of the Financial Instruments
and Exchange Act (Act No.25 of 1948), Act on Investment Trusts and Investment
Corporations (Act No.198 of 1951), Act on the Securitization of Assets (Act No.105
of 1998) and Act on Book Entry of Corporate Bonds and Shares (Act No. 75 of
2001)) to the Securities and Exchange Surveillance Commission. This, however,shall not preclude a Commissioner of the Financial Services Agency from solely
exercising the authority.

(2) The Securities and Exchange Surveillance Commission shall, when having
exercised an authority delegated pursuant to the provisions of the preceding
paragraph, report the results therefrom promptly to a Commissioner of the
Financial Services Agency.

10Ver.1 December, 2016
Personal Information Protection Commission, Japan(Delegation of an Authority to a Director-General of a Local Finance Bureau etc.)

Article 17 A Commissioner of the Financial Services Agency delegates an authority
delegated pursuant to the provisions of Article 44, paragraph (4) (excluding an
authority delegated to the Securities and Exchange Surveillance Commission
pursuant to the provisions of paragraph (2) and paragraph (5) of the said Article) toa Director-General of a Local Finance Bureau which has jurisdiction over thelocation of a primary office or business establishment (referred to as a “primary
office etc.” in the succeeding item and the paragraph (1) of the succeeding Article)of a personal information handling business operator (or a Director-General of the
Fukuoka Local Finance Branch Bureau in cases where the said location is in thejurisdictional district of the Fukuoka Local Finance Branch Bureau). This, however,shall not preclude a Commissioner of the Financial Services Agency from solely
exercising the authority.

(2) An authority delegated pursuant to the preceding paragraph and related to theother offices than a primary office etc. (hereinafter referred to as a “secondary
office etc.” in this paragraph and paragraph (2) of the succeeding Article) may be
exercised by a Director-General of a Local Finance Bureau or a Director-Generalof the Fukuoka Local Finance Branch Bureau prescribed in the preceding
paragraph, as well as a Director-General of a Local Finance Bureau which has
jurisdiction over the location of the secondary office etc. (or a Director-General of
the Fukuoka Local Finance Branch Bureau in cases where the said location is in
the jurisdictional district of the Fukuoka Local Finance Branch Bureau).

Article 18 The Securities and Exchange Surveillance Commission delegates anauthority delegated pursuant to the provisions of Article 44, paragraph (5) to a
Director-General of a Local Finance Bureau which has jurisdiction over the locationof a primary office etc. of a personal information handling business operator etc. (ora Director-General of the Fukuoka Local Finance Branch Bureau in cases where
the said location is in the jurisdictional district of the Fukuoka Local Finance Branch
Bureau). This, however, shall not preclude the Securities and Exchange
Surveillance Commission from solely exercising the authority.

(2) An authority delegated pursuant to the provisions of preceding paragraph andrelated to a secondary office etc. may be exercised by a Director-General of a
Local Finance Bureau or a Director-General of the Fukuoka Local Finance Branch
Bureau prescribed in the said paragraph, as well as a Director-General of a Local
Finance Bureau which has jurisdiction over the location of the secondary office11Ver.1 December, 2016
Personal Information Protection Commission, Japanetc. of a personal information handling business operator etc. (or a DirectorGeneral of the Fukuoka Local Finance Branch Bureau in cases where the said
location is in the jurisdictional district of the Fukuoka Local Finance Branch
Bureau)(Application for Accreditation to Become an Accredited Personal Information
Protection Organization)

Article19 An application for accreditation pursuant to the provisions of Article 47,
paragraph (2) of the Act, shall be filed by submitting a written application
containing those matters set forth in the following to the Personal Information
Protection Commission:(i) the appellation and address, and the name of a representative or administrator;(ii) the location of an office where services relating to an application for
accreditation would be rendered;(iii) a summary of services relating to an application for accreditation (including
whether information handled by a covered business operator is personal
information or anonymously processed information)(2) A written application under the preceding paragraph shall have a document set
forth in the following attached thereto:(i) articles of incorporation, articles of endowment and other basic governing
documents;(ii) a document wherein a person applying to be accredited pledges that it does not
fall under the provisions of each item of Article 48 of the Act;(iii) a document stating a method of rendering services relating to an application for
accreditation;(iv) a document demonstrating sufficient knowledge and capability to properly and12Ver.1 December, 2016
Personal Information Protection Commission, Japanassuredly render services relating to an application for accreditation;(v) a document demonstrating financial bases including the latest business year’s
annual report, balance sheet, income and expenditure account statement,
property inventory list (in case of a corporation established in the business year
encompassing the day of the application, a property inventory list as of the timeof the establishment);(vi) a document stating the name, address and brief personal history of a director;(vii) a document stating the name or appellation of a covered business operator,
and a document verifying that the covered business operator is either aconstituent member of a person who intends to receive an accreditation or aperson who has agreed to be covered by services relating to an application for
accreditation;(viii) in case of performing other services than those relating to an application for
accreditation, a document stating the type and outline of the other services;(ix) a document stating other referential matters.

(3) An accredited personal information protection organization shall, when a matterset forth in each item of paragraph (1) or matters stated in a document set forth initem (ii) through item (iv), item (vi), or item (viii) of the preceding paragraph havechanged, submit a notification to that effect to the Personal Information Protection
Commission without delay (including a reason for a change when a matter statedin a document set forth in item (iii) of that paragraph has changed).

(Notifying the Termination of Accredited Services)

Article 20 An accredited personal information protection organization shall, whenintending to terminate accredited services, submit a notification stating thosematters set forth in the following to the Personal Information Protection
Commission by not later than three months before the date it intends to terminate
the services:

13Ver.1 December, 2016
Personal Information Protection Commission, Japan(i) the appellation and address, and the name of a representative or administrator;(ii) the date of intending to finish receiving a petition under Article 52, paragraph (1)of the Act;(iii) the date of intending to terminate accredited services;(iv) a reason for terminating accredited services.

(Administrative Affairs Handled by a Local Government Head etc.)

Article 21 Administrative affairs belonging to the authority of the Personal
Information Protection Commission under the provisions of paragraph (1), Article
40 (hereinafter in this Article referred to as “inspection etc. related affairs”) are to
be handled by a head of a local government or other enforcement agency(hereinafter in this Article referred to as a “local government head etc.”) in cases
where the said authority has been delegated to a business jurisdictional minister
pursuant to Article 44, paragraph (1) or to a Commissioner of the Financial
Services Agency pursuant to the provisions of paragraph (4) of the said Article, andwhen a whole or part of administrative affairs belonging to an authority related tocollecting a report or conducting an inspection in connection with that business
which a personal information handling business operator performs and which thesaid business jurisdictional minister or the said Commissioner of the Financial
Services Agency have jurisdiction over are to be conducted by the local
government head etc. pursuant to the provisions of other laws and regulations. If,
in such cases as this, there are two or more local government heads that are tohandle the said affairs, none of them shall be precluded from solely handlinginspection etc. related affairs.

(2) The provisions of the preceding paragraph shall not preclude a businessjurisdictional minister or a Commissioner of the Financial Services Agency fromsolely conducting inspection etc. related affairs.

(3) A local government head etc. having conducted inspection etc. related affairs
pursuant to the provisions of paragraph (1) shall report to the Personal
Information Protection Commission through a business jurisdictional minister or a
Commissioner of the Financial Services Agency at every time when a term
14Ver.1 December, 2016
Personal Information Protection Commission, Japandecided by the Personal Information Protection Commission pursuant to theprovisions of Article 14, paragraph (1) has elapsed (or immediately when it has
been recognized that a personal information handling business operator etc.
committed a violating act of the provisions under Chapter Ⅳ, Section 1 or Section
2 of the Act) in a written document which states or records a matter set forth ineach item of the said Article concerning the results of inspection etc. relatedaffairs conducted during the said term.

(4) In cases where a local government head etc. conduct inspection etc. relatedaffairs pursuant to the provisions of paragraph (1), the provisions of Article 40 of
the Act relating to the Personal Information Protection Commission concerning
the inspection etc. related affairs shall apply to the local government head etc. as
the provisions relating to the local government head etc.

15