第三十一条（個人関連情報の第三者提供の制限等）
Except cases set forth in each item of Article 27, paragraph (1), if it is assumed that a third party acquires information related to personal information (limited to those compiled in a database or the equivalent of information related to personal information; hereinafter the same applies in this Chapter and Chapter VI) as personal data, businesses handling information related to personal information must not provide the information related to personal information to the third party without confirming the matters set forth as follows pursuant to Order of the Personal Information Protection Commission:
個人関連情報取扱事業者は、第三者が個人関連情報（個人関連情報データベース等を構成するものに限る。以下この章及び第六章において同じ。）を個人データとして取得することが想定されるときは、第二十七条第一項各号に掲げる場合を除くほか、次に掲げる事項について、あらかじめ個人情報保護委員会規則で定めるところにより確認することをしないで、当該個人関連情報を当該第三者に提供してはならない。
the identifiable person's consent to the effect that the person approves of the third party acquiring information related to personal information as personal data that can identify the person from the business handling information related to personal information, has been obtained;
for provision to a third party in a foreign country, before the businesses obtain the identifiable person's consent referred to in the preceding item, information on the personal information protection system of the foreign country, information on the measures the third party takes for the protection of personal information, and other information that serves as a reference to the person, has been provided in advance to the person pursuant to Order of the Personal Information Protection Commission.
The provisions of Article 28, paragraph (3) apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information pursuant to the provisions of the preceding paragraph. In this case, the phrase ", and provide information on the necessary measures to the identifiable person at the request of that person," in Article 28, paragraph (3) is deemed to be replaced with ",".
The provisions of paragraphs (2) through (4) of the preceding Article apply mutatis mutandis to cases in which a business handling information related to personal information conducts confirmation pursuant to the provisions of paragraph (1). In this case, the phrase "received" in paragraph (3) of the preceding Article is deemed to be replaced with "provided."
前条第二項から第四項までの規定は、第一項の規定により個人関連情報取扱事業者が確認する場合について準用する。この場合において、同条第三項中「の提供を受けた」とあるのは、「を提供した」と読み替えるものとする。
Article 32Disclosure of Information about the Personal Data a Business Holds
第三十二条（保有個人データに関する事項の公表等）
Businesses handling personal information must make the following information about the personal data they hold accessible to identifiable persons (making that information accessible includes providing answers without delay as requested by identifiable persons):
the name and address of the business handling personal information, and if it is a corporation, the name of its representative;
当該個人情報取扱事業者の氏名又は名称及び住所並びに法人にあっては、その代表者の氏名
the purpose of use of all personal data the business holds (excluding cases falling under Article 21, paragraph (4), items (i) through (iii));
全ての保有個人データの利用目的（第二十一条第四項第一号から第三号までに該当する場合を除く。）
the procedures for responding to a request under the following paragraph, or to a request under paragraph (1) of the following Article (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (1); or Article 35, paragraph (1), paragraph (3), or paragraph (5) (including the amount of the fee, if one is set pursuant to the provisions of Article 38, paragraph (2));
beyond what is set forth in the preceding three items, those prescribed by Cabinet Order as matters necessary to ensure the proper handling of personal data the business holds.
If an identifiable person requests that a business handling personal information notify that person of the purpose of use of the personal data the business holds that can be used to identify that person, the business must notify the person of this without delay; provided, however, that this does not apply in a case falling under one of the following items:
the purpose of use of the personal data the business holds that can be used to identify the identifiable person has been made clear pursuant to the provisions of the preceding paragraph;
cases falling under Article 21, paragraph (4), items (i) through (iii).
第二十一条第四項第一号から第三号までに該当する場合
If a business handling personal information decides not to notify the identifiable person of the purpose of use of the personal data the business holds as requested pursuant to the preceding paragraph, the business must notify the identifiable person of this without delay.
第三十三条（開示）
An identifiable person may request that a business handling personal information disclose personal data the business holds that can identify that person through electronic or magnetic records or other means as prescribed by Order of the Personal Information Protection Commission.
When having received a request under the preceding paragraph, a business handling personal information must disclose personal data the business holds to an identifiable person without delay by means that person requests pursuant to the provisions of that paragraph (or by paper-based document, in cases in which disclosing the data by that means would require a costly expenditure or prove otherwise difficult); provided, however, that in cases in which disclosing that data falls under any of each following, all or a part of it may not be disclosed:
if disclosure is likely to harm the life, wellbeing, property, or other rights or interests of the identifiable person or a third party;
本人又は第三者の生命、身体、財産その他の権利利益を害するおそれがある場合
if disclosure is likely to seriously interfere with the proper implementation of the business of the business handling personal information;
当該個人情報取扱事業者の業務の適正な実施に著しい支障を及ぼすおそれがある場合
if disclosure would violate any other law or regulation.
他の法令に違反することとなる場合
If a business handling personal information decides not to disclose all or part of the personal data the business holds as requested pursuant to the provisions of paragraph (1), if that data does not exist, or if it is difficult to disclose that data by the means the identifiable person requests pursuant to the provisions of that paragraph, the business must notify that person of this without delay.
If, pursuant to the provisions of any other law or regulation, all or part of the personal data an business holds that can be used to identify an identifiable person is to be disclosed to the identifiable person by a means equivalent to what is prescribed in the main clause of paragraph (2), the provisions of paragraphs (1) and (2) do not apply to either the whole or the relevant part of the personal data the business holds.
The provisions of paragraphs (1) through (3) apply mutatis mutandis to records referred to in Article 29, paragraph (1) and Article 30, paragraph (3) that is related to personal data that can be used to identify the identifiable person (excluding those prescribed by Cabinet Order as likely to harm the public or other interests if its existence or non-existence is made clear; referred to as a "record of provision to a third party" in Article 37, paragraph (2)).
第三十四条（訂正等）
If the content of personal data a business holds that can be used to identify the identifiable person is not factual, the person may request that the business handling personal information make a correction, addition, or deletion (hereinafter referred to as a "correction" in this Article) on the content of the personal data the business holds.
Except in cases in which special procedures concerning correction of the content is prescribed by the provisions of other laws or regulations, when a business handling personal information has been requested to make a correction pursuant to the provisions of the preceding paragraph, the business must conduct necessary investigation without delay to the extent necessary to achieve the purpose of use, and based on its result, make corrections to the contents of the personal data the business holds.
If a business handling personal information has made a correction to all or part of the contents of the personal data the business holds in connection with a request under paragraph (1), or has made a decision not to make a correction, the business must notify the identifiable person to that effect without delay (including the content of a correction, if the business has made it).
Identifiable persons may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify that person (hereinafter referred to as a "ceasing to use or deleting personal data" in this Article), if the personal data the business holds is being handled in violation of the provisions of Article 18 or 19, or has been obtained in violation of the provisions of Article 20.
If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds to the extent necessary to redress the violation without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds would require a costly expenditure or prove otherwise difficult, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person.
Identifiable persons may request that a business handling personal information cease to provide a third party with the personal data the business holds that can be used to identify the person, if the personal data the business holds is being provided to a third party in violation of the provisions of Article 27, paragraph (1) or Article 28.
If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to provide a third party with the personal data the business holds without delay; provided, however, that this does not apply if ceasing to provide a third party with the personal data the business holds would require a costly expenditure or prove otherwise difficult, and the businesses take the necessary alternative measures to protect an identifiable person's rights and interests.
An identifiable person may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify the person, or cease to provide a third party with the personal data the business holds, if it has ceased to be necessary for the business to use that personal data, if the situation concerning that personal data as prescribed in the main text of Article 26, paragraph (1) has occurred, or if handling that personal data is likely to harm the identifiable person's rights and interests.
If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds to the extent necessary to prevent an infringement of the identifiable person's rights and interests without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds or ceasing to provide a third-party with that personal data would require a costly expenditure or prove otherwise difficult, and the businesses take the necessary alternative measures to protect the identifiable person's rights and interests.
If a business handling personal information have ceased to use or deleted, or decided not to cease to use or delete all or part of personal data the business holds in connection with a request under paragraph (1) or (5), or the business has ceased to provide a third party or decided not to cease to provide a third party with all or part of personal data the business holds in connection with a request under paragraph (3) or (5), the business must notify the identifiable person to that effect without delay.
Article 36Explanation of Reasons
第三十六条（理由の説明）
If, pursuant to the provisions of Article 32, paragraph (3), Article 33, paragraph (3) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (3) or paragraph (7) of the preceding Article, a business handling personal information notifies an identifiable person that it will not take all or part of the measures which the person has requested the business take, or that it will take different measures, the business must endeavor to explain its reasons for this to the person.
Article 37Procedures for Dealing with Requests for Disclosure and Other Handling
第三十七条（開示等の請求等に応じる手続）
As regards a request under Article 32, paragraph (2), or a request under Article 33, paragraph (1) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article; the same applies in paragraph (1) of the following Article and Article 39), Article 34, paragraph (1), Article 35, paragraph (1), (3), or (5) (hereinafter referred to as a "request for disclosure or other handling" in this Article and Article 54, paragraph (1)), a business handling personal information may decide on a method of receiving a request as prescribed by Cabinet Order. In such a case, an identifiable person must request disclosure or other handling in that way.
A business handling personal information may request an identifiable person requesting disclosure or other handling to present sufficient information to identify the personal data the business holds or the record of provision to a third party that would be subject to the disclosure or other handling. In such a case, the business handling personal information must provide information to help the person identify the relevant personal data the business holds or the relevant record of provision to a third party, or take other appropriate measures in consideration of the identifiable person's convenience, so as to allow the person to easily and accurately request disclosure or other handling.
A person may request disclosure or other handling through an agent, as prescribed by Cabinet Order.
開示等の請求等は、政令で定めるところにより、代理人によってすることができる。
In establishing procedures for dealing with requests for disclosure and other handling pursuant to the preceding three paragraphs, a business handling personal information must take care to ensure that the procedures do not impose an excessive burden on identifiable persons.