Silviase/jgov_v1.4_full_ann huggingface dataset:
falls under any of each item of Article 23, paragraph (1) or paragraph (5) (this means, in case of a personal data provision pursuant to the provisions of the preceding Article, any of each item of Article 23, paragraph (1)).

(2) A personal information handling business operator shall maintain a record under the preceding paragraph for a period of time prescribed by rules of the Personal Information Protection Commission from the date when it kept the record.

(Confirmation etc. when Receiving a Third Party Provision)

## Article 26

(1) A personal information handling business operator shall, when receiving the provision of personal data from a third party, confirm those matters set forth in the following pursuant to rules of the Personal Information Protection Commission. This, however, shall not apply in cases where the said personal data provision falls under any of each item of Article 23, paragraph (1) or paragraph (5).

(i) the name or appellation and address of the third party and, for a corporate body, the name of its representative (for a non-corporate body having appointed a representative or administrator, the said representative or administrator)

(ii) circumstances under which the said personal data was acquired by the said third party

(2) A third party under the preceding paragraph shall, in cases where a personal information handling business operator confirms pursuant to the provisions of the preceding paragraph, not deceive the personal information handling business operator on a matter relating to the confirmation.

(3) A personal information handling business operator shall, when having confirmed pursuant to the provisions of paragraph (1), keep a record pursuant to rules of the Personal Information Protection Commission on the date when it received the provision of personal data, a matter concerning the said confirmation, and other matters prescribed by rules of the Personal Information Protection Commission.

(4) A personal information handling business operator shall maintain a record under the preceding paragraph for a period of time prescribed by rules of the Personal Information Protection Commission from the date when it kept the record.
(Public Disclosure etc. on Matters relating to Retained Personal Data)

## Article 27

(1) A personal information handling business operator shall, concerning its retained personal information, put those matters set forth in the following into a state where a principal can know (including those cases in which it, at the request of a principal, responds without delay).

(i) the name or appellation of the said personal information handling business operator

(ii) the utilization purpose of all retained personal data (excluding those cases falling under item (i) through item (iii) of Article 18, paragraph (4))

(iii) the procedures for responding to a request pursuant to the provisions of the succeeding paragraph or a demand pursuant to the provisions of the succeeding Article, paragraph (i); Article 29, paragraph (1); or Article 30, paragraph (1) or paragraph (3) (including, when the amount of a fee has been decided pursuant to the provisions of Article 33, paragraph (2), the amount of the fee)

(iv) besides those set forth under the preceding three items, those prescribed by cabinet order as a necessary matter to ensure the proper handling of retained personal data

(2) A personal information handling business operator shall, when requested by a principal to get informed of a utilization purpose of retained personal data that can identify the principal, inform the said principal thereof without delay. This, however, shall not apply in those cases falling under any of each following item.

(i) cases in which the utilization purpose of retained personal data that can identify the said principal is clear pursuant to the provisions of the preceding paragraph

(ii) cases falling under item (i) through item (iii) of Article 18, paragraph (4)

(3) A personal information handling business operator shall, when having been requested based on the provisions of the preceding paragraph but decided not to inform a principal of the utilization purpose of retained personal data, inform the principal to that effect without delay.
(Disclosure)

Article 28

(1) A principal may demand of a personal information handling business operator disclosing retained personal data that can identify him or herself.

(2) A personal information handling business operator shall, when having received a demand pursuant to the provisions of the preceding paragraph, disclose retained personal data to a principal without delay pursuant to a method prescribed by cabinet order. However, in cases where disclosing such data falls under any of each following item, a whole or part thereof may not be disclosed.

(i) cases in which there is a possibility of harming a principal or third party’s life, body, fortune or other rights and interests

(ii) cases in which there is a possibility of interfering seriously with the said personal information handling business operator implementing its business properly

(iii) cases of violating other laws or regulations

(3) A personal information handling business operator shall, when having decided not to disclose a whole or part of retained personal data in connection with a demand pursuant to the provisions of paragraph (1) or when the retained personal data does not exist, inform a principal thereof without delay.

(4) In cases where a whole or part of retained personal data that can identify a principal is to be disclosed to the principal pursuant to the provisions of other laws or regulations using a method equivalent to that prescribed in the main clause of paragraph (2), the provisions of paragraph (1) and paragraph (2) shall not apply in regard to the said whole or part of retained personal data.

(Correction etc.)

Article 29

(1) A principal may, when the contents of retained personal data that can identify the principal are not factual, demand of a personal information handling business operator making a correction, addition or deletion (hereinafter referred to as a “correction etc.” in this Article) in regard to the
contents of the retained personal data.

(2) A personal information handling business operator shall, in case of having received a demand pursuant to the provisions of the preceding paragraph except in cases where special procedure concerning a correction etc. of the contents is prescribed by the provisions of other laws or regulations, conduct a necessary investigation without delay to the extent necessary to achieve a utilization purpose and, based on the result thereof, make a correction etc. of the contents of the retained personal data.

(3) A personal information handling business operator shall, when having made a correction etc. on a whole or part of the contents of the retained personal data in connection with a demand pursuant to the provisions under paragraph (1) or when having made a decision not to make a correction etc., inform a principal without delay to that effect (including, when having made a correction etc., the contents thereof).

(Utilization Cease etc.)

## Article 30

(1) A principal may, when retained personal data that can identify the principal is being handled in violation of the provisions of Article 16 or has been acquired in violation of the provisions of Article 17, demand of a personal information handling business operator a utilization cease or deletion (hereinafter referred to as a “utilization cease etc.” in this Article) of the retained personal data.

(2) A personal information handling business operator shall, in case of having received a demand pursuant to the provisions of the preceding paragraph and when it has become clear that there is a reason in the demand, fulfill a utilization cease etc. of the said retained personal data to the extent necessary to redress a violation without delay. This, however, shall not apply in cases where a utilization cease etc. of the said retained personal data requires a large amount of expenses or other cases where it is difficult to fulfil a utilization cease etc. and when necessary alternative action is taken to protect a principal's rights and interests.

(3) A principal may, when retained personal data that can identify the principal is being provided to a third party in violation of the provisions of Article 23, paragraph (1) or Article 24, demand of a personal information handling business operator ceasing a third-party provision of the retained personal data.
(4) A personal information handling business operator shall, in case of having received a demand pursuant to the provisions of the preceding paragraph and when it has become clear that there is a reason in the demand, cease a third-party provision of the retained personal data without delay. This, however, shall not apply in cases where ceasing a third-party provision of the said retained personal data requires a large amount of expenses or other cases where it is difficult to cease a third-party provision and when necessary alternative action is taken to protect a principal’s rights and interests.

(5) A personal information handling business operator shall, when having fulfilled a utilization cease etc. or decided not to fulfill a utilization cease etc. of a whole or part of retained personal data in connection with a demand pursuant to the provisions of paragraph (1), or when having ceased a third-party provision or decided not to cease a third-party provision of a whole or part of retained personal data in connection with a demand pursuant to the provisions of paragraph (3), inform a principal to that effect without delay.

## (Explanation of Reason)

Article 31 A personal information handling business operator shall, in case of informing a principal to the effect that, as regards a whole or part of action requested or demanded by the principal pursuant to the provisions of Article 27, paragraph (3); Article 28, paragraph (3); Article 29, paragraph (3); or the preceding Article, paragraph (5), the action will not be taken, or to the effect that different action from the said action will be taken, strive to explain a reason therefor to the said principal.

(Procedure for Responding to a Demand etc. for Disclosure etc.)

## Article 32

(1) A personal information handling business operator may, as regards a request pursuant to the provisions of Article 27, paragraph (2) or a demand pursuant to the provisions of Article 28, paragraph (1); Article 29, paragraph (1); Article 30, paragraph (1) or paragraph (3) (hereinafter referred to as a "demand etc. for disclosure etc." in this Article and Article 53, paragraph (1)), decide on a method of receiving a request or demand pursuant to those prescribed by cabinet order. In this case, a principal shall make a demand etc. for disclosure etc. in accordance with the method.

(2) A personal information handling business operator may, as regards a demand etc. for disclosure etc., request a principal to present a matter sufficient to specify retained personal data subject to the demand etc. In this
case, a personal information handling business operator shall take appropriate action in consideration of a principal’s convenience such as providing information conducive to specify the retained personal data so that the principal would be able to easily and precisely make a demand etc. for disclosure etc.

(3) A demand etc. for disclosure etc. may be made through an agent pursuant to those prescribed by cabinet order.

(4) A personal information handling business operator shall, in establishing a procedure for responding to a demand etc. for disclosure etc. based on the provisions of the preceding three paragraphs, give consideration so as not to impose excessive burden on a principal.

(Fee)

Article 33

(1) A personal information handling business operator may, when having been requested to inform of a utilization purpose pursuant to the provisions of Article 27, paragraph (2) or when having received a demand for disclosure pursuant to the provisions of Article 28, paragraph (1), collect a fee in relation to taking such action.

(2) A personal information handling business operator shall, in case of collecting a fee pursuant to the provisions of the preceding paragraph, decide on the amount of the fee within a range recognized as reasonable considering actual expenses.

(Advance Demand)

Article 34

(1) A principal may, when intending to file a lawsuit in connection with a demand pursuant to the provisions of Article 28, paragraph (1); Article 29, paragraph (1); or Article 30, paragraph (1) or paragraph (3), not file the lawsuit unless the principal had previously issued the demand against a person who should become a defendant in the lawsuit and two weeks have passed from the delivery day of the issued demand. This, however, shall not apply when the person who should become a defendant in the lawsuit has rejected the demand.

(2) A demand under the preceding paragraph is deemed as having been delivered at the time when such a demand should have normally been
delivered.

(3) The provisions of the preceding two paragraphs shall apply mutatis mutandis to a petition for a provisional disposition order in connection with a demand pursuant to the provisions of Article 28, paragraph (1); Article 29, paragraph (1); or Article 30, paragraph (1) or paragraph (3).

(Personal Information Handling Business Operator’s Dealing with a Complaint)

Article 35

(1) A personal information handling business operator shall strive to deal appropriately and promptly with a complaint about the handling of personal information.

(2) A personal information handling business operator shall strive to establish a system necessary to achieve a purpose under the preceding paragraph.

Section 2 Duties of an Anonymously Processed Information Handling Business Operator etc.

(Production etc. of Anonymously Processed Information)

Article 36

(1) A personal information handling business operator shall, when producing anonymously processed information (limited to those constituting anonymously processed information database etc.; hereinafter the same), process personal information in accordance with standards prescribed by rules of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual and restore the personal information used for the production.

(2) A personal information handling business operator, when having produced anonymously processed information, shall, in accordance with standards prescribed by rules of the Personal Information Protection Commission as those necessary to prevent the leakage of information relating to those descriptions etc. and individual identification codes deleted from personal information used to produce the anonymously processed information, and information relating to a processing method carried out pursuant to the provisions of the preceding paragraph, take action for the security control of such information.
(3) A personal information handling business operator, when having produced anonymously processed information, shall, pursuant to rules of the Personal Information Protection Commission, disclose to the public the categories of information relating to an individual contained in the anonymously processed information.

(4) A personal information handling business operator, when having produced anonymously processed information and providing the anonymously processed information to a third party, shall, pursuant to rules of the Personal Information Protection Commission, in advance disclose to the public the categories of information concerning an individual contained in anonymously processed information to be provided to a third party and its providing method, and state to the third party explicitly to the effect that the information being provided is anonymously processed information.

(5) A personal information handling business operator shall, when having produced anonymously processed information and making itself handle the anonymously processed information, not collate the said anonymously processed information with other information in order to identify a principal concerned with personal information used to produce the said anonymously processed information.

(6) A personal information handling business operator shall, when having produced anonymously processed information, strive to take itself necessary and appropriate action for the security control of the anonymously processed information and necessary action for ensuring the proper handling of the anonymously processed information such as dealing with a complaint about the handling, including producing, of the said anonymously processed information, and strive to disclose to the public the contents of such action taken.

## (Provision of Anonymously Processed Information)

Article 37 An anonymously processed information handling business operator, when providing anonymously processed information (excluding those which it produced itself by processing personal information; hereinafter the same in this Section) to a third party, shall, pursuant to rules of the Personal Information Protection Commission, in advance disclose to the public the categories of personal information contained in anonymously processed information to be provided to a third party and state to the third party explicitly to the effect that the provided information is anonymously processed information.
(Prohibition against the Act of Identifying)

Article 38 An anonymously processed information handling business operator, shall, in handling anonymously processed information, neither acquire information relating to those descriptions etc. or individual identification codes deleted from the personal information and information relating to a processing method carried out pursuant to the provisions of Article 36, paragraph (1), nor collate the said anonymously processed information with other information in order to identify a principal concerned with personal information used to produce the anonymously processed information.

(Security Control Action etc.)

Article 39 An anonymously processed information handling business operator shall strive to take itself necessary and appropriate action for the security control of anonymously processed information and necessary action to ensure the proper handling of anonymously processed information such as dealing with a complaint about the handling of anonymously processed information, and shall strive to disclose to the public the contents of such action taken.

## Section 3 Supervision

(Report and Onsite Inspection)

Article 40

(1) The Personal Information Protection Commission may, to the extent necessary to implement the provisions under the preceding two Sections and this Section, require a personal information handling business operator or anonymously processed information handling business operator (hereinafter referred to collectively as a “personal information handling business operator etc.”) to submit necessary information or material relating to the handling of personal information or anonymously processed information (hereinafter referred to collectively as “personal information etc.”), or have its officials enter a business office or other necessary place of a personal information handling business operator etc., inquire about the handling of personal information etc., or inspect a book, document and other property.

(2) An official who conducts an onsite inspection pursuant to the provisions of the preceding paragraph shall carry a certificate for identification, and present it when requested by a person concerned.
(3) An onsite inspection authority pursuant to the provisions of paragraph (1) shall not be construed as granted for a criminal investigation.

(Guidance and Advice)

Article 41 The Personal Information Protection Commission may, to the extent necessary to implement the provisions under the preceding two Sections, provide a personal information handling business operator etc. with necessary guidance or advice on the handling of personal information etc.

(Recommendation and Order)

## Article 42

(1) The Personal Information Protection Commission may, when recognizing there is a need for protecting an individual’s rights and interests in cases where a personal information handling business operator has violated the provisions under Article 16 through Article 18, Article 20 through Article 22, Article 23 (excluding paragraph (4)), Article 24, Article 25, Article 26 (excluding paragraph (2)), Article 27, Article 28 (excluding paragraph (1)), Article 29, paragraph (2) or (3), Article 30 (2), paragraph (4) or (5), Article 33, paragraph (2) or Article 36 (excluding paragraph (6)) or in cases where an anonymously processed information handling business operator has violated the provisions under Articles 37 or 38, recommend the personal information handling business operator etc. to suspend the act of violating or take other necessary action to rectify the violation.

(2) The Personal Information Protection Commission may, when recognizing that a serious infringement of an individual’s rights and interests is imminent in cases where a personal information handling business operator etc. having received a recommendation pursuant to the provisions under the preceding paragraph did not take action in line with the recommendation without legitimate ground, order the personal information handling business operator etc. to take action in line with the said recommendation.

(3) The Personal Information Protection Commission may, notwithstanding the provisions under the preceding two paragraphs when recognizing there is a need to take urgent action because there is a fact that seriously harms an individual’s rights and interests in cases where a personal information handling business operator has violated the provisions of Article 16, Article 17, Article 20 through Article 22, Article 23, paragraph (1), Article 24 or Article 36, paragraph (1), paragraph (2) or paragraph (5) or in cases where an anonymously processed information handling business operator has violated the provisions under Article 38, order the personal information