Article 31Restrictions on the Provision of Information Related to Personal Information to Third Parties
第三十一条（個人関連情報の第三者提供の制限等）
Except cases set forth in each item of Article 27, paragraph (1), if it is assumed that a third party acquires information related to personal information (limited to those compiled in a database or the equivalent of information related to personal information; hereinafter the same applies in this Chapter and Chapter VI) as personal data, businesses handling information related to personal information must not provide the information related to personal information to the third party without confirming the matters set forth as follows pursuant to Order of the Personal Information Protection Commission:
個人関連情報取扱事業者は、第三者が個人関連情報（個人関連情報データベース等を構成するものに限る。以下この章及び第六章において同じ。）を個人データとして取得することが想定されるときは、第二十七条第一項各号に掲げる場合を除くほか、次に掲げる事項について、あらかじめ個人情報保護委員会規則で定めるところにより確認することをしないで、当該個人関連情報を当該第三者に提供してはならない。
the identifiable person's consent to the effect that the person approves of the third party acquiring information related to personal information as personal data that can identify the person from the business handling information related to personal information, has been obtained;
for provision to a third party in a foreign country, before the businesses obtain the identifiable person's consent referred to in the preceding item, information on the personal information protection system of the foreign country, information on the measures the third party takes for the protection of personal information, and other information that serves as a reference to the person, has been provided in advance to the person pursuant to Order of the Personal Information Protection Commission.
The provisions of Article 28, paragraph (3) apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information pursuant to the provisions of the preceding paragraph. In this case, the phrase ", and provide information on the necessary measures to the identifiable person at the request of that person," in Article 28, paragraph (3) is deemed to be replaced with ",".
The provisions of paragraphs (2) through (4) of the preceding Article apply mutatis mutandis to cases in which a business handling information related to personal information conducts confirmation pursuant to the provisions of paragraph (1). In this case, the phrase "received" in paragraph (3) of the preceding Article is deemed to be replaced with "provided."
前条第二項から第四項までの規定は、第一項の規定により個人関連情報取扱事業者が確認する場合について準用する。この場合において、同条第三項中「の提供を受けた」とあるのは、「を提供した」と読み替えるものとする。