①Except cases based on laws and regulations, before providing anonymized personal information (excluding anonymized personal information an administrative entity holds; hereinafter the same applies in this Article) to a third party, an administrative entity must disclose the categories of information on an individual that is contained in anonymized personal information it will provide to the third party, and the means of providing this, and state to that third party explicitly to the effect that the information it will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

②Except cases based on laws and regulations, in handling anonymized personal information, an administrative entity must neither obtain information relating to the identifier or the equivalent, individual identification codes, or information on the method of processing as performed under Article 43, paragraph (1) that has been deleted from the personal information, nor collate that anonymized personal information with other information, in order to identify a person identifiable by the personal information that was used to prepare the anonymized personal information.

③An administrative entity must take necessary measures for proper management of the anonymized personal information in accordance with the criteria specified by Order of the Personal Information Protection Commission as necessary for preventing the leaking of anonymized personal information.

④The provisions of the preceding two paragraphs apply mutatis mutandis if an administrative entity entrusts (including entrustment via two or more layers) a person to handle its anonymized personal information and that person performs those entrusted activities.