Except in cases based on laws and regulations, an administrative organ's head or administrative entity must not provide pseudonymized personal information (excluding those that are personal information; hereinafter the same applies in this Article and Article 128) to a third party (excluding a person entrusted with the handling of the pseudonymized personal information).
An administrative organ's head or administrative entity must take necessary and appropriate measures for managing the security of personal data including preventing the leaking of pseudonymized personal information they handle.
Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must neither acquire deleted or other related information (meaning identifiers or their equivalent, individual identification codes, and information on the method of processing as performed under Article 41, paragraph (1) that have been deleted from the personal information used to prepare the pseudonymized personal information), nor collate the pseudonymized personal information with other information, in order to identify the person identifiable by personal information that was used to prepare that pseudonymized personal information.
Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must not utilize a contact address and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or a specified correspondence delivery operator prescribed in Article 2, paragraph (9) of that Act, for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.
The provisions of each preceding paragraph apply mutatis mutandis to cases in which a person that has been entrusted (including entrustment via two or more layers) with the handling of pseudonymized personal information by an administrative organ's head or administrative entity conducts the entrusted business.