1.  'Electronic storage' refers to the temporary, intermediate storage of communications incidental to electronic transmission and the storage of such communications by an electronic communications service for backup protection purposes. (18 U.S.C. § 2511.) 2.  The countries or regions that have obtained the EU Sufficiency Certification are those countries or regions that have been determined by the European Commission to have an adequate level of data protection based on the GDPR or its predecessor, the Data Protection Directive, which is a system for the protection of personal information in the EU (EU Member States and Iceland, Norway and Liechtenstein, which are part of the European Economic Area), which the Commission has designated as countries or regions with systems for the protection of personal information that are deemed to have an equivalent level of protection to our country. In this sense, the fact that a country or region has obtained EU adequacy certification constitutes "information that may serve as an indicator regarding the system for the protection of personal information". 3.  As a prerequisite for participation in the APEC CBPR system, it is stipulated that, like our country, has legislation that conforms to the APEC Privacy Framework and has enforcement authorities to investigate and rectify complaints or issues that cannot be resolved by CBPR-certified businesses or accountability agents. Therefore, economies participating in the APEC CBPR system, like our coutry, have laws that conform to the APEC Privacy Framework and enforcement authorities to enforce such laws, thus generally expecting protection of personal information similar to that in our country. In this sense, the fact that an economy participates in APEC's CBPR system constitutes "information that can be used as an indicator of a system for the protection of personal information". The APEC CBPR system covers the private sector. 4. The eight principles of the OECD Privacy Guidelines serve as fundamental principles referenced by OECD member countries as well as internationally in their efforts to protect personal information. They are used as global standard effectively when countries develop their personal information protection systems. [Items to be noted] ■Act on the Protection of Personal Data (Act No. 57 of 2003) (hereinafter referred to as the "Personal Data Protection Act"). The purpose of Article 28, Paragraph 2 of the Act on the Protection of Personal Information is not only to increase the predictability of risks associated with the provision of personal data to third parties in foreign countries to the individual concerned, but also to encourage business operators who provide personal data to third parties in foreign countries to be more aware than before of the business environment at the third parties in the foreign countries to which they provide the data. The provision of personal data to a third party in a foreign country also includes the point of encouraging the business operator to be more aware of the business environment of the third party in the foreign country to which the personal data is provided. In addition, the specific content of the information to be provided by the business operator to the individual in accordance with the said paragraph may vary depending on the individual case. Therefore, confirmation of the system for the protection of personal data in a foreign country should be the responsibility of the business operator providing personal data to a third party in a foreign country, and the above reference information provided by the Committee should be referenced only as a supplement. ■The above reference information provided by the Committee is based on the results of the "Survey of Systems for the Protection of Personal Information in Foreign Countries" conducted by the Committee, and is based solely on information as of October 2021, when the survey was conducted. After the date of the survey, there may be changes in the system for the protection of personal information in foreign countries, and the content of information that should be provided to the individual by a business entity that provides personal data to a third party in a foreign country may have been changed. ■The above reference information provided by the Committee is based on the results of the "Survey of Systems for the Protection of Personal Information in Foreign Countries" conducted by the Committee. It should be noted that the investigation was conducted with limited scope regarding the applicable laws and regulations from the following perspective, and is not necessarily exhaustive. If an entity that provides personal data to a third party in a foreign country possesses relevant information other than the above reference information, such information must also be provided to the individual in accordance with Article 28, Paragraph 2 of the Act on the Protection of Personal Information and Article 17, Paragraph 2 of the Enforcement Regulations of the Act on the Protection of Personal Information (the Rules of the Personal Information Protection Commission, No. 3 of 2016). The information must also be provided to the person in question. - The following laws and regulations shall be covered by the survey, which are listed as representative by the consignor or subcontractor for the above survey. -  The laws on the protection of personal information applicable to specific sectors in foreign countries that do not have comprehensive legislation on the protection of personal information -   Laws and regulations concerning the system related to the obligation to preserve personal information in the territory -   Laws and regulations concerning a system imposing on businesses the obligation to cooperate with government information gathering activities -   With respect to laws and regulations concerning systems that impose an obligation on business operators to cooperate with government information collection activities, the survey shall cover systems in which foreign governments have access to personal information held by business operators for both or either criminal law enforcement purposes or national security purposes and in which the business operators are required under such laws and regulations to provide personal information to the foreign government. The survey shall cover those that are required by such laws and regulations to provide personal information to foreign governments. (Updated January 25, 2022)