Article 69Restrictions on the Use and Provision
第六十九条（利用及び提供の制限）
An administrative organ's head or administrative entity must not personally use or provide other persons with personal information the administrative entity holds for any purpose other than the purpose of use, except cases based on laws and regulations.
Notwithstanding the provisions of the preceding paragraph, when finding the case to fall under circumstances specified by any of the following items, an administrative organ's head or administrative entity may personally use or provide other persons with personal information the administrative entity holds for any purpose other than the purpose of use; provided, however, this does not apply if it is found that using that personal information personally or providing it to other persons for any purpose other than the purpose of use is likely to cause unjust prejudice to the rights or interests of the identifiable person or a third party:
if the personal information the administrative entity holds is used or provided with the identifiable person's consent, or if it is provided to the identifiable person;
本人の同意があるとき、又は本人に提供するとき。
if the administrative entity uses personal information it holds within the organ only to the extent necessary for managing processes or services under the jurisdiction provided by laws and regulations, and there are reasonable grounds for the use of that personal information;
if the personal information the administrative entity holds is provided to other administrative organ, incorporated administrative agency or other prescribed corporation, local government organ, or local incorporated administrative agency; the person that receives the information uses it only to the extent necessary for managing the processes or services under its jurisdiction provided by laws and regulations; and there are reasonable grounds for the use of that personal information;
beyond what is set forth in the preceding three items, if the personal information the administrative entity holds is provided exclusively for statistical purpose or academic research purpose; provision of the information to other persons is obviously beneficial to the identifiable person; or there are other special grounds for providing that personal information.
The provisions of the preceding paragraph do not preclude the application of the provisions of other laws and regulations which restrict the use or provision of personal information an administrative entity holds.
When finding it particularly necessary for protecting the individual rights and interests, an administrative organ's head or administrative entity is to allow only particular departments, agencies, or employees within the organ to use personal information the administrative entity holds for any purpose other than the purpose of use.
第七十条（保有個人情報の提供を受ける者に対する措置要求）
When an administrative organ's head or administrative entity finds it necessary in providing personal information the administrative entity holds for the purpose of use or pursuant to the provisions of paragraph (2), item (iii) or (iv) of the preceding Article, they are to impose restrictions on the purpose or method of use of the personal information they provide or any other restrictions considered necessary on a person that receives that personal information, or request the person take necessary measures to prevent the leaking of and for the proper management of that personal information.
Except in cases based on laws and regulations or set forth in Article 69, paragraph (2), item (iv), before an administrative organ's head or administrative entity provides personal information the administrative entity holds to a third party (excluding a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to the one that a business handling personal information prescribed in Article 16, paragraph (2) is to take concerning the handling of personal data prescribed in Article 16, paragraph (3) pursuant to the provisions of Section 2 of the preceding Chapter (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph and the following paragraph) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article) (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article) for any purpose other than the purpose of use, the administrative organ's head or administrative entity must acquire the identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country.
行政機関の長等は、外国（本邦の域外にある国又は地域をいう。以下この条において同じ。）（個人の権利利益を保護する上で我が国と同等の水準にあると認められる個人情報の保護に関する制度を有している外国として個人情報保護委員会規則で定めるものを除く。以下この条において同じ。）にある第三者（第十六条第三項に規定する個人データの取扱いについて前章第二節の規定により同条第二項に規定する個人情報取扱事業者が講ずべきこととされている措置に相当する措置（第三項において「相当措置」という。）を継続的に講ずるために必要なものとして個人情報保護委員会規則で定める基準に適合する体制を整備している者を除く。以下この項及び次項において同じ。）に利用目的以外の目的のために保有個人情報を提供する場合には、法令に基づく場合及び第六十九条第二項第四号に掲げる場合を除くほか、あらかじめ外国にある第三者への提供を認める旨の本人の同意を得なければならない。
When intending to obtain an identifiable person's consent pursuant to the provisions of the preceding paragraph, an administrative organ's head or administrative entity must provide the person in advance with information on the personal information protection system of the foreign country, on the measures the third party takes for the protection of personal information, and other information that serves as a reference to the person, pursuant to Order of the Personal Information Protection Commission.
Except in those cases based on laws and regulations or set forth in Article 69, paragraph (2), item (iv), when an administrative organ's head or administrative entity has provided personal information the administrative entity holds to a third party in a foreign country (limited to a person that has established a system prescribed in paragraph (1)) for any purpose other than the purpose of use, the administrative organ's head or administrative entity must take necessary measures to ensure continuous implementation of the equivalent measures by the third party, and in response to the identifiable person's request, provide the person with information on the necessary measures, pursuant to Order of the Personal Information Protection Commission.
Article 72Making Requests of Persons that Receive Information Related to Personal Information
第七十二条（個人関連情報の提供を受ける者に対する措置要求）
When finding it necessary in providing information related to personal information to a third party (limited to cases in which it is assumed that the third party acquires the information related to personal information as personal information), an administrative organ's head or administrative entity is to impose restrictions on the purpose or method of use of information related to personal information that they provide or any other restrictions considered necessary on the third party, or request the person take necessary measures to prevent the leaking of and for the proper management of the information.
Article 73Obligations on the Handling of Pseudonymized Personal Information
第七十三条（仮名加工情報の取扱いに係る義務）
Except in cases based on laws and regulations, an administrative organ's head or administrative entity must not provide pseudonymized personal information (excluding those that are personal information; hereinafter the same applies in this Article and Article 128) to a third party (excluding a person entrusted with the handling of the pseudonymized personal information).
An administrative organ's head or administrative entity must take necessary and appropriate measures for managing the security of personal data including preventing the leaking of pseudonymized personal information they handle.
Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must neither acquire deleted or other related information (meaning identifiers or their equivalent, individual identification codes, and information on the method of processing as performed under Article 41, paragraph (1) that have been deleted from the personal information used to prepare the pseudonymized personal information), nor collate the pseudonymized personal information with other information, in order to identify the person identifiable by personal information that was used to prepare that pseudonymized personal information.
Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must not utilize a contact address and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or a specified correspondence delivery operator prescribed in Article 2, paragraph (9) of that Act, for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.
The provisions of each preceding paragraph apply mutatis mutandis to cases in which a person that has been entrusted (including entrustment via two or more layers) with the handling of pseudonymized personal information by an administrative organ's head or administrative entity conducts the entrusted business.
Section 3 Personal Information Files
第三節 個人情報ファイル
Article 74Advance Notification on Holding Personal Information Files
第七十四条（個人情報ファイルの保有等に関する事前通知）
Before an administrative organ (excluding the Board of Audit; hereinafter the same applies in this Article) intends to hold personal information file, the head of the administrative organ must notify the Personal Information Protection Commission of the following matters. The same applies to cases in which an administrative organ intends to alter any matters for which notification has already been given:
the name of the personal information file;
個人情報ファイルの名称
the name of the organ and the name of the organizational section in charge of the processes for which the personal information file will be used;
当該機関の名称及び個人情報ファイルが利用に供される事務をつかさどる組織の名称
the purpose of use of the personal information file;
particulars recorded in the personal information file (hereinafter referred to as the "recorded particulars" in this Section) and the scope of individuals that are recorded in the personal information file as an identifiable person (limited to those who can be identified through a search without another individual's name, date of birth, or other identifiers or their equivalent; the same applies in item (ix) of the following paragraph) (this scope is hereinafter referred to as the "scope of record" in this Section);
the means of acquiring the personal information recorded in the personal information file (hereinafter referred to as the "recorded information" in this Section);
if the recorded information contains sensitive personal information, an indication to that effect;
if the recorded information is routinely provided to a party outside that organ, the name of that party;
記録情報を当該機関以外の者に経常的に提供する場合には、その提供先
if a part of the recorded particulars or the matters set forth in item (v) or in the preceding item are not to be contained in the personal information file register, or the personal information file is not to be contained in the personal information file register pursuant to the provisions of paragraph (3) of the following Article, an indication to that effect;
the name and address of the organization that accepts the request prescribed in Article 76, paragraph (1), Article 90, paragraph (1), or Article 98, paragraph (1);
if the proviso of Article 90, paragraph (1) or the proviso of Article 98, paragraph (1) applies, an indication to that effect;
other matters prescribed by Cabinet Order.
その他政令で定める事項
The provisions of the preceding paragraph do not apply to the personal information files set forth in the following:
a personal information file that contains matters concerning the national security, diplomatic secrets, and other important interests of the State;
国の安全、外交上の秘密その他の国の重大な利益に関する事項を記録する個人情報ファイル
a personal information file prepared or acquired for criminal investigation, investigation of tax crimes based on the provisions of laws related to tax, or instituting or keeping a legal proceeding;
犯罪の捜査、租税に関する法律の規定に基づく犯則事件の調査又は公訴の提起若しくは維持のために作成し、又は取得する個人情報ファイル
a personal information file for employees or former employees of that organ, which exclusively contains information concerning their personnel, wages, welfare benefits, or any equivalent matters (including a personal information file concerning an employee recruitment examination conducted by that organ);
当該機関の職員又は職員であった者に係る個人情報ファイルであって、専らその人事、給与若しくは福利厚生に関する事項又はこれらに準ずる事項を記録するもの（当該機関が行う職員の採用試験に関する個人情報ファイルを含む。）
a personal information file exclusively used for the purpose of experimental computer processing;
専ら試験的な電子計算機処理の用に供するための個人情報ファイル
a personal information file which contains all or a part of the recorded information contained in another personal information file subject to the notification prescribed in the preceding paragraph, if its purpose of use, recorded particulars, and scope of record are within the scope of those subject to that notification;
a personal information file that contains only recorded information that will be erased within one year;
a personal information file containing recorded information to be used for sending materials or any goods or money or for making necessary business contacts, which only contain the names, addresses and other necessary details concerning the recipients;
a personal information file that an employee prepares or acquires based on that employee's initiative for academic research purpose, if the recorded information is used exclusively for those academic research purpose;
a personal information file for which the number of the identifiable persons is less than the number specified by Cabinet Order;
a personal information file specified by Cabinet Order as being equivalent to any of the personal information files set forth in item (iii) through the preceding item;
a personal information file in relation to Article 60, paragraph (2), item (ii).
If an administrative organ ceases to hold the personal information file for which notification of the matters prescribed in paragraph (1) has been made or that personal information file comes to fall under item (ix) of the preceding paragraph, the head of the administrative organ must notify the Personal Information Protection Commission to that effect without delay.