Regulations for Protection of Personal Information (11.10)

Radiation Effects Research Foundation
Regulations for Protection of Personal Information

Section 1 – General regulations(Objective)
Article 1 – The objective of these regulations, based on the provisions of Article 65-2,
Articles of Incorporation of the Radiation Effects Research Foundation (hereafterreferred to as “this juristic person”) and in accord with the idea that personal
information should be handled carefully to respect each individual, is to define
necessary matters for the proper handling of personal information at this juristicperson.
(Definition of employees)
Article 2 – “Employees” denote individuals stipulated in Article 2 of the Rules of
Employment as well as all individuals engaged in activities at this juristic person bydirection and order of this juristic person.
(Employees’ responsibilities)
Article 3 – In handling personal information, employees pledge to comply with the law
concerning protection of personal information (Act No. 57 of 2003: hereafterreferred to as the “Personal Information Protection Law”) and other laws andordinances based on the Personal Information Protection Law.
2. Based on the provisions on exemption from application of the Personal Information
Protection Law, 1 employees, in conducting research and studies to which thePersonal Information Protection Law are not applied, pledge to comply with thegovernment-issued Ethical Guidelines for Life-Science and Medical Research
Involving Human Subjects (Ministry of Education, Culture, Sports, Science andTechnology/Ministry of Health, Labour and Welfare/Ministry of Economy, Tradeand Industry) (hereafter referred to as the “national ethical guidelines”) as well as
the following items, and intend to properly handle personal information:(1) Prior to conducting research and studies, to have the institutional review board(IRB) review research protocols concerned, and not to initiate the research andstudies concerned without approval from the IRB;
(2) When obtaining personal information from individuals themselves, to informthe individuals of the purpose of use of the personal information in advance,other than cases that are considered exceptions in accordance with laws andordinances;(3) Not to provide personal information to any third party without consent from theindividuals from whom information was obtained, other than cases that areconsidered exceptions in accordance with laws and ordinances;(4) When outsourcing activities to other institutions, to choose reliableorganizations and conclude work contracts with the other parties to ensure
1
The provisions of “Duties of Entities Handling Personal Information, etc.” of the Personal Information
Protection Law shall not apply to cases where, from among entities handling personal information, auniversity and other organization or group aimed at academic studies, or a person belonging thereto, will
provide personal information for use in academic studies.

1(11.10)

Regulations for Protection of Personal Information (11.10)

proper handling of personal information; and(5) To disclose personal information in the custody of this juristic person whenrequested by the individual from whom information was obtained.

Section 2 – Basic items requiring attention from employees incompliance with the Personal Information Protection Law(Specification of purpose of use)
Article 4 – In handling personal information, employees must specify to the extent
possible the purpose of using such information.
(Restrictions on use for other purposes)
Article 5 – Employees must not handle personal information beyond the scope of thepurpose of use, other than cases that are considered exceptions in accordance withlaws and ordinances.
(Notification of purpose of use)
Article 6 – In acquiring personal information, employees must notify the relevant
individual of, or make public, the purpose of use, other than cases that areconsidered exceptions in accordance with laws and ordinances.
(Proper acquisition)
Article 7 – Employees must not acquire personal information through falsification orother fraudulent means.
(Ensured accuracy of personal data)
Article 8 – Employees must strive to maintain personal data accurately and keep suchdata current within the scope necessary for the achievement of the purpose of use.
(Safe management of personal data)
Article 9 – Employees must adopt necessary and proper measures for the prevention ofleakage of, loss of, or damage to personal data.
(Restrictions on provision of personal data to third parties)
Article 10 – Employees must not provide personal data to third parties, other than casesthat are considered exceptions in accordance with laws and ordinances:2.
Those who receive the personal data in question will not fall under the category ofa third party concerning application of the provision stipulated in the previous
paragraph when any of the following circumstances are applicable:(1) When this juristic person entrusts the handling of personal data within the scopenecessary for achievement of the purpose of use;
(2) When this juristic person jointly uses personal data with specified individuals
or groups (provided that the parties from whom the data were derived areinformed in advance of this matter, items of the data to be used jointly, the extent
of the individuals or groups using the data jointly, the objective of the users, andthe name of person/others responsible for supervising the personal data
concerned, or that the parties are allowed ready access to the above-mentioned2(11.10)

Regulations for Protection of Personal Information (11.10)

information).

Section 3 – Basic items concerning release of information in accordance with
the Personal Information Protection Law(Release of personal information in the custody of this juristic person)
Article 11 – This juristic person must release without delay an individual’s personal data
in its custody to the individual when the individual requests release of suchinformation, other than cases that are considered exceptions in accordance with laws
and ordinances.
(Correction of personal information in the custody of this juristic person)
Article 12 – When an individual, based on justification that his/her personal data in thecustody of this juristic person are incorrect, requests correction, addition, or deletion(hereafter referred to as “corrections”) of the personal data in question, this juristic
person must investigate without delay the personal data within the scope necessary
for achievement of the purpose of use, and make corrections to the personal data inquestion based on the investigation results.
(Suspension of use)
Article 13 – When an individual, for reasons listed below, requests the suspension of use,deletion, or suspension of the provision to third parties (hereafter referred to as“suspension of use”) of the personal data in the custody of this juristic person, thisjuristic person must implement without delay the suspension of use, other than casesthat are considered exceptions in accordance with laws and ordinances.
(1) Based on justification that the data in question was handled in violation ofArticle 16 of the Personal Information Protection Law (equivalent to Article 5of these regulations);(2) Based on justification that the data in question was acquired in violation ofArticle 17 of the Personal Information Protection Law (equivalent to Article 7of these regulations);(3) Based on justification that the data in question was provided to such parties inviolation of Article 23-1 of the Personal Information Protection Law (equivalentto Article 10 of these regulations).
(Handling of complaints)
Article 14 – This juristic person must take appropriate and prompt action upon receipt ofcomplaints regarding the handling of personal information.

Section 4 – Organization and system(General privacy officer)
Article 15 – The Chairman will appoint a general personal information privacy protection
officer (hereafter referred to as “general privacy officer”) for the comprehensive
handling of personal information at this juristic person.

3(11.10)

Regulations for Protection of Personal Information (11.10)(Privacy officer and personal information custodian(s))
Article 16 – The Chairman will appoint personal information privacy protection officer(s)(hereafter referred to as “privacy officer(s)”) and personal information custodian(s)(hereafter referred to as “information custodian(s)”) for supervising the properhandling of personal information in this juristic person’s departments andSecretariat.
(Committee for promoting personal information protection)
Article 17 – A committee for promoting personal information protection (hereafterreferred to as the “committee”) will be established to deliberate the necessary issues
for the proper handling of personal information at this juristic person.
2. The committee will consist of a general privacy officer, privacy officer(s), andothers whom the general privacy officer deems necessary.
3. The general privacy officer will supervise the committee.
4. The General Affairs Section of the Secretariat will carry out administrative work
related to the operation of the committee.
(Administrative work)
Article 18 – The General Affairs Section of the Secretariat will conduct the administrative
work stipulated in each of the provisions in Article 14.

Section 5 – Other(Disciplinary action)
Article 19 – This juristic person may take disciplinary action based on the Rules of
Employment or work contract rules against employees who violate any of theseregulations.
(Ensuring information system security)
Article 20 – This juristic person will give due consideration to the necessity of safety
management of personal data and will strive to ensure information system security.
(Supervision of the party entrusted)
Article 21 – When entrusting handling of personal data to another party, this juristic
person will conduct necessary and due supervision of the entrusted party in order toensure the safe management of the personal data concerned.
(Revision and abolition)
Article 22 – Revision and abolition of these regulations will be implemented only throughdecisions made by the Board of Directors.

Supplementary Provision(Effective date)
These regulations will be effected from 11 October 2005.

4(11.10)

Regulations for Protection of Personal Information (11.10)

Supplementary Provision(Effective Date)
These regulations will take effect from the date of registration of the establishment asa public interest corporation, as stipulated in paragraph 1 of Article 106 of the Act
Serving as a Complement to Related Laws that Accompany Enactment of the Act on
Authorization of Public Interest Incorporated Associations and Public Interest
Incorporated Foundations and the Act on General Incorporated Associations andGeneral Incorporated Foundations.

Supplementary Provision(Effective Date)
These regulations will take effect on the date of approval by the Board of Directors(June 4, 2014).

Supplementary Provision(Effective Date)
Based on the procedure in Article 8-3 of the Regulations on Management Authorityof Directors, these regulations will take effect on the date of approval by theExecutive Committee (August 2, 2016) and be applied retroactive to April 1, 2015.
The revised provision in Article 3-2-1, however, will be applied from April 1, 2016.

Supplementary Provision(Effective Date)
These regulations will take effect on the date of approval by the Board of Directors(June 4, 2019).

Supplementary Provision(Effective Date)
These regulations shall take effect on the date of approval by the Board of Directors(June 3, 2021) and be implemented from June 30, 2021.

5(11.10)