When receiving personal data from a third party, businesses handling personal information must confirm matters set forth in the following pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply to cases in which the provision of personal data falls under any of the items of Article 27, paragraph (1) or paragraph (5):
the name and address of the third party and, if the third party is a corporation, the name of its representative;
当該第三者の氏名又は名称及び住所並びに法人にあっては、その代表者の氏名
background of the acquisition of the personal data by the third party.
当該第三者による当該個人データの取得の経緯
If a business handling personal information conducts confirmation under the preceding paragraph, a third party referred to in the preceding paragraph must not deceive the business handling personal information on a matter relating to the confirmation.
When having given confirmation under paragraph (1), a business handling personal information must prepare a record pursuant to Order of the Personal Information Protection Commission on the date when it received the personal data, matters concerning the confirmation, and other matters prescribed by Order of the Personal Information Protection Commission.
Businesses handling personal information must keep a record referred to in the preceding paragraph for a period of time prescribed by Order of the Personal Information Protection Commission from the date when it prepared the record.
個人情報取扱事業者は、前項の記録を、当該記録を作成した日から個人情報保護委員会規則で定める期間保存しなければならない。