An identifiable person may request that a business handling personal information disclose personal data the business holds that can identify that person through electronic or magnetic records or other means as prescribed by Order of the Personal Information Protection Commission.
When having received a request under the preceding paragraph, a business handling personal information must disclose personal data the business holds to an identifiable person without delay by means that person requests pursuant to the provisions of that paragraph (or by paper-based document, in cases in which disclosing the data by that means would require a costly expenditure or prove otherwise difficult); provided, however, that in cases in which disclosing that data falls under any of each following, all or a part of it may not be disclosed:
if disclosure is likely to harm the life, wellbeing, property, or other rights or interests of the identifiable person or a third party;
本人又は第三者の生命、身体、財産その他の権利利益を害するおそれがある場合
if disclosure is likely to seriously interfere with the proper implementation of the business of the business handling personal information;
当該個人情報取扱事業者の業務の適正な実施に著しい支障を及ぼすおそれがある場合
if disclosure would violate any other law or regulation.
他の法令に違反することとなる場合
If a business handling personal information decides not to disclose all or part of the personal data the business holds as requested pursuant to the provisions of paragraph (1), if that data does not exist, or if it is difficult to disclose that data by the means the identifiable person requests pursuant to the provisions of that paragraph, the business must notify that person of this without delay.
If, pursuant to the provisions of any other law or regulation, all or part of the personal data an business holds that can be used to identify an identifiable person is to be disclosed to the identifiable person by a means equivalent to what is prescribed in the main clause of paragraph (2), the provisions of paragraphs (1) and (2) do not apply to either the whole or the relevant part of the personal data the business holds.
The provisions of paragraphs (1) through (3) apply mutatis mutandis to records referred to in Article 29, paragraph (1) and Article 30, paragraph (3) that is related to personal data that can be used to identify the identifiable person (excluding those prescribed by Cabinet Order as likely to harm the public or other interests if its existence or non-existence is made clear; referred to as a "record of provision to a third party" in Article 37, paragraph (2)).