Page 1

(Separate volume) Specific personal information in financial business
Guidelines for proper handling of

December 11, 2014
(Final revision on May 25, 2nd year of Reiwa)
Personal Information Protection Commission

Page 2

table of contents
Details
1 Restrictions on the use of specific personal information .................................. 1
1- (1) Restrictions on the use of personal numbers ..................................... 1
1-⑵ Restrictions on creating specific personal information files ....................... 4
2 Safety management measures for specific personal information, etc .................................. 5
2-⑴ Handling of consignment ..................................... 5
2-⑵ Safety management measures ..................................... 8
3 Restrictions on the provision of specific personal information, etc ..................... 9
3- (1) Request for provision of personal number ..................... 9
3-⑵ Restriction on request for provision of personal number, restriction on provision of specific personal information ..... 11
3-⑶ Collection / storage restrictions .................................................. 16
3-⑷ Identity verification ....................................................... . 1 9
4 Handling regarding suspension of provision to third parties ........................ 22
5 Specific personal information protection evaluation .................................. 23
6 Main provisions of the Personal Information Protection Law ..................... 24

* "(Separate volume) Guidelines for proper handling of specific personal information in financial business"
"Fourth Theory" of "Guidelines for Proper Handling of Specific Personal Information (Business Operators)"
It constitutes the part corresponding to.

<Reference> "Guidelines for proper handling of specific personal information (business operator)"
table of contents
1st Introduction
Definition of the second term, etc.
Third general remarks
3-1 Purpose
3-2 Application target of this guideline, etc.
3rd-3 Positioning of these guidelines, etc.
3-4 Protective Measures Concerning Specific Personal Information under the Number Act
No. 3-5 Proactive efforts to protect specific personal information
3rd-6 Responses in the event of leakage of specific personal information
3-7 Review of these guidelines
Fourth detailed theory

Page 3

Positioning of separate volume
"Guidelines for Proper Handling of Specific Personal Information (Business Operators)" (hereafter
Below is called "Business Guidelines". ) Is an individual such as an employee mainly by the business operator
It is created on the assumption that the office work that handles numbers will be performed.
On the other hand, the financial field ("In the financial field" prepared by the Personal Information Protection Commission and the Financial Services Agency
Financial fields defined in Article 1, Paragraph 1 of "Guidelines for Personal Information Protection"
Say. ) (Hereinafter referred to as "financial institution") is the number method, "income"
According to the provisions of "Tax Law" (Law No. 33 of 1965), etc., in the field of tax and disaster countermeasures
Therefore, the office work to handle the customer's personal number will also be performed.
"(Separate volume) Guide on proper handling of specific personal information in financial business
"Line" is a separate volume of business guidelines, and financial institutions are related to financial operations.
Appropriate handling of specific personal information in the office work that handles the customer's personal number
It establishes specific guidelines for ensuring the above.
This separate volume guideline corresponds to the "4th theory" of the business operator guideline.
It constitutes a part, from "1st introduction" to "3rd general remarks"
For that, refer to the business operator guidelines. In addition, financial institutions line
Business guidelines shall be applied to businesses other than financial services.
To
In this separate guideline, "must" and "must not"
If you do not comply with these matters, it is a violation of the law.
May be judged. On the other hand, regarding the matters described as "desirable"
Therefore, if you do not comply with this, it will be immediately judged as a violation of the law.
No, but based on the purpose of the numbering method, it is desirable to respond as much as possible.
is there.
* Regarding specific personal information, there are no special provisions in the Numbering Law and the Personal Information Protection Law is applied.
Regarding the minutes, "Personal Information Protection in the Financial Field" prepared by the Personal Information Protection Commission and the Financial Services Agency
It is premised on observing the "Guidelines for Protection".

Page 4

1 Restrictions on the use of specific personal information
1- (1) Restrictions on the use of personal numbers
The point
○ The office work that can use the personal number is limited by the number law.
It is not possible for financial institutions to use personal numbers in connection with financial operations.
Mainly, write the customer's personal number on the payment record and submit it to the tax office chief.
If. → 1
○ Regarding exceptional use, the numbering method is more than the personal information protection law.
It is limited. In the case of a financial institution, the personal number is used beyond the purpose of use.
You can use (1) to pay money in the event of a catastrophic disaster.
When using an individual number to do so and (2) protecting the life, body or property of a person
When it is necessary to use an individual number for protection. → 2
(Related article)
・ Number Law Article 9, Article 30, Paragraph 3
・ Personal Information Protection Law Article 16
1 Principle handling of personal numbers
The personal number (Note) is from the scope of office work that the Numbering Law has limited in advance.
In principle, it is used after specifying the specific purpose of use.
Financial institutions use personal numbers in connection with financial operations mainly for payment.
This is the case when the customer's personal number is stated in the record, etc. and submitted to the tax office chief (personal number).
No. related affairs).
Unlike the Personal Information Protection Law, financial institutions, even with their consent,
Except as an exception (see 2), personal numbers other than these office work
Do not use.
* Financial institutions must not use personal numbers as customer numbers to manage customers.
I.

(Note) "Individual number" corresponds to the individual number and is used in place of the individual number.
Numbers, etc. are also included (Article 2, Paragraph 8 of the Number Act). For example, read numbers into the alphabet
When the personal number is replaced with the alphabet according to the law of replacement
However, the alphabet corresponds to the "individual number". On the other hand, financial institutions
Customer number, etc. attached to manage the customer (Personal number of the customer is set according to a certain rule
Therefore, the one that is not converted) does not correspond to the "individual number".

1

Page 5

A Personal number related affairs (Article 9, Paragraph 3 of the Number Act)
It is the individual that the financial institution handles the personal number in connection with the financial business.
Number-related office work. Specifically, a financial institution is a customer's individual based on laws and regulations.
Enter the person number on documents such as interest payment records and annual transaction reports for specific accounts.
Office work to be submitted to the tax office chief.
B Prohibition of use of personal numbers beyond the purpose of use
a Prohibition of the use of personal numbers beyond the purpose of use (read according to Article 30, Paragraph 3 of the Number Act)
Personal Information Protection Law, Article 16, Paragraph 1)
The financial institution must specify the purpose of use of the personal number as much as possible.
Yes (Article 15, Paragraph 1 of the Personal Information Protection Law), but as a specific degree, use
As with personal information, rather than simply specifying the purpose abstractly and generally.
Is it common for the person to use his / her personal number for what purpose?
It is desirable to specify it concretely to the extent that it can be reasonably predicted.
The numbering method is different from the Personal Information Protection Law, even with the consent of the person.
It stipulates that specific personal information must not be used beyond the purpose of use.
Therefore, the purpose of use of the personal number (the personal number can be used)
It can be used only within the scope of the purpose of use specified within the scope of business.
If it becomes necessary to use the personal number beyond the purpose of use, the initial interest
Change the purpose of use within the range reasonably recognized as having relevance to the purpose of use
Then, by notifying the person, etc., within the scope of the changed purpose of use.
You can use your personal number (Article 15, Paragraph 2, Article 18 of the Personal Information Protection Law)
Article 3).
* Proposed for payment record preparation work related to insurance payment when concluding the previous insurance contract
For the personal number provided, payment related to insurance payment based on the later insurance contract
It is understood that it can be used for record preparation work.

* All possible payments when a financial institution receives a personal number from a customer
It is conceivable to specify the purpose of use such as record preparation work and notify the person himself / herself.
Is done. In addition, as a method of notification etc., when acquiring personal information that has been done conventionally
Similarly, a method such as presenting a document stating the purpose of use can be considered.

b In the case of a merger, etc. (Individuals applied by replacing with Article 30, Paragraph 3 of the Number Act)
Information Protection Law, Article 16, Paragraph 2)
A business operator handling personal information will take over the business due to a merger, etc.
Obtain specific personal information of the customer of the business operator from another business operator handling personal information
In that case, specific personal information will be provided according to the purpose of use specified before the succession.
It can be used. However, even with the consent of the person, before the succession
Specific personal information must not be used beyond the purpose of use specified in.
2

Page 6

* Financial institution A will take over the business of financial institution B, and B will take over the business of preparing payment records, etc.
If you inherit the personal number of your customer, the personal number of the customer will be used as the advisor.
It can be used within the scope of payment record preparation work related to customers.

2 When exceptional handling is possible
In the number method, in the following cases, the advantage of personal numbers that exceeds the purpose of use exceptionally
I admit it.
a When a financial institution pays money in the event of a catastrophic disaster, etc. (Article 9, Paragraph 4 of the Number Act,
Article 16 Paragraph 3 of the Personal Information Protection Law, which is applied by replacing it with Article 30 Paragraph 3.
No. 1, Number Act Enforcement Ordinance (Note) Article 10, in the event of a catastrophic disaster, etc.
To the extent necessary to make payments based on pre-contracted contracts
Cabinet Office Ordinance on the Use of Individual Numbers (Cabinet Office Ordinance No. 74, 2015)
(1) Financial institutions handling deposits such as banks, (2) Securities companies, (3) Life insurance companies, (4) Damage
Insurance company, ⑤ Life insurance company or mutual aid organization that performs the same business as non-life insurance company
Is the "Act on Special Financial Assistance for Dealing with Catastrophic Disasters" (Showa)
37 Year Law No. 150) When a catastrophic disaster occurs in Article 2, Paragraph 1 or "Disaster Countermeasures"
Basic Law for Measures ”(Law No. 223 of 1958), Article 63, Paragraph 1 and other Cabinet Office Ordinances
Access to certain areas is restricted, prohibited, or applicable by law
Personal number related matters such as preparation of payment records when ordered to move out of the area
For the personal number held for the purpose of processing business, the money to the customer
Used to search customer deposit information for another purpose of making payments
be able to.
(Note) The Number Act Enforcement Ordinance is the "use of numbers for identifying specific individuals in administrative procedures.
It means "Law Enforcement Ordinance on Use, etc." (Cabinet Order No. 155, 2014) (the same shall apply hereinafter).

b When it is necessary to protect the life, body or property of a person, the person himself / herself
If there is the consent of the person or it is difficult to obtain the consent of the person (Numbering Law No. 1)
Article 16 Paragraph 3 of the Personal Information Protection Law, which is applied by replacing it with Article 30 Paragraph 3.
No. 2)
When it is necessary to protect the life, body or property of a person, the person himself / herself
If there is the consent of the person or it is difficult to obtain the consent of the person, the payment record
Personal number held for the purpose of processing personal number related affairs such as creation of
It can be used to protect human life, body or property.

3

Page 7

1-⑵ Restrictions on creating specific personal information files
The point
○ Specific personal information only to the extent necessary to process personal number related affairs
You can create an information file.
(Related article)
・ Number Law Article 29
● Restrictions on the creation of specific personal information files (Article 29 of the Number Act)
Financial institutions can create specific personal information files related to financial operations
Only the range necessary to process personal number related affairs can be done.
Specific personal information phi only for customer payment record preparation work performed in accordance with laws and regulations
It is possible to create a personal information system, except in these cases.
Do not create files.

Four

Page 8

2 Safety management measures for specific personal information, etc.
2-⑴ Handling of consignment
The point
○ Persons who outsource all or part of personal number related affairs are at the outsourcee
Therefore, measures equivalent to the safety management measures that the consignor should take based on the number law
Must be supervised as necessary and appropriate so that → 1
A, 2C
"Necessary and appropriate supervision" includes (1) appropriate selection of contractors and (2) safety management measures.
Concluding a consignment contract regarding ③ Understanding the handling status of specific personal information at the consignee
Grip is included. → 1B
* For specific details of safety management measures, see "2-⑵ Safety management measures" and business.
"(Attachment) Safety management measures for specific personal information (Business operator edition)"
checking ...

○ All or part of the personal number related affairs "consigned person" is the consignor
Subcontracting can only be done with permission. → 2A
A person who has been subcontracted is considered to be a "consigned person" for personal number related affairs.
It can be further subcontracted only with the permission of the first consignor.
To → 2B
(Related article)
・ Number Law Articles 10 and 11
・ Personal Information Protection Law Article 22
1 Supervision of contractors (Article 11 of the Number Act, Article 22 of the Personal Information Protection Act)
A Safety management measures at the contractor
A person who outsources all or part of personal number related affairs (hereinafter referred to as "consignor")
U. ) Is the safety management of specific personal information handled by the outsourced personal number related office work.
Necessary and appropriate for "consigned persons" so that measures can be taken appropriately
Must be supervised.
For this reason, the consignor is a "consignee" who is entrusted based on the numbering method.
Is it necessary to take measures equivalent to the safety management measures that the trustee should take?
Appropriate supervision must be provided.
In addition, without taking necessary measures to properly supervise the "consigned person",
Or, we did not take concrete measures to fulfill the necessary and sufficient supervisory obligations.
As a result, if the leakage of specific personal information occurs, it is judged to be a violation of the Numbering Law.
There is a possibility.

Five

Page 9

* We handle personal numbers by entrusting all or part of personal number related affairs from insurance companies.
The agency is the "consignee" under the Number Act, and the insurance company that is the consignor is the substitute.
At the barber shop, the same measures as the safety management measures that the insurance company should take are taken.
We must provide necessary and appropriate supervision.

B Necessary and appropriate supervision
For "necessary and appropriate supervision", (1) appropriate selection of contractors, (2) safety for contractors
Conclusion of contracts necessary to comply with management measures, ③ Specific individual at the contractor
Includes grasping the handling status of personal information.
Regarding the selection of outsourcers, the outsourcer shall use the numbering method at the outsourcee.
Whether or not measures equivalent to the safety management measures that the consignor should take should be taken
You have to confirm it in advance. As a specific confirmation item,
Equipment of contractors, technical level, status of supervision / education for employees (Note) , etc.
The business environment of the outsourcer can be mentioned.
Regarding the conclusion of the consignment contract, the contents of the contract include confidentiality obligations and the inside of the business establishment.
Prohibition of taking out specific personal information from, prohibition of unintended use of specific personal information,
Conditions for subcontracting, responsibility of the consignee in the event of a leak, consignment
Return or disposal of specific personal information after contract termination, supervision and education for employees,
It is necessary to include provisions that require a report on the status of compliance with the contract contents.
Absent. In addition to these contract details, employees who handle specific personal information
Clarification, provisions that allow the consignor to conduct an on-the-spot survey of the consignee, etc.
It is desirable to include it.
Regarding the grasp of the handling status of specific personal information at the contractor, the above contract
Implementation of the contents included in the consignment contract by requesting a report based on
Appropriate, including considering reviewing the content of the consignment, etc. after understanding the degree
It is desirable to evaluate it.
(Note) “Employee” means direct and indirect command and supervision of a financial institution within the organization of the financial institution.
A person who is engaged in the business of a financial institution. Specifically, in addition to employees,
Includes corporate auditors, corporate auditors, directors, auditors, dispatched employees, etc.

2 Subcontracting (Articles 10 and 11 of the Number Act)
A Requirements for subcontracting (Article 10, Paragraph 1)
All or part of the personal number related affairs "consigned person" is the permission of the consignor
Subcontracting may only be done with consent.
* If financial institution A outsources personal number-related affairs to business operator B, you are the outsourcer.
The affairs can be outsourced to another business operator only with the permission of a certain company.

6

Page 10

B Effect of subcontracting (Article 10, Paragraph 2)
Those who have been subcontracted are "consigned" for all or part of the personal number related affairs.
Can be regarded as a "person" and can carry out subcontracted personal number related affairs
In addition, the affairs will be further subcontracted only with the permission of the first consignor.
be able to.
* When subcontracting further, the person who obtains the permission is the first consignor.
Therefore, if the personal number related office work is entrusted in the order of A → B → Hei → Ding, Hei will
Subcontract to another business operator only with the permission of the first consignor, A.
Can be done. The same applies when subcontracting is repeated.
In addition, since you are obliged to supervise Hei, Hei will renew the contents of the consignment contract between Hei and Hei.
Determine the handling when outsourcing, the conditions when subcontracting, and against B when subcontracting
It is desirable to include the obligation to notify.

* The "consignee" violates the provisions of Article 10 of the Number Act, and the permission of the first consignor
If the personal number related affairs are subcontracted without obtaining the information, the "consigned person" will be Article 19 of the same law.
It also violates (Provision restrictions), and the person who received the subcontract is also Article 15 of the same law (Proposal)
Possibility of being judged to violate Article 20 (collection / storage restrictions)
Therefore, it is necessary to keep in mind.

C Supervision of subcontractors (Article 11)
"Person who has been entrusted" in 1A means a business operator directly entrusted by the consignor.
It points to, but if you are entrusted in the order of A → B → Hei → Ding, you are obliged to supervise A
The content of is not only the suitability of subcontracting, but also the necessity and suitability of B for Hei and Ding.
It also includes supervising whether or not you are doing earnest supervision. Therefore,
A is not only obliged to supervise B, but also to the subcontractors Hei and Ding.
You will be indirectly obliged to supervise.

7

Page 11

2-⑵ Safety management measures
● Safety management measures (Article 12 of the Number Act, Articles 20 and 21 of the Personal Information Protection Act)
The financial institution that is the person who carries out the affairs related to the Individual Number is the Individual Number
Not only those of the dead but also those of the dead. ) And specific personal information (hereinafter referred to as "specific personal information"
Etc. " ) Leakage, loss or damage prevention and other management of specific personal information, etc.
Necessary and appropriate measures must be taken for the sake of reason. In addition, employees (Note)
Safety management of specific personal information, etc.
The necessary and appropriate supervision of the employee must be provided so that
Not.
(Note) “Employee” means direct and indirect command and supervision of a financial institution within the organization of the financial institution.
A person who is engaged in the business of a financial institution. Specifically, in addition to employees, crackdown
Includes roles, corporate auditors, directors, auditors, dispatched employees, etc.

* For specific details of safety management measures, see "(Attachment) Identification" in the operator guidelines.
We will refer to "Safety Management Measures for Personal Information (Business Operators)", but personal information
"Guidelines for the protection of personal information in the financial field" prepared by the Protection Commission and the Financial Services Agency
It is premised that the "Practical Guidelines for Safety Management Measures, etc."

8

Page 12

3 Restrictions on the provision of specific personal information, etc.
3-⑴ Request for provision of personal number
The point
○ Personal number related affairs practitioner is necessary to process personal number related affairs
Only when there is an individual to the person or other personal number related office worker
You can ask for a person number.
(Related article)
・ Number Law Article 14

1 Request for provision (Article 14, Paragraph 1 of the Number Act)
A financial institution is responsible for personal number-related affairs related to financial operations.
It is necessary to receive the personal number from another person who carries out the work related to the personal number. number
Article 14, Paragraph 1 of the Act is for the individual number-related office worker to request the provision of an individual number.
It is a rule that is the basis of.
The individual number-related affairs practitioner handles personal number-related affairs in accordance with this article.
If necessary, personal number for the person or other personal number related office worker
Will be requested.
A Request to provide an individual number to the person
Based on this article, financial institutions are required to prepare payment records for customers.
You will be asked to provide the required personal number.
B Request for provision of personal number to other personal number related office workers
Based on this article, financial institutions will contact other personal number-related clerical workers.
You will be asked to provide the personal number required for payment record preparation work.
* Under the stock transfer system, we were entrusted with the affairs related to the shareholder list by the stock issuer.
The shareholder registry administrator (trust bank, etc.) requests the transfer institution to provide the individual number of the shareholder.
It will be lost.

2 When to request the offer
Personal number related affairs practitioner needs to process personal number related affairs
You will be asked to provide your personal number when you do so.
Financial institutions request the provision of personal numbers when personal number-related office work occurs
In principle, it is necessary to issue personal number related affairs based on legal relationships with customers.
If it is expected to be raw, it is expected that the relevant office work will occur at the time of concluding the contract.
It is understood that it is possible to request the provision of an individual number at the time of arrival. In addition, contract
If it is recognized from the contents of the agreement that personal number related office work does not occur clearly,

9

Page 13

Do not ask for your personal number.
* In the case of office work to prepare an annual transaction report for a specific account associated with income calculation for a specific account, etc.
According to the provisions of Article 37-11-3, Paragraph 4 of the Special Taxation Measures Law, the customer submits a specific account opening notification form.
Since it is obligatory to announce the personal number at the time of issuing, requesting provision at that time
Become.

* In the case of preparation of payment records for settlement of differences in futures transactions, Article 224 of the Income Tax Act
5 Until the date of settlement of differences, etc. pursuant to the provisions of Paragraph 1 and Article 350-3, Paragraph 1 of the Enforcement Ordinance of the Act.
In principle, we request the notification of personal number each time, but we entrust futures trading, etc.
It is understood that it is possible to request the provision of an individual number at the time of concluding such a contract.

* In the case of preparation of payment records for payment of insurance claims based on life insurance contracts, insurance
Requesting the personal numbers of policyholders and beneficiaries of insurance claims, etc. at the time of contract conclusion
Is also understood to be possible.

* In the case of payment record preparation work associated with the payment of investment dividends of cooperative financial institutions, income
Each time payment is confirmed pursuant to the provisions of Article 224, Paragraph 1 of the Tax Law and Article 336, Paragraph 1 of the Enforcement Ordinance of the same law,
In principle, you will be asked to give your personal number, but when you join a cooperative financial institution,
It is understood that it is also possible to request the provision of an individual number.

Ten

Page 14

3-⑵ Restriction on request for provision of personal number, restriction on provision of specific personal information
The point
○ Unless otherwise specified by the numbering method, requesting the provision of an individual number
It doesn't become. → 1
○ Unless otherwise specified by the numbering method, do not provide specific personal information.
It doesn't become. → 2
(Related article)
・ Number Law Article 15, Article 19, Article 30 Paragraph 3
・ Personal Information Protection Law Article 23
1 Restrictions on request for provision (Article 15 of the Number Act)
Many people fall under any of the items of Article 19 of the Number Act and receive specific personal information.
Unless you can, do not ask for the personal number of another person.
Financial institutions will be required to provide an individual number in connection with financial operations.
Only when requesting the customer to provide an individual number for payment record preparation work, etc.
Be done.
* The financial institution provides the customer with an individual number for the purpose of processing payment record preparation work, etc.
You will be asked for a companion. On the other hand, a place to process payment record preparation work, etc. stipulated by law
Except in cases, you must not ask for your personal number.

2 Restrictions on the provision of specific personal information (Article 19 of the Number Act)
Any person "provides" specific personal information, unless otherwise specified by the Number Act.
should not be done.
Financial institutions can provide specific personal information to customers' personal numbers in payment records, etc.
It is limited to the case of submitting to the tax office chief with the description.
A About the significance of "offering"
"Provision" means the transfer of specific personal information beyond the legal personality
The movement of specific personal information that does not exceed the legal personality of the same corporation, etc.
Use is not "offer" but "use", and usage restrictions (Articles 9 and 29 of the Numbering Law,
Article 30 Paragraph 3) will be followed.
In addition, under the Personal Information Protection Law, it is used jointly with a specific person.
If personal data is provided to the specific person, it will be provided to a third party.
It is said that there is no such thing (Article 23, Paragraph 5, Item 3 of the Personal Information Protection Law), but it smells like the numbering method.
Excludes the application of Article 23, Paragraph 5, Item 3 of the Personal Information Protection Law (Number Law).
(Article 30, Paragraph 3) Therefore, in this case as well, it corresponds to normal "offering" and provision restrictions.
(Articles 14 to 16 of the same law, Article 19, Article 20, Article 30, Paragraph 3)

11

Page 15

It becomes.
* If it does not correspond to "offer"
When specific personal information moves from the X part to the Y part in the financial institution A, the X part and the Y part are the same.
Since each is an internal department of A and does not have an independent legal personality, it is not applicable to "offering".
It's irresistible. For example, the customer's personal number creates a payment record through the person in charge at the sales office.
If it is submitted to the Accounting Department for the purpose of doing so, it does not correspond to "offering" and is permitted by law.
It becomes "use".

* When it corresponds to "offer"
When specific personal information is transferred from financial institution A to another business operator B, it corresponds to "providing".
Even if specific personal information is transferred between companies of the same affiliate, as long as it is a different corporation,
It is necessary to note that when "providing", the provision restrictions will be followed. For example, instep
The bank and its subsidiary, B Securities Company, are dealing with the same customer and are not disclosed by that customer.
Even if you have written consent to give and receive information, the customer's individuality between A and B
Do not provide or share personal numbers.

B When specific personal information can be provided (Article 19, Items 1 to 16 of the Number Act)
Each item of Article 19 of the Number Act stipulates that specific personal information can be provided.
Among the things, those related to financial business are as follows.
a Provision from the person carrying out the office work related to the Individual Number (No. 2)
The financial institution that carries out the personal number related affairs handles the personal number related affairs
To provide specific personal information to the tax office chief, etc., based on laws and regulations.
It becomes.
* Financial institutions (personal number-related clerical workers) are subject to the provisions of Article 225, Paragraph 1 of the Income Tax Act.
Therefore, in order to handle the personal number related affairs of submitting payment records, the tax office chief
On the other hand, a payment record containing the customer's personal number will be submitted.

* Financial institutions (personal number-related clerical workers) are required to use Article 37-11-3 of the Special Taxation Measures Law.
In accordance with the provisions of Paragraph 7, the personal number related affairs of submitting the annual transaction report for a specific account
To process, create a specific account annual transaction report with the customer's personal number,
It will be submitted to the tax office chief.

b Provided by the person or his / her agent (No. 3)
The person or his / her agent is to the financial institution that is the person who carries out the affairs related to the Individual Number.
However, specific personal information including the individual number of the person will be provided.
* Customers are financial machines that carry out personal number-related affairs for payment record preparation affairs, etc.
12

Page 16

You will provide your personal number to Seki.

c Consignment, provision due to merger (No. 5)
Entrustment or merger of all or part of the handling of specific personal information and other matters
When the business is succeeded by the reason, it is possible to provide specific personal information.
It recognized.
* If financial institution A merges with financial institution B, the absorbed B will prepare a payment record.
The personal number of the customer required for clerical work can be provided to the surviving A.

* The person who has been entrusted with the personal number related affairs violates the provisions of Article 10 of the Number Act,
If the personal number related affairs are subcontracted without the permission of the first consignor, the subcontract
Since the provision of specific personal information accompanying the provision does not fall under the provision of Article 19 No. 5 of the same law, it is provided.
It also violates the restrictions.

d Provision utilizing the stock transfer system (No. 11, Number Act Enforcement Ordinance, Article 23, No.
Article 24)
The transfer institution or account management institution is a corporate bond issuer, another transfer institution, or
Using an online system that connects each person to the account management institution,
Provisions of the "Act on Transfer of Corporate Bonds, Shares, etc." (Act No. 75 of 2001)
Based on the above, the shareholder is the transfer institution as the personal number that should be stated in the payment record.
Or, the specific personal information notified to the account management organization is the security of the specific personal information.
It can be provided after taking necessary measures (Note) to secure .
* Shareholders → Account management institution (Securities company X) → Account management institution (Securities company Y) → Transfer institution
→ See the example where specific personal information of shareholders is provided in the order of stock issuer → tax office chief
Then, securities company X → securities company Y, securities company Y → transfer institution, transfer institution → stock issuer
This corresponds to the provision of specific personal information between. Securities company X, securities company Y and transfer machine
Seki provides specific personal information pursuant to the provisions of Article 62 of the Order Concerning the Transfer of Corporate Bonds, Shares, etc.
It is obligatory to serve.
The provision of specific personal information between shareholders and securities company X is provided in Article 19, Item 3 (b) of the Number Act.
The provision of specific personal information between the stock issuer and the tax office chief is based on item 2 (a) of the same Article.
Will be done.

(Note) Enforcement of the Number Act for necessary measures to ensure the safety of specific personal information
Article 24 of the Ordinance stipulates as follows.
(1) In the computer related to the use of the person who provides the specific personal information, the specific personal information
Record the name of the person who receives the offer, the date and time of the offer, and the matters specified by the ordinance of the competent ministry.
Keep the record for 7 years
(2) If the specific personal information provided is leaked, that fact and the reason
13

Page 17

To establish and provide the necessary system to report to the committee without delay.
Make sure that the recipient has a similar system
③ Measures to ensure the safety of specific personal information specified by the ordinance of the competent ministry
To carry out

e Request for provision from the committee (No. 12)
The committee stipulates Article 35, Paragraph 1 of the Number Act regarding the handling of specific personal information.
If you request the submission of specific personal information, the committee members will respond to this request.
Specific personal information must be provided to the association.
f Provision when there is a need for other public interests such as examinations by each House (No. 14, Number Act)
Enforcement Ordinance Article 25, Enforcement Ordinance Appendix)
(1) Examination and investigation procedures of each chamber, (2) Legal proceedings and other court procedures
Continued, ③ Execution of trial, ④ Investigation of criminal cases, ⑤ Based on the provisions of the tax law
Investigating criminal cases, ⑥ When the Board of Audit is inspected, ⑦ In the public interest
Specific personal information can be provided when necessary. ⑦ Public interest
When it is necessary to do the above, it is stipulated in Article 25 of the Number Act Enforcement Ordinance, "Private
Law Concerning Prohibition of Monopoly and Ensuring Fair Trade "(Law No. 54 of 1947)
Investigation of criminal cases under the provisions of (Number Act Enforcement Ordinance Appendix No. 2), "Financial Instruments
Investigation of criminal cases under the provisions of the "Transaction Law" (Law No. 25 of 1948) (Table No. 25)
No. 4), tax investigation (No. 8 of the same table), report collection according to the provisions of the Personal Information Protection Law
Revenue (No. 19 of the same table), "Act on Prevention of Transfer of Proceeds from Crimes" (Heisei
There is a notification (No. 23 of the same table), etc. pursuant to the provisions of Law No. 22 of 19).
g Provision for the protection of human life, body or property (No. 15)
Books where necessary to protect human life, body or property
Specific when there is a person's consent or it is difficult to obtain the person's consent
Personal information can be provided.
C Difference from third party provision under the Personal Information Protection Law
The Personal Information Protection Law tells businesses that handle personal information about personal data.
Provide to a third party with the consent of the person or in accordance with the provisions of laws and regulations.
It is supposed to be possible.
In the numbering method, specific personal information is specified in Article 19 of the law for all businesses.
We have limited the cases where we can provide specific personal information.
Article 23 of the Personal Information Protection Law does not apply.
When requested to provide specific personal information, the grounds for requesting the provision are
Carefully check whether it corresponds to each item of Article 19 of the Numbering Law, and correspond to each item of the same Article.
If you do not, you must not provide specific personal information.

14

Page 18

* Request for disclosure based on Article 28 of the Personal Information Protection Law, request for correction based on Article 29 of the same law, etc.
Or, when requesting suspension of use, etc. based on Article 30 of the same law, attach a personal number from the person himself / herself.
When a request is made or when the personal number or specific personal information is provided to the person,
Although not stipulated in each item of Article 19 of the Numbering Law, it is natural that specific personal information is provided due to the interpretation of the law.
This is a case that should be accepted, and specific personal information can be provided.

15

Page 19

3-⑶ Collection / storage restrictions
The point
○ Except for cases that fall under any of the items of Article 19 of the Number Act, specific personal information will be provided.
Do not collect or store.
(Related article)
・ Number Law Article 20
・ Personal Information Protection Law Article 19
● Restrictions on collection and storage (Article 20 of the Number Act)
Any person is an individual of another person, except when it falls under any of the items of Article 19 of the Number Act.
You must not collect or store specific personal information including numbers.
A Collection restrictions
"Collecting" means putting it in your possession with the intention of collecting, eg
For example, receiving a memo with an individual number from a person, hearing from a person
In addition to directly obtaining the personal number, such as writing down the personal number, operate a computer, etc.
Create, display the personal number on the screen, write down the personal number, pre
Includes things like going out. On the other hand, just receiving the presentation of specific personal information
Does not correspond to "collection".
* A person who is engaged in personal number related affairs as a person in charge of payment record preparation at a financial institution
Do not copy the customer's specific personal information to a notebook for purposes other than personal number related office work
Absent.

* A financial institution is a depositor in a deposit refund business that is not related to personal number related affairs.
If your personal number card is presented as an identity verification document, the person in charge at the counter will be your personal number.
Copy the personal number written on the number card, or write the personal number of the personal number card
Do not copy the posted part to collect specific personal information.

* At a financial institution, simply receive documents with an individual number and prepare a payment record.
Since the person in the position of handing over to the person engaged in the business does not need to keep the personal number independently,
After performing necessary office work such as confirmation of personal number, deliver the documents as soon as possible
However, you must not leave your personal number in your possession.
For example, a sales person and an individual number who receive documents containing an individual number from a customer.
When the person in charge of managing the document is different, the sales person who receives the documents, etc. manages the personal number.
I will hand over the document to the person in charge as soon as possible, and I will have it in my hand
Do not leave the person number.
In addition, the person in charge of receiving documents with personal number is also in accordance with personal number related office work.

16

Page 20

Since you are engaged in the office work as a part of the financial institution, you can use the personal number.
When receiving the documents, etc. from the identified person, whether the documents, etc. are incomplete
You can check it including your personal number.

* We handle personal numbers by entrusting all or part of personal number related affairs from insurance companies.
The agency will do as much as possible unless it is necessary to keep the personal number under the consignment contract.
We will promptly hand over the documents, etc. containing the customer's personal number to the insurance company, and act as a proxy.
Do not leave your personal number in the store.

* In Article 10 of the Number Act, re-delegation of personal number-related affairs without the permission of the first consignor
It is clearly stated that entrustment is not permitted, and specific personal information associated with the subcontracting
Does not fall under any of the items of Article 19 of the same law.
For this reason, without confirming that the permission of the first consignor has been obtained, the personal number related affairs
Subcontracted and, as a result, identified with a subcontract without the permission of the original consignor
If personal information is collected, it may be judged as a violation of the Numbering Law.
However, for example, the consignment contract, etc. states that it is a consignment business that handles personal numbers.
The subcontracting corresponds to "subcontracting of personal number related affairs", such as not being clear.
If the subcontract was made in a situation that the person receiving the subcontract could not recognize,
Generally, it is not understood that specific personal information has been collected.

B Storage restrictions and disposal
Personal numbers are collected or collected to handle the affairs specified in the Number Act.
Is stored, so only if you need to do those affairs
You can continue to store specific personal information. In addition, the personal number was listed
Documents, etc. are required to be stored for a certain period of time by the relevant laws and regulations.
There are some, but for the personal number written in these documents, etc., the period
It will be stored for a while.
On the other hand, when it is no longer necessary to process those affairs, the decree under the jurisdiction
If the specified storage period has expired, please give your personal number as much as possible.
Must be promptly discarded or deleted. In addition, the personal number part is restored
It is possible to continue storage after masking or deleting to the extent that it can not be original
However, it is not necessary to use it when it corresponds to personal data.
When it becomes, we must try to erase the personal data without delay.
No (Article 19 of the Personal Information Protection Law).
* The financial institution keeps the customer's personal number for the purpose of processing payment record preparation work, etc.
be able to. On the other hand, except when processing payment record preparation work, etc. stipulated by law.
The customer's personal number cannot be stored.

* If you are required to submit a transaction report every year, such as for specific accounts and tax-exempt accounts,
17

Page 21

The personal number provided by the customer will continue to be used for transaction report preparation work from the next fiscal year onward.
It is understood that specific personal information can be continuously stored because it is necessary to use it for.

* The specific account opening notification form is Article 18-13-4, Paragraph 1, Item 3 of the Special Taxation Measures Law Enforcement Regulations.
On the day when the specific account abolition notification form, etc. was submitted for the specific account related to the notification form.
Since it is supposed to be stored for 5 years from the year following the year to which the
In that case, it is necessary to keep the personal number stated in the specific account opening notification form.
As a general rule, do not submit a specific account opening notification form with your personal number as quickly as possible.
Must be discarded.
Therefore, documents such as the specific account opening notification form with the personal number are saved.
It is desirable to establish a storage system that assumes disposal after the lapse of the period.

* Saves the specific personal information provided for payment record preparation work as an electromagnetic record.
Even if it is, it is not necessary to use it for the office work, and it is stipulated by the competent law.
As a general rule, if the storage period has expired, the personal number will be discarded as soon as possible.
Must be deleted.
Therefore, in the system that stores specific personal information, it should be left after the storage period has elapsed.
It is desirable to build a system that is premised on disposal or deletion.

* For specific details such as disposal methods, see "(Attachment) Specific Individuals" in the Business Guidelines.
Please refer to "Safety Management Measures for Personal Information (Business Operators)".

18

Page 22

3-⑷ Identity verification
● Identity verification (Article 16 of the Number Act)
Regarding identity verification, Number Law, Number Law Enforcement Ordinance, Number Law Enforcement Regulations (Note) and Individuals
Appropriate measures will be taken as the method approved by the person number use office worker will be followed.
There is a need.
(Note) The Number Act Enforcement Regulations are "numbers for identifying specific individuals in administrative procedures.
"Law Enforcement Regulations on Use, etc." (2014 Cabinet Office / Ministry of Internal Affairs and Communications Ordinance No. 3)
the same. ).

<Reference 1: Overview of identity verification>
The outline of identity verification in the Numbering Law, Numbering Law Enforcement Ordinance and Numbering Law Enforcement Regulations is as follows.
It is as follows. In this item, "law" is the number law, and "decree" is the number law.
Ordinance, "regulation" refers to the Number Law Enforcement Regulations (Number Law Enforcement Regulations Article 1, Paragraph 1, Item 1)
In this case, write "Rule 1 ① 1". ).
① When receiving an individual number from the person
I When receiving the presentation of the Individual Number Card
"Individual Number Card" (Law 16)

Ii Other than i
(I) When receiving documents, etc.
"Number verification documents" + "Identity verification documents"
(Ordinance 12 ① 1) (Ordinance 12 ① 2)
Driver's license, etc. of resident's card (Rule 1)
Copy etc.

In difficult cases (Rule 2③)
In difficult cases Special provisions of the Minister of Finance, etc. (Rule 2 ④)
(Rule 2 ①) By telephone (Rule 2 ⑤)
When it is clear that the person is the same as a specific individual
(Rule 2 ⑥)

(Ii) When receiving an individual number using an electronic information processing organization
Reading the IC chip of the Individual Number Card, sending electronic signatures, etc., using the Individual Number
Confirmation with the Japan Agency for Local Authority Information Systems by the business implementer (Rule 3)

19

Page 23

② When receiving the personal number from the person's agent
I When receiving documents, etc.
"Authority Confirmation Documents" + "Agent Identity Confirmation Documents" + "Personal Number Confirmation Documents"
(Ordinance 12 ③ 1) (Ordinance 12 ③ 2)

(Ordinance 12 ③ 3)

Family register copy, personal number card, related to the person
Power of attorney, etc. Driver's license, etc.

Personal number card, etc.

(Rule 6 ① 1, 2) (Rule 7 ①)

(Rule 8)

When it is difficult When the agent is a corporation When it is difficult
(Rule 6 ① 3) (Rule 7 ②)

(Rule 9⑤)

When the agent is a corporation difficult
Case (Rule 6②) (Rule 9①)
Special provisions of the Minister of Finance, etc.
(Rule 9②)
By phone When by phone
(Rule 9 ③) (Rule 9 ③)
A place where it is clear that you are the same person as a specific individual
(Rule 9 ④)

Ii When receiving an individual number using an electronic information processing organization
Transmission of proxy right certification information and electronic signature of the proxy, by the individual number use office worker
Confirmation with the Japan Agency for Local Authority Information Systems (Rule 10)

* If you receive your personal number by sending it in writing, you must show it above.
You must submit the documents or a copy thereof (Rule 11).

<Reference 2: Transitional measures related to the abolition of notification cards>
"Improving the convenience of those involved in administrative procedures, etc. by utilizing information and communication technology.
Information and communication in administrative procedures, etc. to simplify and improve the efficiency of administrative operations
"Law to partially revise the law concerning the use of technology" (Law No. 16 of the first year of Reiwa.

Hereinafter referred to as the "Digital Procedure Act". ) Partially enforced, so far number confirmation
Notification card that was available as a kind (according to the provisions of Article 4 of the Digital Procedure Act)
The notification card specified in Article 7, Paragraph 1 of the Number Act before the revision. ) Has been abolished.
However, transitional measures are in place, and the individual number-related office worker will notify you.
Notification card when personal number is provided by a person who has been issued a card
After the abolition date (May 25, 2nd year of Reiwa), the items described in the notification card have been changed.
As in the past, the notification card will be printed by the following method only if there is no
It can be used for person confirmation. In addition, before the abolition date, the notification card will be in charge.
If there is a change in the items described, the mayor of the municipality (including the mayor of the special ward)
If you have not taken steps to change the items listed, the transitional measures will not apply.

20

Page 24

① When receiving an individual number from the person
"Notification card" + "Identity verification documents"
(Old law (Note 1) 16) (Old regulations (Note 2) 1 ①)
Driver's license, etc. (Old Regulation 1 ① 1, 2)
Difficult case (old rule 1 ① 3)
Special Provisions of the Minister of Finance, etc. (Old Regulations 1 ③ 1 to 4)
Difficult case (old rule 1 ③ 5)
When it is clear that the person is the same as a specific individual (old rule 3⑥)

② When receiving the personal number from the person's agent
"Authority Confirmation Documents" + "Agent Identity Confirmation Documents" + "Personal Number Confirmation Documents"
(Old Ordinance (Note 3) 12②1) (Old Ordinance 12②2) (Old Ordinance 12②3)
Family register copy, personal number card, related to the person
Power of attorney, etc. Driver's license, etc.

Notification card

(Old rule 6 ① 1, 2) (Old rule 7 ①)

(Old rule 8)

When it is difficult When the agent is a corporation
(Old rule 6 ① 3) (Old rule 7 ②)
When the agent is a corporation difficult
Case (old rule 6②) (old rule 9①)
Special provisions of the Minister of Finance, etc.
(Old rule 9②)
By phone When by phone
(Old rule 9③) (Old rule 9③)
A place where it is clear that you are the same person as a specific individual
If (old rule 9④)

* If you receive your personal number by sending it in writing, you must show it above.
You must submit the documents or a copy thereof (Old Regulation 11).

(Note 1) Refers to the numbering method before amendment pursuant to the provisions of Article 4 of the "Digital Procedure Law".
(Note 2) "Act on the Use of Numbers for Identifying Specific Individuals in Administrative Procedures, etc."
Amendment by "Order to partially revise the enforcement regulations" (Reiwa 2nd year Cabinet Office / Ministry of Internal Affairs and Communications Ordinance No. 6)
Refers to the previous number law enforcement regulations.
(Note 3) "Act on the Use of Numbers for Identifying Specific Individuals in Administrative Procedures, etc."
Numbering method before revision by "Cabinet Order to partially revise the enforcement order" (Cabinet Order No. 164 of 2nd year of Reiwa)
Enforcement order.

twenty one

Page 25

4 Handling regarding suspension of provision to third parties
The point
○ It is applicable to each item of Article 19 of the Number Act that specific personal information can be provided.
Limited to cases where it fits. Therefore, specific personal information is illegally third
The person who knew that it was provided to the person requested that the provision be stopped.
If it turns out that there is a reason for the request, the third
The offer to the person must be stopped.
○ If specific personal information is handled properly, provision to third parties will be suspended.
There will be no demand for a stop.
(Related article)
・ Numbering Law, Article 30, Paragraph 3
・ Personal Information Protection Law Article 30
● Suspension of provision to a third party (Individuals who are applied by replacing with Article 30, Paragraph 3 of the Number Act)
Information Protection Law, Article 30, Paragraphs 3 and 4)
It is applicable to each item of Article 19 of the Number Act that specific personal information can be provided.
If you do not provide specific personal information in other cases
Absent. The person is a specific individual who is the retained personal data for the business operator handling personal information.
If the information is illegally provided to a third party in violation of each item of the same Article, the relevant identification
You can request the suspension of provision of personal information to a third party. Handling of personal information
When the trader receives the request, it turns out that there is a reason for the request
If you do, you must stop providing the specific personal information to a third party without delay.
Must be.
However, it is difficult to stop the provision to a third party, and the rights and interests of the person
When taking alternative measures to protect, do not stop providing to third parties
This point is the same as the handling of the conventional Personal Information Protection Law.

twenty two

Page 26

5 Specific personal information protection evaluation
● Specific Personal Information Protection Evaluation (Articles 27 and 28 of the Number Act)
Specific personal information protection evaluation is information using the information provision network system.
A business operator that cooperates with information causes leakage of specific personal information and other situations.
Analyze the desk and take appropriate steps to mitigate such risks
Is to declare.
Financial institutions are not obliged to carry out specific personal information protection evaluations, but they are responsible.
Utilizing the method of specific personal information protection evaluation is to protect specific personal information.
It is beneficial from the point of view.
* For details on the specific personal information protection evaluation, see "Rules for Specific Personal Information Protection Evaluation"
(2014 Specified Personal Information Protection Commission Rule No. 1) and "Specific Personal Information Protection Evaluation Guidelines"
Please refer to (2014 Specified Personal Information Protection Commission Notification No. 4).

twenty three

Page 27

6 Main provisions of the Personal Information Protection Law
Businesses handling personal information are as follows regarding the handling of specific personal information.
It is necessary to keep in mind that it is subject to the Personal Information Protection Law (Number Law, Article 30, Paragraph 3).
According to the section, Article 16 (3) (3) and (4) of the Personal Information Protection Law, Article 17 (2)
In addition, the provisions of Articles 23 to 26 are exempted).
A Identification of purpose of use (Article 15 of the Personal Information Protection Law)
a Identification of purpose of use (paragraph 1)
Businesses handling personal information should use it when handling personal information.
The target must be specified as much as possible.
b Change of purpose of use (Section 2)
When the business operator handling personal information changes the purpose of use, the usage before the change
Do not go beyond what is reasonably considered to be relevant to the target.
B Notification of purpose of use, etc. (Article 18 of the Personal Information Protection Law)
a Notification of purpose of use, etc. (Section 1)
When a business operator handling personal information acquires personal information, it will take advantage of it in advance.
Unless the purpose of use is announced, promptly inform the person of the purpose of use.
Must be known or published.
b Clarification of purpose of use (Section 2)
The business operator handling personal information concludes a contract with the person regardless of the provisions of a.
Contracts and other documents (including electromagnetic records; hereinafter referred to in b) accompanying the conclusion
It's the same. ) When acquiring the personal information of the person concerned Others
If you want to obtain the personal information of the person in question directly from
First of all, the purpose of use must be clearly stated to the person. However, people
If there is an urgent need to protect your life, body or property
Not.
c Notification of changed purpose of use, etc. (Section 3)
If the business operator handling personal information changes the purpose of use, the changed usage item
The person must be notified or announced about the target.
d Exemption (Section 4)
The provisions a to c apply when there is a risk of harming the rights and interests of the person, etc.
Ii Places where there is a risk of harming the rights or legitimate interests of the business operator handling personal information
In that case, the administrative agency of the country or the local public body shall carry out the affairs stipulated by the law.
If it is necessary to cooperate with, it will hinder the performance of the relevant affairs.
When there is a risk of ⅳ, it is recognized that the purpose of use is clear from the status of acquisition.
twenty four

Page 28

If it is found, it does not apply.
C Ensuring the accuracy of data content, etc. (Article 19 of the Personal Information Protection Law)
The business operator handling personal information is to the extent necessary to achieve the purpose of use.
Keep your data accurate and up-to-date and when you no longer need to use it
Must endeavor to erase the personal data without delay.
D Appropriate acquisition (Personal Information Protection Law, Article 17, Paragraph 1)
Businesses handling personal information acquire personal information by deception or other fraudulent means.
Must not be.
E Publication of matters related to retained personal data (Article 27 of the Personal Information Protection Law, personal information
Protection Law Enforcement Ordinance Article 8)
Publication of matters concerning retained personal data (Section 1)
The business operator handling personal information, regarding the retained personal data, i.
Name or name of the trader, purpose of use of all retained personal data (Bd i to iii)
Except when applicable to. ), Ⅲ Notification of purpose of use, disclosure, correction, etc.
In addition to the procedures listed in iv i to iii, such as procedures for responding to requests due to suspension, etc.
Personal information protection as a necessary matter for ensuring the proper handling of retained personal data
A state that the person can know about what is stipulated in Article 8 of the Dharmapala Enforcement Ordinance (Person's request)
Including the case of replying without delay according to the request. ) Must be placed.
b Request for notification of purpose of use (Section 2)
The business operator handling personal information is a retained personal day in which the person is identified by the person.
When requested to notify the purpose of use of the data, the person should be notified without delay.
Must be notified. However, the person concerned is identified according to the provisions of ia.
If the purpose of use of the retained personal data is clear, it corresponds to iiBd i to iii.
This does not apply if any of the cases apply.
c Notification to the person (Section 3)
The business operator handling personal information is required to collect personal data based on the provisions of b.
If you decide not to notify the purpose of use, you should notify the person without delay.
Must be notified.
F Disclosure (Article 28 of the Personal Information Protection Law, Article 9 of the Enforcement Ordinance of the Personal Information Protection Law)
a Request for disclosure (paragraph 1)
The person is a retained individual who can identify the person to the business operator handling personal information.
Disclosure of data can be requested.

twenty five

Page 29

b Disclosure (paragraph 2)
When a business operator handling personal information receives a request pursuant to the provisions of a, it will contact the person himself / herself.
However, by the method stipulated in Article 9 of the Personal Information Protection Law Enforcement Ordinance, the insurance concerned will be held without delay.
Yes Personal data must be disclosed. However, by disclosing
I. If there is a risk of harming the rights and interests of the person, etc., ii.
If there is a risk of significantly hindering the proper implementation of a person's business, iii other laws
If any of the cases that violate the decree are applicable, all or all of them
Some may not be disclosed.
c Notification to the person (Section 3)
The business operator handling personal information is all of the retained personal data related to the request pursuant to the provisions of a.
When it is decided not to disclose a part or a part, or the holding individual
If the data does not exist, you must notify the person without delay.
Must be.
d Disclosure by other laws and regulations (paragraph 4)
Corresponds to the method specified in the text of b for the person according to the provisions of other laws and regulations.
Disclose all or part of the retained personal data that identifies the person by the method
If it is supposed to be, all or part of the retained personal data
Therefore, the provisions of a and b do not apply.
G Correction, etc. (Article 29 of the Personal Information Protection Law)
a Request for correction, etc. (paragraph 1)
The person is a retained individual who can identify the person to the business operator handling personal information.
If the content of the data is not true, correct or add the content of the retained personal data.
Or you can request deletion (hereinafter referred to as "correction, etc." in G).
To
b Correction, etc. (Section 2)
When a business operator handling personal information receives a request pursuant to the provisions of a, it is among them.
Places where special procedures are stipulated by the provisions of other laws and regulations regarding correction of contents, etc.
Except for cases, the necessary investigation without delay within the range necessary to achieve the purpose of use
And based on the result, do not correct the contents of the retained personal data.
Must be.
c Notification to the person (Section 3)
The business operator handling personal information is included in the retained personal data related to the request pursuant to the provisions of a.
When you make corrections, etc. for all or part of the contents, or do not make corrections, etc.
When a decision is made to that effect, that effect (correction, etc.) will be made to the person without delay.
If so, include the contents. ) Must be notified.
26

Page 30

H Suspension of use, etc. (Article 30 of the Personal Information Protection Law)
a Request for suspension of use, etc. (Section 1)
The person is a retained individual who can identify the person to the business operator handling personal information.
Data violates the provisions of 1-⑴1B (prohibition of use of personal numbers beyond the purpose of use)
It was acquired when it was being handled or in violation of the provisions of D.
In some cases, suspension or deletion of the use of the retained personal data (hereinafter referred to as "interest" in H
Stopping, etc. " ) Can be requested.
b Suspension of use, etc. (Section 2)
The business operator handling personal information is in the case of receiving a request pursuant to the provisions of a.
Needed to correct a breach when it turns out that there is a reason for the claim
To the limit, the use of the retained personal data must be suspended without delay.
Absent. However, if a large amount of money is required to suspend the use of the retained personal data, etc.
If it is difficult to suspend the use of the service, the rights and interests of the person
This is not the case when taking alternative measures necessary to protect the
I.
c Notification to the person (Section 5)
The business operator handling personal information is all of the retained personal data related to the request pursuant to the provisions of a.
When the use of a part or part is suspended or the usage is suspended
When it is decided not to do so, or 4 (Handling regarding suspension of provision to a third party)
Regarding all or part of the retained personal data related to the request pursuant to the provisions of
Decision not to stop providing to a person or to a third party
If you do, you must notify the person without delay.
I Explanation of reason (Article 31 of the Personal Information Protection Law)
Is the business operator handling personal information the person himself / herself according to the regulations of Ec, Fc, Gc or Hc?
Take measures for all or part of the measures requested or requested
When notifying that there is no such measure or when notifying that measures different from the measures will be taken
You must try to explain the reason to the person.
J Procedures for responding to requests for disclosure, etc. (Article 32 of the Personal Information Protection Law, Implementation of the Personal Information Protection Law)
Ordinance Articles 10 and 11)
a How to accept requests for disclosure, etc. (Section 1)
The business operator handling personal information is requested by the provisions of Eb or Fa, Ga or
Request under the provisions of Ha or 4 (Handling regarding suspension of provision to a third party)
(Hereinafter, in J and Article 53, Paragraph 1 of the Personal Information Protection Law, "request for disclosure, etc."
Say. ), As stipulated in Article 10 of the Personal Information Protection Law Enforcement Ordinance,
The method of accepting a request or request can be determined. Smell in this case
Therefore, the person must make a request for disclosure, etc. in accordance with the method.
27

Page 31

b Presentation of matters sufficient to identify (Section 2)
A business operator handling personal information is subject to requests for disclosure, etc. from the person himself / herself.
It is possible to request the presentation of matters sufficient to identify the retained personal data.
To In this case, the business operator handling personal information can be easily and accurately opened by the person himself / herself.
Contribute to the identification of the retained personal data so that requests for indications, etc. can be made.
Providing information and other appropriate measures in consideration of the convenience of the person
Absent.
c Agent (Section 3)
Requests for disclosure, etc. shall be made in accordance with Article 11 of the Personal Information Protection Law Enforcement Ordinance.
Can be done by an agent.
d Consideration for the person (Section 4)
Businesses handling personal information make requests for disclosure, etc. based on the provisions a to c.
In deciding the procedure to respond, if it imposes an excessive burden on the person
Care must be taken not to.
K fee (Article 33 of the Personal Information Protection Law)
a Fee collection (paragraph 1)
Businesses handling personal information were requested to notify the purpose of use pursuant to the provisions of Eb.
At that time, or when a request for disclosure pursuant to the provisions of Fa is received, the implementation of the relevant measures
Fees can be collected for.
b Determining the amount of fees (paragraph 2)
If the business operator handling personal information collects a fee according to the provisions of a, the actual cost
To the extent that it is considered reasonable in consideration of
Must be determined.
L Advance request (Article 34 of the Personal Information Protection Law)
a Advance request (paragraph 1)
The person himself / herself is Fa, Ga or Ha or 4 (Takes regarding suspension of provision to a third party).
When attempting to file an action relating to a request pursuant to the provisions of (Handling), the action
Make the request in advance to the person who should be the defendant of
Only two weeks have passed since the date of arrival to file the complaint.
Can not. However, when the person who should be the defendant of the complaint refuses the request
Is not limited to this.
b Deemed provisions (paragraph 2)
The claim of a is that it arrived when the claim should normally have arrived
I reckon.
28

Page 32

c Applicable mutatis mutandis to the petition for provisional disposition order (paragraph 3)
The provisions of a and b are Fa, Ga or Ha or 4 (suspension of provision to a third party).
Regarding the petition for provisional disposition order pertaining to the request pursuant to the provisions of
To use.
Processing of M complaints (Article 35 of the Personal Information Protection Law)
a Complaint handling (paragraph 1)
Businesses handling personal information should promptly and appropriately make complaints regarding the handling of personal information.
You have to make an effort for proper processing.
b System maintenance (Section 2)
The business operator handling personal information is required to establish the system necessary to achieve the purpose of a.
I have to make an effort.

29

