A business handling personal information must not acquire personal information by deception or other wrongful means.
個人情報取扱事業者は、偽りその他不正の手段により個人情報を取得してはならない。
A business handling personal information must not acquire sensitive personal information without obtaining the identifiable person's consent in advance, except cases set forth in the following:
cases based on laws and regulations;
法令に基づく場合
cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person;
人の生命、身体又は財産の保護のために必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person;
公衆衛生の向上又は児童の健全な育成の推進のために特に必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a need to cooperate with a national government organ, local government, or person entrusted thereby with performing the functions prescribed by laws and regulations, and the consent of the identifiable person is likely to interfere with the performance of those functions;
国の機関若しくは地方公共団体又はその委託を受けた者が法令の定める事務を遂行することに対して協力する必要がある場合であって、本人の同意を得ることにより当該事務の遂行に支障を及ぼすおそれがあるとき。
cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle the sensitive personal information for academic research purposes (including cases in which a part of the purpose of handling the sensitive personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);
cases of acquiring the sensitive personal information from an academic research institution or the equivalent and it is necessary to acquire that information for academic research purpose (including cases in which a part of the purpose of acquiring the sensitive personal information is for academic research purposes, excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the academic research institution or the equivalent jointly conduct academic research);
cases in which the sensitive personal information is open to the public by a person identifiable by that information, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission;
other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.
その他前各号に掲げる場合に準ずるものとして政令で定める場合