Page 1

Guidelines for personal information protection in the letter service business field
(May 17, 2017 Ministry of Internal Affairs and Communications Notification No. 168)

table of contents
Chapter 1 General Provisions (Articles 1-3)
Chapter 2 Common Principles Regarding the Handling of Personal Information (Article 4-Article 29)
Chapter 3 Miscellaneous Provisions (Article 30)

Chapter 1 General Rules
(Purpose)
Article 1 This guideline is a regulation of the Law Concerning the Protection of Personal Information (hereinafter referred to as the "law").
Based on the rules and in the basic policy regarding the protection of personal information (Cabinet decision on April 2, 2006)
Nori, letter service business (private business among personal information handling business stipulated in Article 2, Paragraph 5 of the Act)
Act on Service of Letters by Traders (Act No. 99 of 2004; hereinafter referred to as the "Letter Service Act"
Say. ) General letter service provider prescribed in Article 2, Paragraph 6 and specific letter prescribed in Article 2, Paragraph 9
Refers to a flight operator. same as below. ) Is a letter (Postal Law (Law No. 165 of 1947) No. 4
A letter prescribed in Article 2, paragraph 2. same as below. ) Of secret matters and other personal information
Appropriate and effective implementation of measures to be taken to ensure proper handling
It is defined as a guideline for this purpose.

(General principles of application)
Article 2 The provisions of this guideline are the compliance of letter service operators regarding the proper handling of personal information.
It shall be interpreted and operated as defining the basic matters to be observed.
2 Letter service operators shall be concerned with the provisions of the law and the protection of confidentiality of letters, Article 5 of the Letter Service Law and other related matters.
In addition to complying with the regulations, personal information must be handled properly in accordance with these guidelines.
Absent.

(Definition)
Article 3 The terms used in this guideline are examples of terms used in Article 2 of the Act.
by.

Chapter 2 Common Principles Regarding the Handling of Personal Information
(Specification of purpose of use)
Article 4 When handling personal information, the letter service operator shall use the purpose of use (hereinafter referred to as "interest").
"Purpose". ) Must be specified as much as possible.
2 When changing the purpose of use, the letter service operator has a relevance to the purpose of use before the change.

Page 2

Do not go beyond the range reasonably accepted.

(Restrictions depending on the purpose of use)
Article 5 A letter service operator is specified by the provisions of the preceding article without obtaining the consent of the person in advance.
Personal information must not be handled beyond the scope necessary to achieve the purpose of use.
2 The letter service operator will take over the business from another personal information handling operator due to a merger or other reasons.
If personal information is acquired in connection with this, without obtaining the consent of the person in advance, before the succession
Handling of personal information beyond the scope necessary to achieve the purpose of use of personal information in
It should not be.
(3) The provisions of the preceding two paragraphs shall not apply in the following cases.
When required by law
When it is necessary to protect the life, body or property of two people, and obtain the consent of the person
When it is difficult to do.
(Iii) When it is particularly necessary to improve public health or promote the sound development of children.
When it is difficult to obtain the consent of the person.
Shikoku organizations or local public bodies or those entrusted with them carry out the affairs stipulated by laws and regulations.
When it is necessary to cooperate with what you do, and by obtaining the consent of the person
When there is a risk of hindering the performance of the office work.
4. Notwithstanding the provisions of the preceding paragraph, the letter service operator shall use the letter even in the cases listed in each item of the same paragraph.
Regarding the confidentiality of the letter, except with the consent of the person and other reasons for blocking illegality.
Do not handle personal information.

(Proper acquisition)
Article 6 A letter service operator shall not acquire personal information by deception or other improper means.
2 Letter service operators need to obtain the consent of the person in advance, except in the following cases.
Consideration Personal information must not be obtained.
When required by law
When it is necessary to protect the life, body or property of two people, and obtain the consent of the person
When it is difficult to do.
(Iii) When it is particularly necessary to improve public health or promote the sound development of children.
When it is difficult to obtain the consent of the person.
Shikoku organizations or local public bodies or those entrusted with them carry out the affairs stipulated by laws and regulations.
When it is necessary to cooperate with what you do, and by obtaining the consent of the person
When there is a risk of hindering the performance of the office work.
(V) The personal information requiring consideration is the person, national institution, local public body, each item of Article 76, paragraph 1 of the Act.
To persons listed in, foreign governments, foreign government agencies, foreign local governments, international organizations or foreign countries

Page 3

When published by a person equivalent to the person listed in each item of Article 76, paragraph 1 of the Act
(Vi) By visually observing or photographing the person himself / herself, personal information requiring consideration that is clear in appearance can be obtained.
If you get
(Vii) Proposal of sensitive personal information that is personal data in the cases listed in each item of Article 13, paragraph 8.
When receiving a companion.
3 Notwithstanding the provisions of the preceding paragraph, the letter service operator may be illegal with the consent of the user.
Unless there is a reason for obstruction, personal information related to the confidentiality of the letter must not be obtained.

(Notification of purpose of use at the time of acquisition, etc.)
Article 7 When a letter service operator acquires personal information, the purpose of use shall be announced in advance.
Unless you have, you must promptly notify or announce the purpose of use to the person.
Not.
2 Regardless of the provisions of the preceding paragraph, the letter service operator concludes a contract with the person himself / herself.
The individual stated in the contract or other document (including electromagnetic records; the same shall apply hereinafter).
When acquiring information Others Obtain the personal information of the person directly written in writing from the person.
In that case, the purpose of use must be clearly stated to the person in advance. However
However, if there is an urgent need to protect human life, body or property, this is not the case.
I.
3 If the letter service operator changes the purpose of use, the changed purpose of use will be given to the person himself / herself.
Must be notified or published.
4. The provisions of the preceding three paragraphs shall not apply in the following cases.
(I) By notifying or disclosing the purpose of use to the person, the life, body, of the person or a third party,
When there is a risk of harming property or other rights and interests
(Ii) The right or correctness of the letter service operator by notifying or publicizing the purpose of use.
When there is a risk of harming reasonable profits
Must cooperate with the three national organizations or local public bodies to carry out the affairs stipulated by law
When it is necessary, the relevant office work is done by notifying the person of the purpose of use or making it public.
When there is a risk of interfering with the performance of.
(Iv) When it is recognized that the purpose of use is clear from the status of acquisition

(Ensuring the accuracy of data contents, etc.)
Article 8 Is the letter service operator accurate in personal data within the range necessary to achieve the purpose of use?
Keep the contents up-to-date and delay the personal data when it is no longer necessary to use it.
You must try to erase it without delay.

(Safety management measures)

Page 4

Article 9 The letter service operator may leak, lose or damage the personal data it handles (hereinafter referred to as "leakage").
No, etc. " ) Prevention and other necessary and appropriate measures for the security management of personal data
Must be taken.
2 The letter service operator is a personal information protection manager (related to the handling of personal information of the letter service operator).
Responsible person. ), And formulate and audit internal rules to comply with this guideline.
We must endeavor to improve the system and supervise the handling of personal information of the letter service operator.
Must be.

(Employee supervision)
Article 10 A letter service operator shall, when having its employees handle personal data, the individual concerned.
Do not supervise the employee as necessary and appropriate to ensure the safety management of human data.
Must be.
2 Employees do not unnecessarily inform others of the contents of personal data that they have learned about their work.
It shall be and shall not be used for unreasonable purposes. The same is true even after retiring from that position
And.

(Supervision of contractor)
Article 11 When a letter service operator entrusts all or part of the handling of personal data, it shall be
Necessary for the outsourced person so that the personal data outsourced to be handled can be safely managed.
Necessary and appropriate supervision must be provided.
2 Letter service operators use persons who have taken sufficient measures to protect personal information as outsourcers.
Efforts must be made to establish criteria for selection.
3 The letter service operator shall, in order to comply with the provisions of the preceding paragraph, carry out the following matters at the time of the consignment contract.
We must try to clarify.
(I) Matters concerning the security management of personal data. For example, the following matters.
B. Matters concerning prevention of leakage of personal data and prohibition of plagiarism
(B) Prohibition of processing and use outside the scope of the consignment contract
C. Prohibition of copying and duplication outside the scope of the consignment contract
D Consignment processing period
E. Matters concerning the return, erasure, and destruction of personal data after the completion of consignment processing
(Ii) Content and frequency of reporting to the consignor regarding the handling status of personal data
(Iii) Confirmation that the content and period of the consignment contract are being observed
(Iv) Measures to be taken when the content and period of the entrustment contract are not complied with
(V) Matters concerning reporting and communication in the event of an accident such as leakage of personal data
(Vi) Scope of responsibility of the consignor and the consignee in the event of an accident such as leakage of personal data
4 Persons engaged in the business related to the handling of personal data entrusted by the letter service business operator shall be in that business.

Page 5

We will not let others know the contents of personal data that we have learned about our business, and we will not let you know.
Do not use for any purpose. The same shall apply even after retiring from that position.

(privacy policy)
Article 12 The letter service operator shall have a privacy policy (handling of personal information of the letter service operator).
It is a declaration about the policy regarding the policy. ) Is formulated and announced, and efforts are made to comply with it.
There must be.

(Restrictions on provision to third parties)
Article 13 A letter service operator shall not obtain the consent of the person in advance except in the following cases.
Therefore, personal data must not be provided to a third party.
When required by law
When it is necessary to protect the life, body or property of two people, and obtain the consent of the person
When it is difficult to do.
(Iii) When it is particularly necessary to improve public health or promote the sound development of children.
When it is difficult to obtain the consent of the person.
Shikoku organizations or local public bodies or those entrusted with them carry out the affairs stipulated by laws and regulations.
When it is necessary to cooperate with what you do, and by obtaining the consent of the person
When there is a risk of hindering the performance of the office work.
2 Letter service operators provide personal data provided to third parties (excluding sensitive personal information. Hereinafter, this
Same in section. ), Of personal data that identifies the person at the request of the person
When it is decided to suspend the provision to a third party, regarding the following matters,
Ecklonia cava, notify the person, or put it in a state that the person can easily know, and the law 23
When notifying the Personal Information Protection Commission pursuant to the provisions of Article 2, paragraph 2, regardless of the provisions of the preceding paragraph
Instead, the personal data can be provided to a third party.
(I) The purpose of use is to provide it to a third party.
(Ii) Items of personal data provided to a third party
(3) Method of providing to a third party
(Iv) Suspending the provision of personal data that identifies the person to a third party at the request of the person
thing.
5 How to accept the request of the person
3 If the letter service operator changes the matters listed in item 2, item 3 or item 5 of the preceding paragraph, it may change.
Notify the person in advance of further content, or put it in a state where the person can easily know
At the same time, you must notify the Personal Information Protection Commission.
(4) Notifications pursuant to the provisions of the preceding two paragraphs or measures to be placed in an easily recognizable state shall be provided in the following places.
It shall be done.

Page 6

(I) The person identified by the personal data provided to a third party (in the next issue, "person")
Say. ) Allows the period required to request the suspension of the provision.
(Ii) By an appropriate and rational method that allows the person to reliably recognize the matters listed in each item of paragraph (2).
When.
(5) Notification pursuant to the provisions of paragraph (2) or paragraph (3) must be made by any of the following methods.
Must be.
(I) An electronic information processing organization (Personal Information Protection Commission) as stipulated by the Personal Information Protection Commission.
Telecommunications line between the computer used by the association and the computer used by the person making the notification
An electronic information processing organization connected by. ) How to use
(Ii) Law Enforcement Regulations on the Protection of Personal Information (Personal Information Protection Commission Regulations No. 3 of 2008)
issue. Hereinafter referred to as "rules". ) It should be stated in the notification form in the separate form 1 and the notification form.
Optical disc on which items are recorded (certain items are surely recorded by a method similar to this)
Includes things that can be worn. ) How to submit
6 When a letter service operator makes a notification pursuant to the provisions of paragraph 2 or 3 by an agent
Must submit to the Personal Information Protection Commission a document certifying its authority in accordance with the second rule form.
Must be.
7. The letter service operator shall promptly enter after the announcement pursuant to the provisions of Article 23, Paragraph 4 of the Act.
Matters listed in paragraph 2 (No. 2 and 3 of the same paragraph) by using the Internet or other appropriate methods.
When there is a change in the matters listed in item 5 or item 5, the matters listed in each item after the change)
It shall be announced.
8 In the following cases, the person who receives the provision of the personal data shall apply the provisions of the preceding paragraphs.
Does not correspond to a third party.
(I) All handling of personal data within the scope necessary for the letter service operator to achieve the purpose of use
Or when the personal data is provided by entrusting a part
(Ii) When personal data is provided due to business succession due to a merger or other reasons
(Iii) When personal data shared with a specific person is provided to that specific person
To that effect, items of personal data to be used jointly, and persons to use jointly
Scope of, the purpose of use of the user and the person responsible for the management of the personal data
A state in which the person is notified in advance of the name or name, or the person can easily know the name or name.
When you put it in.
9 The letter service operator shall manage the purpose of use or personal data of the user prescribed in item 3 of the preceding paragraph.
When changing the name or name of the person who is responsible for
You must notify the person in advance or put it in a state that the person can easily know.
I.
10 Notwithstanding the provisions of the preceding paragraphs, the letter service operator shall provide personal data to a third party.
Therefore, we must comply with Article 5 of the Letter Convenience Law and other related provisions concerning the protection of confidentiality of letters.

Page 7

It doesn't become.

(Restrictions on provision to third parties in foreign countries)
Article 14 A letter service operator shall be a foreign country (meaning a country or region outside the region of Japan; the same shall apply hereinafter).
A third party (Handling of personal information) Handling of personal information pursuant to the provisions of Chapter 4, Section 1 of the Act
Necessary to continuously take measures equivalent to the measures that the contractor is supposed to take
Excludes those who have established a system that meets the standards set forth in the next paragraph. The following smells in this article
Same. ), Except for the cases listed in each item of paragraph 1 of the preceding article.
Or, you must obtain the consent of the person in advance to allow the provision to a third party in a foreign country.
I. In this case, the provisions of the same Article (excluding paragraph 10) shall not apply.
2 Regarding the handling of personal data, the business operator handling personal information does not take measures according to the provisions of Chapter 4, Section 1 of the Act.
Determined as necessary measures to continuously take measures equivalent to the measures that should be taken
The criteria to be determined shall fall under any of the following items.
(I) Between the letter service operator and the person who receives the personal data, for the person who receives the personal data
Regarding the handling of the personal data, by an appropriate and rational method, Chapter 4, Section 1 of the Act
The implementation of measures in line with the purpose of the provisions of
(Ii) The person to whom personal data is provided is based on the international framework for handling personal information.
Be certified.

(Creation of records related to provision to a third party, etc.)
Article 15 A letter service operator shall exclude personal data from a third party (excluding those listed in each item of Article 2, Paragraph 5 of the Act).
Ku. The same shall apply hereinafter in this article and the next article. ), Documents, electromagnetic records or
According to the classification in each of the following items by the method of making using icro film,
A record of the matters specified in each item must be created. However, the relevant piece
Provision of personal data is either each item of Article 13, paragraph 1 or each item of paragraph 8 (individuals pursuant to the provisions of the preceding article)
In providing personal data, if any of the items in Article 13, Paragraph 1) applies, this
Not limited.
(I) When personal data is provided to a third party pursuant to the provisions of Article 13, paragraph (2):
Matters listed in
B. Date when the personal data was provided
(B) Name or name of the third party and other matters sufficient to identify the third party (unspecified)
And when it is provided to a large number of people, to that effect)
C. To identify the person's name and other persons identified by the personal data.
Matters
D. Items of the personal data
(Ii) When personal data is provided to a third party pursuant to the provisions of Article 13, paragraph 1 or the preceding article:

Page 8

And matters listed in (b)
B. The fact that the consent of the person in Article 13, paragraph 1 or the preceding article has been obtained
(B) Matters listed in the previous item (b) to (d)
2 Of the matters specified in each item of the preceding paragraph, already prepared by the method specified in the preceding paragraph, the next paragraph and the fourth paragraph.
It is recorded in the record of the preceding paragraph (limited to the case where the record is saved)
If the content is the same as the item, the record of the item in the preceding paragraph can be omitted.
Wear.
3 The record set forth in paragraph 1 must be promptly created each time personal data is provided to a third party.
Absent. However, personal data will be provided to the third party continuously or repeatedly (13th).
Excludes provision under the provisions of Article 2, Paragraph 2. The same shall apply hereinafter in this section. ) Or the relevant
Expected to be certain to provide personal data to the three parties continuously or repeatedly
Records can be created all at once.
4 Notwithstanding the provisions of the preceding paragraph, articles for the person pursuant to the provisions of Article 13, paragraph 1 or the preceding article
Or when personal data related to the person concerned is provided to a third party in connection with the provision of services.
The matters specified in each item of paragraph 1 are described in the contract and other documents prepared for the provision.
If so, the document may be used in place of the record relating to the matter in paragraph 1.
Wear.
5 When the letter service operator lists the record set forth in paragraph 1 in each of the following items from the date of creation of the record.
It must be stored for the period specified in each item according to the classification of.
(I) When a record is created by the method prescribed in the preceding paragraph Finally, personal data related to the record
From the date of provision to the day when one year has passed
(Ii) When a record is created by the method prescribed in the proviso of paragraph (3) Finally, the record is related.
From the day when personal data is provided to the day when three years have passed since the date of provision
(3) In cases other than the previous two items, three years

(Confirmation when receiving a third party offer, etc.)
Article 16 When receiving personal data from a third party, the letter service operator shall have the following items.
According to the matters listed in, confirmation must be performed by the method specified in each item.
I. However, the provision of the personal data is either in each item of Article 23, paragraph 1 or each item of paragraph 5 of the Act.
If this is the case, this does not apply.
(I) In the case of the name or name and address of the third party and the corporation, its representative (not a corporation)
In the case of an organization with a designated representative or manager, the representative or manager)
Name (excluding those that fall under the matters listed in item 3) Providing the personal data
How to receive a declaration from the third party and other appropriate methods (those that fall under the matters listed in the next item)
Except for. )
(Ii) Background of acquisition of the personal data by the third party The third party who provides the personal data

Page 9

A contract or other document showing the process of acquisition of the personal data by the third party from the person
How to receive the presentation and other appropriate methods
(Iii) The method already specified in the preceding two items when receiving other personal data from the third party.
Confirmation by (Recording of the confirmation by the method prescribed in paragraphs 3, 5 and 6)
Only when creating and storing. ) Matters
Those who confirm that the contents of the above and the contents of the matters listed in the preceding two items related to the provision are the same
Law
(2) The third party set forth in the preceding paragraph shall be the letter when the letter service operator confirms the letter pursuant to the provisions of the same paragraph.
Do not falsify the matters related to the confirmation to the calligraphy operator.
(3) When the letter service operator confirms pursuant to the provisions of paragraph (1), it shall be a document, an electromagnetic record or a message.
According to the classification in each of the following items by the method of making using icro film,
A record of the matters specified in each item must be created.
(I) Received personal data provided by a business operator handling personal information pursuant to the provisions of Article 23, paragraph 2 of the Act.
In the case of the following items from a to e
B. Date of receiving personal data
(B) Matters listed in each item of paragraph (1)
C. To identify the person's name and other persons identified by the personal data.
Matters
D. Items of the personal data
(E) The fact that it has been announced pursuant to the provisions of Article 23, Paragraph 4 of the Act
(Ii) Personal information handling business operators pursuant to the provisions of Article 23, Paragraph 1 of the Act or Article 24 of the Act.
If you receive the data, the matters listed in (a) and (b) below
B. The fact that the consent of the person in question, Article 23, Paragraph 1 of the Act or Article 24 of the Act has been obtained.
(B) Matters listed in the previous item (b) to (d)
(Iii) Received personal data provided by a third party (excluding those who fall under the category of business operators handling personal information)
In the case of the first item (b) to (d)
4 Of the matters specified in each item of the preceding paragraph, already prepared by the method specified in the preceding paragraph, the next paragraph and the sixth paragraph.
Recorded in the record set forth in the preceding paragraph (limited to the case where the record is preserved)
For items that have the same content as the item, the record of the item in the preceding item may be omitted.
To
5 The record set forth in paragraph 3 must be promptly created each time personal data is provided by a third party.
Must be. However, the third party will provide personal data continuously or repeatedly (law).
Excludes provision pursuant to the provisions of Article 23, paragraph 2. The same shall apply hereinafter in this article. )
Or, it is certain that personal data will be provided continuously or repeatedly by the third party.
Records of what is expected to be true can be created in bulk.
6 Notwithstanding the provisions of the preceding paragraph, a third party may provide goods or services to the person.

Page 10

When personal data related to the person is provided, the contract created for the provision
When the matters specified in each item of paragraph 3 are described in the contract or other documents, the relevant documents shall be included.
It may be replaced with the record concerning the relevant matter in the same paragraph.
7. When the letter service operator lists the record set forth in paragraph 3 in each of the following items from the date of creation of the record.
It must be stored for the period specified in each item according to the classification of.
(I) When a record is created by the method prescribed in the preceding paragraph Finally, personal data related to the record
From the date of receiving the offer to the day when one year has passed
(Ii) When a record is created by the method prescribed in the proviso of paragraph 5 Finally, the record is related.
From the day when personal data is provided to the day when three years have passed since the date of receipt of personal data
(3) In cases other than the previous two items, three years

(Publication of matters related to retained personal data, etc.)
Article 17 The letter service business operator shall know the following matters regarding the retained personal data.
Must be in a state where it can be (including the case of responding without delay at the request of the person)
Absent.
(I) Name or name of the letter service operator
(Ii) Purpose of use of all retained personal data (corresponding to Article 7, Paragraph 4, Items 1 to 3)
Except for cases. )
(3) Requests pursuant to the provisions of the following paragraph or the following Article, Paragraph 1, Article 19, Paragraph 1 or Article 20, Paragraph 1 Young
Or the procedure for responding to a request pursuant to the provisions of paragraph 3 (fee pursuant to the provisions of Article 23, paragraph 2)
When the amount of is set, the amount of the fee is included. )
(Iv) In addition to the matters listed in the preceding three items, necessary matters regarding ensuring the proper handling of retained personal data.
Items listed below
B. To file a complaint regarding the handling of retained personal data by the letter service operator.
(B) If the letter service operator is a target operator of an authorized personal information protection organization,
The name of the authorized personal information protection organization and the address for resolving complaints
2 The letter service operator notifies the person of the purpose of use of the retained personal data that identifies the person.
When requested, the person must be notified of this without delay. However
However, this does not apply if any of the following items apply.
(I) When the purpose of use of the retained personal data that identifies the person concerned is clear according to the provisions of the preceding paragraph
(Ii) When applicable to Article 7, Paragraph 4, Items 1 to 3
3 The letter service operator notifies the purpose of use of the retained personal data requested based on the provisions of the preceding paragraph.
If you decide not to do so, you must notify the person without delay.
I.

(Disclosure)

Page 11

Article 18 The person shall disclose to the letter service operator the retained personal data that identifies the person.
Can be billed.
2 When a letter service operator receives a request pursuant to the provisions of the preceding paragraph, it will deliver a document to the person.
(If there is a method agreed by the person who requested the disclosure, the method), without delay
The retained personal data must be disclosed. However, by disclosing the following items
If any of the above applies, all or part of it may not be disclosed.
When there is a risk of harming the life, body, property or other rights and interests of the person or a third party
(Ii) When there is a risk of significantly hindering the proper implementation of the business of the letter service operator.
(Iii) Decree (Law, Law Enforcement Ordinance on Protection of Personal Information (Cabinet Order No. 507 of 2003) and
Excludes orders based on these. The same shall apply in paragraph 4 and paragraph 2 of the next article. ) Violate
When
3 The letter service operator shall apply to all or part of the retained personal data pertaining to the request pursuant to the provisions of paragraph 1.
If it is decided not to disclose the personal data, or if the retained personal data does not exist, the person himself / herself
You must notify us without delay.
4 According to the provisions of laws and regulations, the person concerned is concerned by a method equivalent to the method prescribed in the main text of paragraph 2.
When it is supposed to disclose all or part of the retained personal data that identifies the person
The provisions of paragraphs 1 and 2 apply to all or part of the retained personal data.
do not.

(Correction, etc.)
Article 19 The person himself / herself tells the letter service operator that the content of the retained personal data that identifies the person concerned is
If this is not the case, the content of the retained personal data will be corrected, added or deleted (hereinafter referred to in this Article).
It is called "correction, etc." ) Can be requested.
2 When a letter service operator receives a request pursuant to the provisions of the preceding paragraph, it shall be concerned with correction of the contents, etc.
Necessary to achieve the purpose of use, unless special procedures are stipulated by the provisions of laws and regulations.
Within the scope, we will conduct the necessary investigation without delay, and based on the result, the retained personal data
The contents of the above must be corrected.
3 The letter service operator shall be young in all the contents of the retained personal data pertaining to the request pursuant to the provisions of paragraph 1.
When a part of the book is corrected, or when it is decided not to make a correction, the book
Do not notify the person to that effect (including the content of any corrections made) without delay.
Must be.

(Suspension of use, etc.)
Article 20 The person is the letter service operator, and the retained personal data that identifies the person is Article 5
When it is handled in violation of the provisions of Article 6 or acquired in violation of the provisions of Article 6.
In some cases, suspension or deletion of the use of the retained personal data (hereinafter referred to as "suspension of use" in this article.

Page 12

Stop, etc. " ) Can be requested.
2 The letter service operator receives a request pursuant to the provisions of the preceding paragraph, and there is a reason for the request.
When it is found that the item is held, without delay, to the extent necessary to correct the violation.
The use of human data must be suspended. However, suspension of use of the retained personal data
When it costs a lot of money to stop, etc., or when it is difficult to stop using other services, etc.
When taking necessary alternative measures to protect the rights and interests of the person, this is the limit.
Absent.

3 The person is the letter service operator, and the retained personal data that identifies the person is Article 13 (1).
If the data is provided to a third party in violation of the provisions of paragraph or Article 14, the retained personal data
Can be requested to stop providing the service to a third party.
4 The letter service operator receives a request pursuant to the provisions of the preceding paragraph, and there is a reason for the request.
If it is found that the personal data will be retained, do not stop providing the retained personal data to a third party without delay.
Must be. However, a large amount of cost will be charged for suspending the provision of the retained personal data to a third party.
When it is necessary, it is difficult to stop the provision to other third parties, and the right of the person
This shall not apply when taking the necessary alternative measures to protect the interests.
5 The letter service operator shall have all or part of the retained personal data pertaining to the request pursuant to the provisions of paragraph 1.
When the use is suspended or when it is decided not to suspend the use
Or a third party for all or part of the retained personal data related to the request pursuant to the provisions of paragraph 3.
When we stop providing to a third party or when we decide not to stop providing to a third party
The person must be notified to that effect without delay.

(Explanation of reason)
Article 21 A letter service operator shall be an Article 17, Paragraph 3, Article 18, Paragraph 3, Article 19, Paragraph 3 or the preceding.
Regarding all or part of the measures requested or requested by the person pursuant to the provisions of paragraph 5 of the Article
Notify that the measures will not be taken or that measures different from the measures will be taken.
If so, you must try to explain the reason to the person.

(Procedures for responding to requests for disclosure, etc.)
Article 22 A letter service operator shall make a request pursuant to the provisions of Article 17, paragraph 2 or Article 18, paragraph 1, paragraph 2.
Requests pursuant to the provisions of Article 19, paragraph 1 or Article 20, paragraph 1 or 3 (hereinafter referred to in this Article)
It is called "request for disclosure, etc." ), As a method of accepting the request or request
The items listed in the following items can be specified. In this case, the person himself / herself is the method
In accordance with this, requests for disclosure, etc. must be made.
(I) Request for disclosure, etc.
(Ii) Document format to be submitted when requesting disclosure, etc. and other methods for requesting disclosure, etc.
(Iii) Confirmation that the person making the request for disclosure, etc. is the person or the agent prescribed in paragraph 3.

Page 13

Law
(Iv) How to collect the fee set forth in paragraph (1) of the next article
2 The letter service operator shall be subject to the personal day held by the person regarding the request for disclosure, etc.
It is possible to request the presentation of matters sufficient to identify the data. In this case, letter mail
The trader is the holding individual so that the person can easily and accurately make a request for disclosure, etc.
Provide information that contributes to the identification of data and take other appropriate measures in consideration of the convenience of the person.
Must be.
(3) Requests for disclosure, etc. may be made by the following agents. However, Article 18
Regarding the request for disclosure pursuant to the provisions of paragraph (1), in the case of infringing the confidentiality of the person's letter, etc.
This shall not apply if any of the items in paragraph (2) applies.
(I) Legal representative of a minor or an adult guardian
(Ii) An agent delegated by the principal to request disclosure, etc.
4 The letter service operator shall establish the procedure for responding to requests for disclosure, etc. based on the provisions of the preceding three paragraphs.
Therefore, care must be taken not to impose an excessive burden on the person.

(Commission)
Article 23 The letter service operator was requested to notify the purpose of use pursuant to the provisions of Article 17, paragraph 2.
When or when a request for disclosure pursuant to the provisions of Article 18, paragraph 1 is received, regarding the implementation of such measures
And you can collect a fee.
2 When a letter service operator collects a fee pursuant to the provisions of the preceding paragraph, it is reasonable in consideration of the actual cost.
The amount of the fee must be set within the range recognized as.

(Advance billing)
Article 24 The person himself / herself is Article 18, paragraph 1, Article 19, paragraph 1, or Article 20, paragraph 1 or 3.
If you intend to file an action relating to a claim pursuant to the provisions of paragraph, you should be a defendant in that action.
Two weeks have passed since the request was made to the person in advance and the request was made.
Only later can the complaint be filed. However, you should be the defendant in the complaint.
This shall not apply when the person refuses the request.
(2) The request set forth in the preceding paragraph shall be deemed to have arrived when the request should normally have arrived.
(3) The provisions of the preceding two paragraphs shall be Article 18, paragraph 1, Article 19, paragraph 1, or Article 20, paragraph 1 or 3.
The same shall apply mutatis mutandis to a petition for a provisional disposition order pertaining to a request pursuant to the provisions of paragraph.

(Handling of complaints by letter service operators)
Article 25 The letter service operator shall endeavor to properly and promptly handle complaints regarding the handling of personal information.
I have to get it.
2 The letter service operator must endeavor to establish the system necessary to achieve the purpose set forth in the preceding paragraph.

Page 14

Absent.

(Creation of anonymous processing information, etc.)
Article 26 A letter service operator may configure anonymously processed information (anonymously processed information database, etc.)
Limited to. same as below. ) To identify a specific individual and to create it
The following is defined as necessary to prevent the personal information used from being restored.
The personal information must be processed in accordance with the above standards.
(I) Delete all or part of the description, etc. that can identify a specific individual contained in personal information.
Exclusion (those who do not have the regularity to restore all or part of the description, etc.
Includes replacement with other descriptions by law. ).
(Ii) Deleting all of the personal identification code contained in the personal information (restoring the personal identification code)
Including replacing with other descriptions etc. by a method that does not have regularity that can be done
Mu. ).
(Iii) A code that connects personal information and information obtained by taking measures against the personal information (actually, an individual)
Limited to codes that connect information handled by information handling businesses to each other. ) To be deleted
And (the personal information and the personal information by a method that does not have regularity that can restore the code.
Replace the personal information with a code that cannot be linked to the information obtained by taking measures.
Including that. ).
(Iv) Deleting a peculiar description, etc. (Regularity that can restore the peculiar description, etc.)
Including replacing with other description etc. by a method that does not have. ).
(V) In addition to the measures listed in the preceding items, the description, etc. contained in the personal information and the individual including the personal information.
Differences from other personal information that constitutes an information database, etc.
Consider the nature of the personal information database, etc., and take appropriate measures based on the results.
When.
2 When a letter service operator creates anonymously processed information, it deletes it from the personal information used to create it.
Information about the removed description, personal identification code, and the processing method performed according to the provisions of the preceding paragraph.
The security of this information is in accordance with the following standards as necessary to prevent leakage of information.
Measures must be taken for full control.
(1) Processing method information (descriptions, etc. deleted from personal information used to create anonymous processing information)
Information on the person identification code and the processing method performed according to the provisions of the preceding paragraph (using that information)
Limited to those that can restore the personal information. ). In this article below
the same. ) Clearly define the authority and responsibility of the person who handles it.
(Ii) Regulations regarding the handling of information such as processing methods have been established, and processing methods, etc. have been established in accordance with the regulations.
We handle information appropriately, evaluate the status of its handling, and use the results as a result.
Take necessary measures to make improvements based on the above.
(Iii) Handling of processing method information by a person who does not have the proper authority to handle processing method information

Page 15

Take necessary and appropriate measures to prevent this.
3 When a letter service operator creates anonymously processed information, he / she can use the Internet without delay.
By other appropriate method, publicize the item of personal information contained in the anonymously processed information.
Must be represented.
4 When a letter service operator creates anonymously processed information on behalf of another personal information handling operator
Is the section of information about individuals included in the anonymously processed information by the other business operator handling personal information.
The eyes shall be published by the method prescribed in the preceding paragraph. In this case, make the announcement
Therefore, it is considered that the letter service operator has published the item.
5 When a letter service operator creates anonymously processed information and provides the anonymously processed information to a third party.
Is provided to a third party in advance by using the Internet or other appropriate method.
Publicly announce the items of personal information contained in anonymously processed information and the method of providing it
At the same time, electronically inform the third party that the information related to the provision is anonymously processed information.
Must be clearly stated by sending an email, delivering a document, or any other appropriate method.
Must be.
6 The letter service operator creates anonymously processed information and handles the anonymously processed information by itself.
In order to identify the person related to the personal information used to create the anonymously processed information,
The anonymously processed information must not be collated with other information.
7. When a letter service operator creates anonymously processed information, it is responsible for the safety management of the anonymously processed information.
Necessary and appropriate measures, handling of complaints regarding the creation and other handling of the anonymously processed information
Do you take other necessary measures to ensure the proper handling of the anonymously processed information?
At the same time, efforts must be made to publicize the details of the measures.

(Provision of anonymous processing information)
Article 27 Letter service operators shall exclude anonymously processed information (excluding information created by processing personal information by themselves).
Ku. same as below. ) To a third party, use the Internet or other appropriate person
Information about individuals included in anonymously processed information provided to third parties in advance by law
We will announce the items and the method of providing them, and provide them to the third party.
How to send an e-mail or deliver a document to the effect that the information related to is anonymously processed information
It must be clearly stated by law or other appropriate method.

(Prohibition of identification)
Article 28 When handling anonymously processed information, the letter service business operator shall use the anonymously processed information.
In order to identify the person related to the personal information used to create the personal information, it is deleted from the personal information.
Description, etc. or personal identification code or Article 26, paragraph 1, personal information held by the administrative agency
Law Concerning the Protection of Information (Act No. 58 of 2005) Article 44-10, Paragraph 1 (Act No. 2 of the same Article)
Including cases where it is applied mutatis mutandis in the section. ) Or protection of personal information held by independent administrative agencies, etc.

Page 16

Law Concerning (Act No. 59 of 2003) Article 44-10, Paragraph 1 (Smell, Paragraph 2 of the same Article)
Including cases where it is applied mutatis mutandis. ), And also obtains information on the processing method performed according to the provisions of
Must not collate the anonymously processed information with other information.

(Safety management measures, etc.)
Article 29 The letter service operator shall take necessary and appropriate measures and concealment for the safety management of anonymously processed information.
Handle complaints regarding the handling of name processing information and ensure proper handling of other anonymously processed information
You must take the necessary measures yourself and make an effort to publicize the contents of the measures.
Not.

Chapter 3 Miscellaneous Provisions
(Review of guidelines)
Article 30 This guideline is based on changes in social conditions, changes in public awareness, changes in technological trends, etc.
It shall be reviewed as necessary in consideration of changes in various environments.

