Supplementary Provisions, Article 7Transitional Measures Accompanying Enforcement of the Provisions of Article 50
第七条（第五十条の規定の施行に伴う経過措置）
If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given, before the date of enforcement of the provisions of Article 50 (hereinafter referred to as the "Article 50 Effective Date" in this Article), to an Appended Table 2 corporation or the equivalent (meaning a corporation listed in Appended Table 2 of the Act on the Protection of Personal Information as Amended by Article 50; the Japan Organization of Occupational Health and Safety that is deemed, pursuant to Article 58, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, to be a business handling personal information prescribed in Article 16, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, a business handling pseudonymized personal information prescribed in paragraph (5) of that Article, or a business handling information related to personal information prescribed in paragraph (7) of that Article; or a business handling personal information prescribed in paragraph (2) of that Article that is an academic research institution or the equivalent prescribed in paragraph (8) of that Article; the same applies hereinafter in this Article), and that consent is equivalent to consent to the effect of permitting the handling of personal information for a purpose other than the purpose of use specified pursuant to the provisions of Article 17, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in Article 18, paragraph (1) or (2) of the Act on the Protection of Personal Information as Amended by Article 50 is deemed to have been given on the Article 50 Effective Date.
第五十条の規定の施行の日（以下この条において「第五十条施行日」という。）前に別表第二法人等（第五十条改正後個人情報保護法別表第二に掲げる法人、第五十条改正後個人情報保護法第五十八条第二項の規定により第五十条改正後個人情報保護法第十六条第二項に規定する個人情報取扱事業者、同条第五項に規定する仮名加工情報取扱事業者若しくは同条第七項に規定する個人関連情報取扱事業者とみなされる独立行政法人労働者健康安全機構又は同条第八項に規定する学術研究機関等である同条第二項に規定する個人情報取扱事業者をいう。以下この条において同じ。）に対しされた本人の個人情報の取扱いに関する同意がある場合において、その同意が第五十条改正後個人情報保護法第十七条第一項の規定により特定される利用目的以外の目的で個人情報を取り扱うことを認める旨の同意に相当するものであるときは、第五十条施行日において第五十条改正後個人情報保護法第十八条第一項又は第二項の同意があったものとみなす。
If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to an Appended Table 2 corporation or the equivalent before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal data to a third party pursuant to the provisions of Article 27, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that paragraph is deemed to have been given on the Article 50 Effective Date.
An Appended Table 2 corporation or the equivalent that intends to provide personal data to a third party pursuant to the provisions of Article 27, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 may, even before the Article 50 Effective Date, as provided by Order of the Personal Information Protection Commission, notify the identifiable person of matters equivalent to those set forth in the items of that paragraph and file a notification of them with the Personal Information Protection Commission. In this case, that notice and notification are deemed to be the notice and notification under the provisions of that paragraph on or after the Article 50 Effective Date.
If, before the Article 50 Effective Date, an Appended Table 2 corporation or the equivalent has notified the identifiable person of matters equivalent to the matters that must be notified to the identifiable person or made readily accessible to the identifiable person pursuant to the provisions of Article 27, paragraph (5), item (iii) of the Act on the Protection of Personal Information as Amended by Article 50, that notice is deemed to be the notice under the provisions of that item on or after the Article 50 Effective Date.
If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to an Appended Table 2 corporation or the equivalent before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal data to a third party in a foreign country pursuant to the provisions of Article 28, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that paragraph is deemed to have been given on the Article 50 Effective Date.
The provisions of Article 28, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an Appended Table 2 corporation or the equivalent obtains the consent of the identifiable person pursuant to the provisions of Article 28, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50 on or after the Article 50 Effective Date.
The provisions of Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an Appended Table 2 corporation or the equivalent provides personal data, on or after the Article 50 Effective Date, to a third party in a foreign country prescribed in that paragraph.
If there is consent of the identifiable person concerning the handling of information related to personal information on the identifiable person that was given to an Appended Table 2 corporation or the equivalent before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of information related to personal information to a third party pursuant to the provisions of Article 31, paragraph (1), item (i) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that item is deemed to have been given on the Article 50 Effective Date.
The provisions of Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50, which are applied mutatis mutandis with terms replaced pursuant to Article 31, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, apply to cases in which an Appended Table 2 corporation or the equivalent provides information related to personal information, on or after the Article 50 Effective Date, to a third party in a foreign country prescribed in Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50.
If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given, before the Article 50 Effective Date, to an administrative entity prescribed in Article 2, paragraph (11) of the Act on the Protection of Personal Information as Amended by Article 50 (excluding the Japan Organization of Occupational Health and Safety that is deemed, pursuant to Article 58, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, to be a business handling personal information prescribed in Article 16, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50; hereinafter referred to as the "administrative entity" in this Article), and that consent is equivalent to consent to the effect of permitting the personal use or provision of personal information the administrative entity holds for a purpose other than the purpose of use specified pursuant to the provisions of Article 61, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in Article 69, paragraph (2), item (i) of the Act on the Protection of Personal Information as Amended by Article 50 is deemed to have been given on the Article 50 Effective Date.
第五十条施行日前に第五十条改正後個人情報保護法第二条第十一項に規定する行政機関等（第五十条改正後個人情報保護法第五十八条第二項の規定により第五十条改正後個人情報保護法第十六条第二項に規定する個人情報取扱事業者とみなされる独立行政法人労働者健康安全機構を除く。以下この条において「行政機関等」という。）に対しされた本人の個人情報の取扱いに関する同意がある場合において、その同意が第五十条改正後個人情報保護法第六十一条第一項の規定により特定される利用目的以外の目的のために保有個人情報を自ら利用し、又は提供することを認める旨の同意に相当するものであるときは、第五十条施行日において第五十条改正後個人情報保護法第六十九条第二項第一号の同意があったものとみなす。
If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to an administrative entity before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal information the administrative entity holds to a third party in a foreign country pursuant to the provisions of Article 71, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that paragraph is deemed to have been given on the Article 50 Effective Date.
The provisions of Article 71, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an administrative entity obtains the consent of the identifiable person pursuant to the provisions of Article 71, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50 on or after the Article 50 Effective Date.
The provisions of Article 71, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an administrative entity provides personal information the administrative entity holds, on or after the Article 50 Effective Date, to a third party in a foreign country prescribed in that paragraph.
Regarding the application of Article 74, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50 to a personal information file prescribed in Article 60, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 that an administrative organ prescribed in Article 2, paragraph (8) of the Act on the Protection of Personal Information as Amended by Article 50 actually holds on the Article 50 Effective Date, the phrase "intends to hold" in that paragraph is deemed to be replaced with "holds", and the term "Before" is deemed to be replaced with "Promptly after the enforcement of Article 50 of the Act on the Arrangement of Related Acts for the Formation of a Digital Society (Act No. 37 of 2021), when".
第五十条施行日において現に第五十条改正後個人情報保護法第二条第八項に規定する行政機関が保有している第五十条改正後個人情報保護法第六十条第二項に規定する個人情報ファイルについての第五十条改正後個人情報保護法第七十四条第一項の規定の適用については、同項中「保有しようとする」とあるのは「保有している」と、「あらかじめ」とあるのは「デジタル社会の形成を図るための関係法律の整備に関する法律（令和三年法律第三十七号）第五十条の規定の施行後遅滞なく」とする。