Articles 1 to 7, Supplementary Provisions (Act No. 37 of 2021) — Act on the Protection of Personal Information

2 articles

Supplementary Provisions

附　則

Supplementary Provisions, Article 1Effective Date

第一条（施行期日）

This Act comes into effect on September 1, 2021; provided, however, that the provisions set forth in the following items come into effect on the dates specified in those items:

この法律は、令和三年九月一日から施行する。ただし、次の各号に掲げる規定は、当該各号に定める日から施行する。

the provisions of Article 27 (limited to the provision amending Appended Tables 1 through 5 of the Residential Basic Book Act), Article 45, Article 47 and Article 55 (limited to the provision amending Appended Table 1 and Appended Table 2 of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (excluding the provision amending row 27 of that Table)), and the provisions of Article 8, paragraph (1), Articles 59 through 63, Article 67 and Articles 71 through 73 of the Supplementary Provisions: the date of promulgation;

第二十七条（住民基本台帳法別表第一から別表第五までの改正規定に限る。）、第四十五条、第四十七条及び第五十五条（行政手続における特定の個人を識別するための番号の利用等に関する法律別表第一及び別表第二の改正規定（同表の二十七の項の改正規定を除く。）に限る。）並びに附則第八条第一項、第五十九条から第六十三条まで、第六十七条及び第七十一条から第七十三条までの規定　公布の日

Omitted

略

the provisions of Article 7, paragraph (3) of the Supplementary Provisions: the date specified by Cabinet Order within a period not exceeding nine months from the date of promulgation;

附則第七条第三項の規定　公布の日から起算して九月を超えない範囲内において政令で定める日

the provisions of Article 17, Article 35, Article 44, Article 50 and Article 58, and the following Article, and Article 3, Article 5, Article 6, Article 7 (excluding paragraph (3)), Article 13, Article 14, Article 18 (limited to the provisions amending Article 129 of the Family Register Act (excluding the part inserting "the original and" after "of the family register")), Articles 19 through 21, Article 23, Article 24, Article 27, Article 29 (excluding the provisions amending Article 30-15, paragraph (3) of the Residential Basic Book Act), Article 30, Article 31, Articles 33 through 35, Article 40, Article 42, Articles 44 through 46, Article 48, Articles 50 through 52, Article 53 (excluding the provisions amending Article 45-2, paragraphs (1), (5), (6) and (9) of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures and the provisions amending Article 52-3 of that Act), Article 55 (excluding the provisions amending Article 35 of the Act on Promotion of Cancer Registration, etc. (Act No. 111 of 2013) (limited to the part deleting "(including ordinances)")), Article 56, Article 58, Article 64, Article 65, Article 68 and Article 69 of the Supplementary Provisions: the date specified by Cabinet Order for each provision within a period not exceeding one year from the date of promulgation;

第十七条、第三十五条、第四十四条、第五十条及び第五十八条並びに次条、附則第三条、第五条、第六条、第七条（第三項を除く。）、第十三条、第十四条、第十八条（戸籍法第百二十九条の改正規定（「戸籍の」の下に「正本及び」を加える部分を除く。）に限る。）、第十九条から第二十一条まで、第二十三条、第二十四条、第二十七条、第二十九条（住民基本台帳法第三十条の十五第三項の改正規定を除く。）、第三十条、第三十一条、第三十三条から第三十五条まで、第四十条、第四十二条、第四十四条から第四十六条まで、第四十八条、第五十条から第五十二条まで、第五十三条（行政手続における特定の個人を識別するための番号の利用等に関する法律第四十五条の二第一項、第五項、第六項及び第九項の改正規定並びに同法第五十二条の三の改正規定を除く。）、第五十五条（がん登録等の推進に関する法律（平成二十五年法律第百十一号）第三十五条の改正規定（「（条例を含む。）」を削る部分に限る。）を除く。）、第五十六条、第五十八条、第六十四条、第六十五条、第六十八条及び第六十九条の規定　公布の日から起算して一年を超えない範囲内において、各規定につき、政令で定める日

Omitted

略

the provisions of Article 8, paragraph (2) and Article 9, paragraph (3) of the Supplementary Provisions: the date specified by Cabinet Order within a period not exceeding one year and six months from the date of promulgation;

附則第八条第二項及び第九条第三項の規定　公布の日から起算して一年六月を超えない範囲内において政令で定める日

the provisions of Article 27 (limited to the provisions amending Article 24-2 of the Residential Basic Book Act and the provisions amending Article 30-15, paragraph (3) of that Act), Article 48 (excluding the provisions renumbering Article 71-2 of the Act on Certification Business of the Japan Agency for Local Authority Information Systems in Relation to Electronic Signatures, etc. as Article 71-3 of that Act and adding one Article after Article 71 of that Act), Article 49 and Article 51, and Article 9 (excluding paragraph (3)), Article 10, Article 15, Article 18 (limited to the provisions amending Article 129 of the Family Register Act (limited to the part inserting "the original and" after "of the family register")), Article 22, Article 25, Article 26, Article 28, Article 29 (limited to the provisions amending Article 30-15, paragraph (3) of the Residential Basic Book Act), Article 39, Article 43, Article 47, Article 49, Article 54, Article 55 (limited to the provisions amending Article 35 of the Act on Promotion of Cancer Registration, etc. (limited to the part deleting "(including ordinances)")), Article 57, Article 66 and Article 70 of the Supplementary Provisions: the date specified by Cabinet Order for each provision within a period not exceeding two years from the date of promulgation.

第二十七条（住民基本台帳法第二十四条の二の改正規定及び同法第三十条の十五第三項の改正規定に限る。）、第四十八条（電子署名等に係る地方公共団体情報システム機構の認証業務に関する法律第七十一条の二を同法第七十一条の三とし、同法第七十一条の次に一条を加える改正規定を除く。）、第四十九条及び第五十一条並びに附則第九条（第三項を除く。）、第十条、第十五条、第十八条（戸籍法第百二十九条の改正規定（「戸籍の」の下に「正本及び」を加える部分に限る。）に限る。）、第二十二条、第二十五条、第二十六条、第二十八条、第二十九条（住民基本台帳法第三十条の十五第三項の改正規定に限る。）、第三十九条、第四十三条、第四十七条、第四十九条、第五十四条、第五十五条（がん登録等の推進に関する法律第三十五条の改正規定（「（条例を含む。）」を削る部分に限る。）に限る。）、第五十七条、第六十六条及び第七十条の規定　公布の日から起算して二年を超えない範囲内において、各規定につき、政令で定める日

Supplementary Provisions, Article 7Transitional Measures Accompanying Enforcement of the Provisions of Article 50

第七条（第五十条の規定の施行に伴う経過措置）

If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given, before the date of enforcement of the provisions of Article 50 (hereinafter referred to as the "Article 50 Effective Date" in this Article), to an Appended Table 2 corporation or the equivalent (meaning a corporation listed in Appended Table 2 of the Act on the Protection of Personal Information as Amended by Article 50; the Japan Organization of Occupational Health and Safety that is deemed, pursuant to Article 58, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, to be a business handling personal information prescribed in Article 16, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, a business handling pseudonymized personal information prescribed in paragraph (5) of that Article, or a business handling information related to personal information prescribed in paragraph (7) of that Article; or a business handling personal information prescribed in paragraph (2) of that Article that is an academic research institution or the equivalent prescribed in paragraph (8) of that Article; the same applies hereinafter in this Article), and that consent is equivalent to consent to the effect of permitting the handling of personal information for a purpose other than the purpose of use specified pursuant to the provisions of Article 17, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in Article 18, paragraph (1) or (2) of the Act on the Protection of Personal Information as Amended by Article 50 is deemed to have been given on the Article 50 Effective Date.

第五十条の規定の施行の日（以下この条において「第五十条施行日」という。）前に別表第二法人等（第五十条改正後個人情報保護法別表第二に掲げる法人、第五十条改正後個人情報保護法第五十八条第二項の規定により第五十条改正後個人情報保護法第十六条第二項に規定する個人情報取扱事業者、同条第五項に規定する仮名加工情報取扱事業者若しくは同条第七項に規定する個人関連情報取扱事業者とみなされる独立行政法人労働者健康安全機構又は同条第八項に規定する学術研究機関等である同条第二項に規定する個人情報取扱事業者をいう。以下この条において同じ。）に対しされた本人の個人情報の取扱いに関する同意がある場合において、その同意が第五十条改正後個人情報保護法第十七条第一項の規定により特定される利用目的以外の目的で個人情報を取り扱うことを認める旨の同意に相当するものであるときは、第五十条施行日において第五十条改正後個人情報保護法第十八条第一項又は第二項の同意があったものとみなす。

If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to an Appended Table 2 corporation or the equivalent before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal data to a third party pursuant to the provisions of Article 27, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that paragraph is deemed to have been given on the Article 50 Effective Date.

第五十条施行日前に別表第二法人等に対しされた本人の個人情報の取扱いに関する同意がある場合において、その同意が第五十条改正後個人情報保護法第二十七条第一項の規定による個人データの第三者への提供を認める旨の同意に相当するものであるときは、第五十条施行日において同項の同意があったものとみなす。

An Appended Table 2 corporation or the equivalent that intends to provide personal data to a third party pursuant to the provisions of Article 27, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 may, even before the Article 50 Effective Date, as provided by Order of the Personal Information Protection Commission, notify the identifiable person of matters equivalent to those set forth in the items of that paragraph and file a notification of them with the Personal Information Protection Commission. In this case, that notice and notification are deemed to be the notice and notification under the provisions of that paragraph on or after the Article 50 Effective Date.

第五十条改正後個人情報保護法第二十七条第二項の規定により個人データを第三者に提供しようとする別表第二法人等は、第五十条施行日前においても、個人情報保護委員会規則で定めるところにより、同項各号に掲げる事項に相当する事項について、本人に通知するとともに、個人情報保護委員会に届け出ることができる。この場合において、当該通知及び届出は、第五十条施行日以後は、同項の規定による通知及び届出とみなす。

If, before the Article 50 Effective Date, an Appended Table 2 corporation or the equivalent has notified the identifiable person of matters equivalent to the matters that must be notified to the identifiable person or made readily accessible to the identifiable person pursuant to the provisions of Article 27, paragraph (5), item (iii) of the Act on the Protection of Personal Information as Amended by Article 50, that notice is deemed to be the notice under the provisions of that item on or after the Article 50 Effective Date.

第五十条改正後個人情報保護法第二十七条第五項第三号の規定により本人に通知し、又は本人が容易に知り得る状態に置かなければならない事項に相当する事項について、第五十条施行日前に、別表第二法人等により本人に通知されているときは、当該通知は、第五十条施行日以後は、同号の規定による通知とみなす。

If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to an Appended Table 2 corporation or the equivalent before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal data to a third party in a foreign country pursuant to the provisions of Article 28, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that paragraph is deemed to have been given on the Article 50 Effective Date.

第五十条施行日前に別表第二法人等に対しされた本人の個人情報の取扱いに関する同意がある場合において、その同意が第五十条改正後個人情報保護法第二十八条第一項の規定による個人データの外国にある第三者への提供を認める旨の同意に相当するものであるときは、第五十条施行日において同項の同意があったものとみなす。

The provisions of Article 28, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an Appended Table 2 corporation or the equivalent obtains the consent of the identifiable person pursuant to the provisions of Article 28, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50 on or after the Article 50 Effective Date.

第五十条改正後個人情報保護法第二十八条第二項の規定は、別表第二法人等が第五十条施行日以後に第五十条改正後個人情報保護法第二十八条第一項の規定により本人の同意を得る場合について適用する。

The provisions of Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an Appended Table 2 corporation or the equivalent provides personal data, on or after the Article 50 Effective Date, to a third party in a foreign country prescribed in that paragraph.

第五十条改正後個人情報保護法第二十八条第三項の規定は、別表第二法人等が第五十条施行日以後に個人データを同項に規定する外国にある第三者に提供した場合について適用する。

If there is consent of the identifiable person concerning the handling of information related to personal information on the identifiable person that was given to an Appended Table 2 corporation or the equivalent before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of information related to personal information to a third party pursuant to the provisions of Article 31, paragraph (1), item (i) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that item is deemed to have been given on the Article 50 Effective Date.

第五十条施行日前に別表第二法人等に対しされた本人の個人関連情報の取扱いに関する同意がある場合において、その同意が第五十条改正後個人情報保護法第三十一条第一項第一号の規定による個人関連情報の第三者への提供を認める旨の同意に相当するものであるときは、第五十条施行日において同号の同意があったものとみなす。

The provisions of Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50, which are applied mutatis mutandis with terms replaced pursuant to Article 31, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, apply to cases in which an Appended Table 2 corporation or the equivalent provides information related to personal information, on or after the Article 50 Effective Date, to a third party in a foreign country prescribed in Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50.

第五十条改正後個人情報保護法第三十一条第二項において読み替えて準用する第五十条改正後個人情報保護法第二十八条第三項の規定は、別表第二法人等が第五十条施行日以後に個人関連情報を同項に規定する外国にある第三者に提供した場合について適用する。

If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given, before the Article 50 Effective Date, to an administrative entity prescribed in Article 2, paragraph (11) of the Act on the Protection of Personal Information as Amended by Article 50 (excluding the Japan Organization of Occupational Health and Safety that is deemed, pursuant to Article 58, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, to be a business handling personal information prescribed in Article 16, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50; hereinafter referred to as the "administrative entity" in this Article), and that consent is equivalent to consent to the effect of permitting the personal use or provision of personal information the administrative entity holds for a purpose other than the purpose of use specified pursuant to the provisions of Article 61, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in Article 69, paragraph (2), item (i) of the Act on the Protection of Personal Information as Amended by Article 50 is deemed to have been given on the Article 50 Effective Date.

第五十条施行日前に第五十条改正後個人情報保護法第二条第十一項に規定する行政機関等（第五十条改正後個人情報保護法第五十八条第二項の規定により第五十条改正後個人情報保護法第十六条第二項に規定する個人情報取扱事業者とみなされる独立行政法人労働者健康安全機構を除く。以下この条において「行政機関等」という。）に対しされた本人の個人情報の取扱いに関する同意がある場合において、その同意が第五十条改正後個人情報保護法第六十一条第一項の規定により特定される利用目的以外の目的のために保有個人情報を自ら利用し、又は提供することを認める旨の同意に相当するものであるときは、第五十条施行日において第五十条改正後個人情報保護法第六十九条第二項第一号の同意があったものとみなす。

If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to an administrative entity before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal information the administrative entity holds to a third party in a foreign country pursuant to the provisions of Article 71, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that paragraph is deemed to have been given on the Article 50 Effective Date.

第五十条施行日前に行政機関等に対しされた本人の個人情報の取扱いに関する同意がある場合において、その同意が第五十条改正後個人情報保護法第七十一条第一項の規定による保有個人情報の外国にある第三者への提供を認める旨の同意に相当するものであるときは、第五十条施行日において同項の同意があったものとみなす。

The provisions of Article 71, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an administrative entity obtains the consent of the identifiable person pursuant to the provisions of Article 71, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50 on or after the Article 50 Effective Date.

第五十条改正後個人情報保護法第七十一条第二項の規定は、行政機関等が第五十条施行日以後に第五十条改正後個人情報保護法第七十一条第一項の規定により本人の同意を得る場合について適用する。

The provisions of Article 71, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an administrative entity provides personal information the administrative entity holds, on or after the Article 50 Effective Date, to a third party in a foreign country prescribed in that paragraph.

第五十条改正後個人情報保護法第七十一条第三項の規定は、行政機関等が第五十条施行日以後に保有個人情報を同項に規定する外国にある第三者に提供した場合について適用する。

Regarding the application of Article 74, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50 to a personal information file prescribed in Article 60, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 that an administrative organ prescribed in Article 2, paragraph (8) of the Act on the Protection of Personal Information as Amended by Article 50 actually holds on the Article 50 Effective Date, the phrase "intends to hold" in that paragraph is deemed to be replaced with "holds", and the term "Before" is deemed to be replaced with "Promptly after the enforcement of Article 50 of the Act on the Arrangement of Related Acts for the Formation of a Digital Society (Act No. 37 of 2021), when".

第五十条施行日において現に第五十条改正後個人情報保護法第二条第八項に規定する行政機関が保有している第五十条改正後個人情報保護法第六十条第二項に規定する個人情報ファイルについての第五十条改正後個人情報保護法第七十四条第一項の規定の適用については、同項中「保有しようとする」とあるのは「保有している」と、「あらかじめ」とあるのは「デジタル社会の形成を図るための関係法律の整備に関する法律（令和三年法律第三十七号）第五十条の規定の施行後遅滞なく」とする。

Search