A business handling personal information must not handle personal information beyond the scope necessary for achieving the purpose of use specified pursuant to the provisions of the preceding Article without obtaining the identifiable person's consent to do so in advance.
If, due to a merger or other such circumstances, a business handling personal information acquires personal information when succeeding to the business of another business handling personal information, it must not handle that personal information beyond the scope necessary for achieving the pre-succession purpose of use for that personal information without obtaining the identifiable person's consent to do so in advance.
The provisions of the preceding two paragraphs do not apply in the following cases:
前二項の規定は、次に掲げる場合については、適用しない。
cases based on laws and regulations (including local ordinances; hereinafter the same applies in this Chapter);
法令（条例を含む。以下この章において同じ。）に基づく場合
cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person;
人の生命、身体又は財産の保護のために必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person;
公衆衛生の向上又は児童の健全な育成の推進のために特に必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a need to cooperate with a national government organ, local government, or person entrusted thereby with performing the functions prescribed by laws and regulations, and obtaining the consent of the identifiable person is likely to interfere with the performance of those functions;
国の機関若しくは地方公共団体又はその委託を受けた者が法令の定める事務を遂行することに対して協力する必要がある場合であって、本人の同意を得ることにより当該事務の遂行に支障を及ぼすおそれがあるとき。
cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle the personal information for the purpose of using it in academic research (hereinafter referred to as "academic research purposes" in this Chapter) (including cases in which a part of the purpose of handling the personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);
cases in which personal data is provided to an academic research institution or the equivalent, and they need to handle the personal data for academic research purposes (including cases in which a part of the purpose of handling the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests).