[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"article:daisan-sha-teikyou":3},{"meta":4,"markdown":259,"quiz":260},{"type":5,"articleId":6,"slug":7,"title":8,"titleEn":9,"category":10,"order":11,"seriesLabel":12,"summary":13,"publishedAt":14,"image":15,"tags":16,"vocabulary":20,"quizId":255,"source":256},"article","kjh-k1-h04-daisan-sha-teikyou","daisan-sha-teikyou","課題Ⅰ 第４編② 第三者提供の制限 ― 同意・オプトアウト・非該当類型","Restrictions on Third-Party Provision — Complete Guide to Consent, Opt-Out, and Non-Third-Party Categories","kojin-joho-hogo\u002Fkadai-1",1042,"課題Ⅰ 第４編②","Comprehensive coverage of Article 27 restrictions on third-party provision of personal data: the general rule requiring prior consent and all methods of obtaining it (written, verbal, email, web form, implied); every exception ground under Paragraph 1 with concrete examples; the opt-out mechanism including required notification items and 2020 amendment restrictions (sensitive data, illicit acquisition, double opt-out prohibition); and the three categories not constituting third-party provision — outsourcing (with supervision obligations), business succession (with purpose-of-use constraints), and joint use (with five mandatory announcement items). Includes exam-focused callouts on key distinctions.","2026-04-26T00:00:00Z","https:\u002F\u002Fimages.yamiyomi.com\u002Fkjh-k1-h04-daisan-sha-teikyou.png",[17,18,19],"exam:個人情報保護士","topic:第三者提供","topic:オプトアウト",[21,26,30,34,38,43,47,51,55,59,63,67,71,75,79,83,87,91,95,99,103,107,111,115,119,123,127,131,135,139,143,147,151,155,159,163,167,171,175,179,183,187,191,195,199,203,207,211,215,219,223,227,231,235,239,243,247,251],{"word":22,"reading":23,"meaning":24,"level":25},"第三者","だいさんしゃ","third party","N2",{"word":27,"reading":28,"meaning":29,"level":25},"提供","ていきょう","provision, offering",{"word":31,"reading":32,"meaning":33,"level":25},"同意","どうい","consent, agreement",{"word":35,"reading":36,"meaning":37,"level":25},"原則","げんそく","principle, general rule",{"word":39,"reading":40,"meaning":41,"level":42},"承諾","しょうだく","approval, acceptance","N1",{"word":44,"reading":45,"meaning":46,"level":42},"勧告","かんこく","recommendation, warning",{"word":48,"reading":49,"meaning":50,"level":42},"黙示","もくし","implied, tacit",{"word":52,"reading":53,"meaning":54,"level":25},"利用規約","りようきやく","terms of service",{"word":56,"reading":57,"meaning":58,"level":42},"法令","ほうれい","laws and regulations",{"word":60,"reading":61,"meaning":62,"level":42},"所得税法","しょとくぜいほう","Income Tax Act",{"word":64,"reading":65,"meaning":66,"level":42},"支払調書","しはらいちょうしょ","payment record",{"word":68,"reading":69,"meaning":70,"level":42},"弁護士会照会","べんごしかいしょうかい","bar association inquiry",{"word":72,"reading":73,"meaning":74,"level":42},"嘱託","しょくたく","commission, entrustment",{"word":76,"reading":77,"meaning":78,"level":25},"生命","せいめい","life",{"word":80,"reading":81,"meaning":82,"level":25},"財産","ざいさん","property, assets",{"word":84,"reading":85,"meaning":86,"level":25},"被災者","ひさいしゃ","disaster victim",{"word":88,"reading":89,"meaning":90,"level":42},"安否","あんぴ","safety, well-being",{"word":92,"reading":93,"meaning":94,"level":25},"公衆衛生","こうしゅうえいせい","public health",{"word":96,"reading":97,"meaning":98,"level":25},"児童","じどう","children",{"word":100,"reading":101,"meaning":102,"level":42},"健全","けんぜん","sound, healthy",{"word":104,"reading":105,"meaning":106,"level":25},"育成","いくせい","upbringing, development",{"word":108,"reading":109,"meaning":110,"level":25},"感染症","かんせんしょう","infectious disease",{"word":112,"reading":113,"meaning":114,"level":42},"児童虐待","じどうぎゃくたい","child abuse",{"word":116,"reading":117,"meaning":118,"level":42},"遂行","すいこう","execution, performance",{"word":120,"reading":121,"meaning":122,"level":42},"支障","ししょう","hindrance, obstacle",{"word":124,"reading":125,"meaning":126,"level":42},"税務調査","ぜいむちょうさ","tax investigation",{"word":128,"reading":129,"meaning":130,"level":25},"捜査","そうさ","investigation",{"word":132,"reading":133,"meaning":134,"level":42},"証拠隠滅","しょうこいんめつ","destruction of evidence",{"word":136,"reading":137,"meaning":138,"level":25},"学術研究","がくじゅつけんきゅう","academic research",{"word":140,"reading":141,"meaning":142,"level":25},"届け出","とどけで","notification, filing",{"word":144,"reading":145,"meaning":146,"level":25},"公表","こうひょう","public announcement",{"word":148,"reading":149,"meaning":150,"level":42},"要配慮個人情報","ようはいりょこじんじょうほう","sensitive personal information",{"word":152,"reading":153,"meaning":154,"level":42},"信条","しんじょう","creed, beliefs",{"word":156,"reading":157,"meaning":158,"level":25},"病歴","びょうれき","medical history",{"word":160,"reading":161,"meaning":162,"level":42},"不正取得","ふせいしゅとく","illicit acquisition",{"word":164,"reading":165,"meaning":166,"level":25},"二重","にじゅう","double",{"word":168,"reading":169,"meaning":170,"level":42},"連鎖","れんさ","chain",{"word":172,"reading":173,"meaning":174,"level":25},"拡散","かくさん","spread, diffusion",{"word":176,"reading":177,"meaning":178,"level":42},"名簿業者","めいぼぎょうしゃ","directory dealer",{"word":180,"reading":181,"meaning":182,"level":42},"委託","いたく","outsourcing, entrustment",{"word":184,"reading":185,"meaning":186,"level":42},"委託先","いたくさき","contractor, outsourcing destination",{"word":188,"reading":189,"meaning":190,"level":25},"監督","かんとく","supervision",{"word":192,"reading":193,"meaning":194,"level":25},"義務","ぎむ","obligation, duty",{"word":196,"reading":197,"meaning":198,"level":42},"漏えい","ろうえい","leakage, breach",{"word":200,"reading":201,"meaning":202,"level":42},"事業承継","じぎょうしょうけい","business succession",{"word":204,"reading":205,"meaning":206,"level":25},"合併","がっぺい","merger",{"word":208,"reading":209,"meaning":210,"level":42},"会社分割","かいしゃぶんかつ","company split",{"word":212,"reading":213,"meaning":214,"level":42},"事業譲渡","じぎょうじょうと","business transfer",{"word":216,"reading":217,"meaning":218,"level":25},"継続性","けいぞくせい","continuity",{"word":220,"reading":221,"meaning":222,"level":25},"共同利用","きょうどうりよう","joint use",{"word":224,"reading":225,"meaning":226,"level":42},"管理責任者","かんりせきにんしゃ","person responsible for management",{"word":228,"reading":229,"meaning":230,"level":25},"範囲","はんい","scope, range",{"word":232,"reading":233,"meaning":234,"level":42},"頻出","ひんしゅつ","frequently appearing",{"word":236,"reading":237,"meaning":238,"level":25},"暗記","あんき","memorization",{"word":240,"reading":241,"meaning":242,"level":42},"列挙","れっきょ","enumeration",{"word":244,"reading":245,"meaning":246,"level":42},"紛争","ふんそう","dispute",{"word":248,"reading":249,"meaning":250,"level":25},"規定","きてい","provision, regulation",{"word":252,"reading":253,"meaning":254,"level":25},"顧客","こきゃく","customer, client","kjh-k1-h04-quiz",{"name":257,"url":258},"個人情報保護委員会","https:\u002F\u002Fwww.ppc.go.jp\u002Fpersonalinfo\u002Flegal\u002F","\n::heading\n[第三者]{だいさんしゃ:third party:N1}[提供]{ていきょう:provision:N1}の[制限]{せいげん:restriction, limitation:N3}（[法]{ほう:law:N3}27[条]{じょう:article:N1}）\n\n#en\nRestrictions on Third-Party Provision (Article 27)\n::\n\n::heading\n[法]{ほう:law:N3}27[条]{じょう:article:N1}1[項]{こう:paragraph:N1}：[原則]{げんそく:principle:N2} — [本人]{ほんにん:the person themselves:N5}の[同意]{どうい:consent:N4}\n\n#en\nArticle 27, Paragraph 1: The Principle — Consent of the Individual\n::\n\n::para\n[個人]{こじん:individual, personal:N2}データを[第三者]{だいさんしゃ:third party:N1}に[提供]{ていきょう:provision, offering:N1}する[場合]{ばあい:case, situation:N3}、[原則]{げんそく:principle:N2}として、あらかじめ[本人]{ほんにん:the person themselves:N5}の[同意]{どうい:consent:N4}を[得]{え:to obtain:N3}なければならない（[法]{ほう:law:N3}27[条]{じょう:article, clause:N1}1[項]{こう:paragraph, section:N1}）。これは[個人情報]{こじんじょうほう:personal information:N2}[保護法]{ほごほう:protection law:N1}における[最]{もっと:most:N3}も[基本的]{きほんてき:fundamental:N1}なルールの[一]{ひと:one:N5}つである。[個人情報]{こじんじょうほう:personal information:N2}[取扱]{とりあつかい:handling:N1}[事業者]{じぎょうしゃ:business operator:N4}が[保有]{ほゆう:possession:N1}する[個人]{こじん:personal:N2}データを[社外]{しゃがい:outside the company:N4}の[第三者]{だいさんしゃ:third party:N1}に[渡す]{わたす:to hand over:N3}ためには、[本人]{ほんにん:the person themselves:N5}がその[提供]{ていきょう:provision:N1}を[認識]{にんしき:recognition:N3}し[承諾]{しょうだく:approval, acceptance:N1}していることが[前提]{ぜんてい:premise:N1}となる。この[同意]{どうい:consent:N4}は、[本人]{ほんにん:the person themselves:N5}の[権利]{けんり:rights:N3}[利益]{りえき:interests:N1}を[保護]{ほご:protection:N1}するための[中核的]{ちゅうかくてき:core, central:N1}な[仕組み]{しくみ:mechanism:N3}であり、[違反]{いはん:violation:N3}した[場合]{ばあい:case:N3}には[個人情報]{こじんじょうほう:personal information:N2}[保護]{ほご:protection:N1}[委員会]{いいんかい:commission:N2}による[勧告]{かんこく:recommendation:N1}・[命令]{めいれい:order:N2}の[対象]{たいしょう:subject:N2}となる。\n\n#en\nWhen providing personal data to a third party, prior consent of the individual must be obtained as a general rule (Article 27, Paragraph 1). This is one of the most fundamental rules under the Act on the Protection of Personal Information. For a personal information handling business operator to pass personal data it holds to an external third party, the premise is that the individual recognizes and approves of that provision. This consent is a core mechanism for protecting the rights and interests of the individual, and violations may result in recommendations or orders from the Personal Information Protection Commission.\n::\n\n::para\n「[同意]{どうい:consent:N4}」の[取得]{しゅとく:acquisition:N3}[方法]{ほうほう:method:N3}には[特]{とく:special:N4}に[制限]{せいげん:restriction:N3}はない。[書面]{しょめん:written document:N3}（[同意書]{どういしょ:consent form:N4}への[署名]{しょめい:signature:N2}・[押印]{おういん:seal impression:N2}）、[口頭]{こうとう:verbal, oral:N3}、メール、ウェブ[上]{じょう:on:N5}のフォーム[送信]{そうしん:sending, submission:N3}、チェックボックスへの[入力]{にゅうりょく:input:N4}など、いずれも[有効]{ゆうこう:valid:N2}である。さらに、[黙示]{もくし:implied, tacit:N1}の[同意]{どうい:consent:N4}も[合理的]{ごうりてき:reasonable:N3}な[範囲]{はんい:scope:N1}で[認め]{みとめ:to permit:N3}られる。[例えば]{たとえば:for example:N3}、[利用]{りよう:use:N3}[規約]{きやく:terms of service:N3}に[第三者]{だいさんしゃ:third party:N1}[提供]{ていきょう:provision:N1}の[旨]{むね:the effect that:N1}が[明確]{めいかく:clear:N3}に[記載]{きさい:description, statement:N1}されており、[利用者]{りようしゃ:user:N3}がサービスを[利用]{りよう:use:N3}[開始]{かいし:start:N4}した[場合]{ばあい:case:N3}などは、[黙示]{もくし:implied:N1}の[同意]{どうい:consent:N4}と[解釈]{かいしゃく:interpretation:N1}できる。ただし、[後日]{ごじつ:at a later date:N5}の[紛争]{ふんそう:dispute:N1}を[避ける]{さける:to avoid:N1}ため、[記録]{きろく:record:N2}を[残す]{のこす:to leave behind:N3}ことが[望ましい]{のぞましい:desirable:N3}。\n\n#en\nThere are no particular restrictions on how consent may be obtained. Written documents (signing and sealing a consent form), verbal consent, email, web form submission, and checkbox input are all valid. Furthermore, implied (tacit) consent is also recognized within a reasonable scope. For example, if the terms of service clearly state that data will be provided to third parties and the user begins using the service, this can be interpreted as implied consent. However, it is desirable to keep records in order to avoid disputes at a later date.\n::\n\n::heading\n[同意]{どうい:consent:N4}[不要]{ふよう:unnecessary:N3}の[例外]{れいがい:exception:N3}[事由]{じゆう:reason:N3}（[法]{ほう:law:N3}27[条]{じょう:article:N1}1[項]{こう:paragraph:N1}[各号]{かくごう:each item:N2}）\n\n#en\nException Grounds Where Consent Is Not Required (Article 27, Paragraph 1, Each Item)\n::\n\n::para\nただし、[法]{ほう:law:N3}27[条]{じょう:article:N1}1[項]{こう:paragraph:N1}[各号]{かくごう:each item:N2}に[定める]{さだめる:to stipulate:N3}[例外]{れいがい:exception:N3}[事由]{じゆう:reason, grounds:N3}に[該当]{がいとう:to apply:N1}する[場合]{ばあい:case:N3}は、[本人]{ほんにん:the person themselves:N5}の[同意]{どうい:consent:N4}なく[第三者]{だいさんしゃ:third party:N1}[提供]{ていきょう:provision:N1}が[可能]{かのう:possible:N3}である。[第]{だい:number:N1}1[号]{ごう:item:N3}は、[法令]{ほうれい:laws and regulations:N2}に[基づく]{もとづく:based on:N1}[場合]{ばあい:case:N3}である。[具体的]{ぐたいてき:specific, concrete:N3}には、[所得税法]{しょとくぜいほう:Income Tax Act:N2}に[基づく]{もとづく:based on:N1}[支払]{しはらい:payment:N3}[調書]{ちょうしょ:report, record:N3}の[提出]{ていしゅつ:submission:N1}、[弁護士会]{べんごしかい:bar association:N1}[照会]{しょうかい:inquiry:N2}（[弁護士法]{べんごしほう:Attorneys Act:N1}23[条]{じょう:article:N1}の2）、[裁判所]{さいばんしょ:court:N1}の[嘱託]{しょくたく:commission, entrustment:N1}による[調査]{ちょうさ:investigation:N2}[回答]{かいとう:response:N3}などがこれに[該当]{がいとう:to apply:N1}する。\n\n#en\nHowever, when the exception grounds stipulated in each item of Article 27, Paragraph 1 apply, third-party provision is possible without the individual's consent. Item 1 covers cases based on laws and regulations. Specifically, this includes submission of payment records under the Income Tax Act, inquiries from bar associations (Article 23-2 of the Attorneys Act), and responses to court-commissioned investigations.\n::\n\n::para\n[第]{だい:number:N1}2[号]{ごう:item:N3}は、[人]{ひと:person:N5}の[生命]{せいめい:life:N3}、[身体]{しんたい:body:N4}[又]{また:or:N1}は[財産]{ざいさん:property:N3}の[保護]{ほご:protection:N1}に[必要]{ひつよう:necessary:N3}がある[場合]{ばあい:case:N3}であって、[本人]{ほんにん:the person themselves:N5}の[同意]{どうい:consent:N4}を[得る]{える:to obtain:N3}ことが[困難]{こんなん:difficult:N3}なときである。[例えば]{たとえば:for example:N3}、[大]{おお:large:N5}[規模]{きぼ:scale:N1}[災害]{さいがい:disaster:N1}の[発生]{はっせい:occurrence:N4}[時]{じ:time, when:N5}に、[被災者]{ひさいしゃ:disaster victim:N1}の[安否]{あんぴ:safety, well-being:N3}[情報]{じょうほう:information:N3}を[自治体]{じちたい:local government:N3}や[医療]{いりょう:medical:N2}[機関]{きかん:institution:N3}に[提供]{ていきょう:provision:N1}する[場合]{ばあい:case:N3}がこれに[当たる]{あたる:to correspond to:N3}。[本人]{ほんにん:the person themselves:N5}が[意識]{いしき:consciousness:N3}[不明]{ふめい:unknown, unclear:N4}の[状態]{じょうたい:state:N1}で[同意]{どうい:consent:N4}を[取得]{しゅとく:acquisition:N3}できない[場合]{ばあい:case:N3}も[含まれる]{ふくまれる:to be included:N2}。\n\n#en\nItem 2 covers cases where it is necessary for the protection of a person's life, body, or property, and obtaining the individual's consent is difficult. For example, providing safety and well-being information about disaster victims to local governments or medical institutions during a large-scale disaster falls under this category. This also includes cases where the individual is unconscious and consent cannot be obtained.\n::\n\n::para\n[第]{だい:number:N1}3[号]{ごう:item:N3}は、[公衆]{こうしゅう:public:N1}[衛生]{えいせい:hygiene, health:N1}の[向上]{こうじょう:improvement:N3}[又]{また:or:N1}は[児童]{じどう:children:N2}の[健全]{けんぜん:sound, healthy:N1}な[育成]{いくせい:upbringing, development:N3}の[推進]{すいしん:promotion:N1}に[特に]{とくに:especially:N4}[必要]{ひつよう:necessary:N3}がある[場合]{ばあい:case:N3}であって、[本人]{ほんにん:the person themselves:N5}の[同意]{どうい:consent:N4}を[得る]{える:to obtain:N3}ことが[困難]{こんなん:difficult:N3}なときである。[例えば]{たとえば:for example:N3}、[感染症]{かんせんしょう:infectious disease:N1}の[発生]{はっせい:occurrence:N4}を[保健所]{ほけんじょ:health center:N1}に[報告]{ほうこく:report:N3}する[場合]{ばあい:case:N3}や、[児童]{じどう:children:N2}[虐待]{ぎゃくたい:abuse:N1}の[疑い]{うたがい:suspicion:N3}がある[場合]{ばあい:case:N3}に[児童]{じどう:children:N2}[相談所]{そうだんじょ:consultation center:N3}に[通告]{つうこく:notification, report:N3}する[場合]{ばあい:case:N3}が[典型]{てんけい:typical:N1}[例]{れい:example:N3}である。\n\n#en\nItem 3 covers cases where it is especially necessary for the improvement of public health or the promotion of the sound upbringing of children, and obtaining the individual's consent is difficult. Typical examples include reporting the occurrence of an infectious disease to a public health center, or notifying a child consultation center when there is suspicion of child abuse.\n::\n\n::para\n[第]{だい:number:N1}4[号]{ごう:item:N3}は、[国]{くに:nation, country:N5}の[機関]{きかん:institution, agency:N3}もしくは[地方]{ちほう:local:N4}[公共]{こうきょう:public:N3}[団体]{だんたい:organization:N2}[又]{また:or:N1}はその[委託]{いたく:entrustment:N1}を[受けた]{うけた:received:N3}[者]{もの:person, party:N4}が[法令]{ほうれい:laws and regulations:N2}の[定める]{さだめる:to stipulate:N3}[事務]{じむ:affairs, duties:N3}を[遂行]{すいこう:execution, performance:N1}することに[対]{たい:toward:N3}して[協力]{きょうりょく:cooperation:N2}する[必要]{ひつよう:necessary:N3}がある[場合]{ばあい:case:N3}であって、[本人]{ほんにん:the person themselves:N5}の[同意]{どうい:consent:N4}を[得る]{える:to obtain:N3}ことにより[当該]{とうがい:the relevant:N1}[事務]{じむ:affairs:N3}の[遂行]{すいこう:execution:N1}に[支障]{ししょう:hindrance, obstacle:N1}を[及ぼす]{およぼす:to exert, cause:N1}おそれがあるときである。[例えば]{たとえば:for example:N3}、[税務]{ぜいむ:tax affairs:N2}[調査]{ちょうさ:investigation:N2}への[回答]{かいとう:response:N3}や、[警察]{けいさつ:police:N3}の[捜査]{そうさ:investigation:N2}[関係]{かんけい:related:N3}[事項]{じこう:matters:N1}[照会]{しょうかい:inquiry:N2}（[刑事]{けいじ:criminal:N1}[訴訟法]{そしょうほう:procedure law:N1}197[条]{じょう:article:N1}2[項]{こう:paragraph:N1}）への[対応]{たいおう:response, handling:N1}が[該当]{がいとう:to apply:N1}する。[本人]{ほんにん:the person themselves:N5}に[同意]{どうい:consent:N4}を[求める]{もとめる:to request:N3}と[捜査]{そうさ:investigation:N2}[対象者]{たいしょうしゃ:person targeted:N2}が[証拠]{しょうこ:evidence:N1}を[隠滅]{いんめつ:destruction:N1}するおそれがあるからである。\n\n#en\nItem 4 covers cases where cooperation is necessary for a national agency, local government, or a party entrusted by them to carry out duties prescribed by law, and obtaining the individual's consent would impede the performance of those duties. For example, this includes responding to tax investigations and cooperating with police inquiry requests (Article 197, Paragraph 2 of the Code of Criminal Procedure). This is because requesting consent from the individual might cause the investigation target to destroy evidence.\n::\n\n::para\nさらに、2020[年]{ねん:year:N5}（[令和]{れいわ:Reiwa:N2}2[年]{ねん:year:N5}）[改正]{かいせい:amendment:N2}により、[学術]{がくじゅつ:academic:N3}[研究]{けんきゅう:research:N4}[目的]{もくてき:purpose:N4}の[場合]{ばあい:case:N3}も[例外]{れいがい:exception:N3}[事由]{じゆう:reason:N3}として[整理]{せいり:organization, arrangement:N1}された。[大学]{だいがく:university:N5}その[他]{た:other:N3}の[学術]{がくじゅつ:academic:N3}[研究]{けんきゅう:research:N4}を[目的]{もくてき:purpose:N4}とする[機関]{きかん:institution:N3}もしくはそれに[属する]{ぞくする:to belong to:N1}[者]{もの:person:N4}が[学術]{がくじゅつ:academic:N3}[研究]{けんきゅう:research:N4}の[用]{よう:for:N4}に[供する]{きょうする:to provide for:N3}[目的]{もくてき:purpose:N4}で[個人]{こじん:personal:N2}データを[取り扱う]{とりあつかう:to handle:N1}[必要]{ひつよう:necessity:N3}がある[場合]{ばあい:case:N3}がこれに[該当]{がいとう:to apply:N1}する。\n\n#en\nFurthermore, through the 2020 (Reiwa 2) amendment, cases for academic research purposes were also organized as exception grounds. This applies when universities or other institutions whose purpose is academic research, or individuals belonging to them, need to handle personal data for the purpose of serving academic research.\n::\n\n::callout\n[注意]{ちゅうい:attention, caution:N4}：これらの[例外]{れいがい:exception:N3}[事由]{じゆう:reason:N3}は[法]{ほう:law:N3}18[条]{じょう:article:N1}（[利用]{りよう:use:N3}[目的]{もくてき:purpose:N4}による[制限]{せいげん:restriction:N3}）の[例外]{れいがい:exception:N3}[事由]{じゆう:reason:N3}とほぼ[同]{おな:same:N4}じだが、[微妙]{びみょう:subtle:N1}に[異なる]{ことなる:to differ:N1}。[法]{ほう:law:N3}18[条]{じょう:article:N1}は[利用]{りよう:use:N3}[目的]{もくてき:purpose:N4}の[変更]{へんこう:change:N3}に[関]{かん:related:N3}する[制限]{せいげん:restriction:N3}であり、[法]{ほう:law:N3}27[条]{じょう:article:N1}は[第三者]{だいさんしゃ:third party:N1}[提供]{ていきょう:provision:N1}に[関]{かん:related:N3}する[制限]{せいげん:restriction:N3}である。[試験]{しけん:exam:N4}ではこの[違い]{ちがい:difference:N3}が[問われる]{とわれる:to be asked:N4}ことがある。[特に]{とくに:especially:N4}、[条文]{じょうぶん:text of a law:N1}の[番号]{ばんごう:number:N3}と[適用]{てきよう:application:N3}[場面]{ばめん:scene, situation:N3}を[正確]{せいかく:accurate:N3}に[区別]{くべつ:distinction:N2}できるようにしておくこと。\n\n#en\nCaution: These exception grounds are almost the same as those under Article 18 (restrictions based on purpose of use), but differ subtly. Article 18 concerns restrictions on changing the purpose of use, while Article 27 concerns restrictions on third-party provision. The exam may test this difference. In particular, be sure you can accurately distinguish the article numbers and the situations in which each applies.\n::\n\n::heading\nオプトアウトによる[第三者]{だいさんしゃ:third party:N1}[提供]{ていきょう:provision:N1}（[法]{ほう:law:N3}27[条]{じょう:article:N1}2～4[項]{こう:paragraph:N1}）\n\n#en\nThird-Party Provision via Opt-Out (Article 27, Paragraphs 2-4)\n::\n\n::para\n[法]{ほう:law:N3}27[条]{じょう:article:N1}2～4[項]{こう:paragraph:N1}は、オプトアウト[方式]{ほうしき:method, format:N3}による[第三者]{だいさんしゃ:third party:N1}[提供]{ていきょう:provision:N1}を[定めて]{さだめて:to stipulate:N3}いる。オプトアウトとは、[本人]{ほんにん:the person themselves:N5}の[事前]{じぜん:prior:N4}の[同意]{どうい:consent:N4}を[得]{え:to obtain:N3}ずに[個人]{こじん:personal:N2}データを[第三者]{だいさんしゃ:third party:N1}に[提供]{ていきょう:provision:N1}できる[仕組み]{しくみ:mechanism:N3}であるが、[本人]{ほんにん:the person themselves:N5}が[求めた]{もとめた:requested:N3}[場合]{ばあい:case:N3}にはその[提供]{ていきょう:provision:N1}を[停止]{ていし:cessation, stop:N2}しなければならないという[条件]{じょうけん:condition:N1}が[付く]{つく:to be attached:N3}。つまり、「[嫌]{いや:dislike:N1}なら[断]{ことわ:to refuse:N3}れる」という[形]{かたち:form:N3}で[本人]{ほんにん:the person themselves:N5}の[自己]{じこ:self:N1}[決定権]{けっていけん:right of determination:N3}を[担保]{たんぽ:guarantee, collateral:N1}している。\n\n#en\nArticle 27, Paragraphs 2 through 4 establish third-party provision through the opt-out mechanism. Opt-out is a mechanism that allows personal data to be provided to third parties without the individual's prior consent, but with the condition that provision must be stopped if the individual requests it. In other words, it guarantees the individual's right of self-determination in the form of \"you can refuse if you don't want it.\"\n::\n\n::para\nオプトアウト[方式]{ほうしき:method:N3}を[利用]{りよう:use:N3}するためには、2つの[手続]{てつづき:procedure:N3}が[必要]{ひつよう:necessary:N3}である。[第]{だい:number:N1}[一]{いち:one:N5}に、あらかじめ[個人情報]{こじんじょうほう:personal information:N2}[保護]{ほご:protection:N1}[委員会]{いいんかい:commission:N2}に[届け出]{とどけで:notification, filing:N2}ること。[第]{だい:number:N1}[二]{に:two:N5}に、[所定]{しょてい:prescribed, specified:N3}の[事項]{じこう:matters:N1}を[公表]{こうひょう:public announcement:N3}すること、または[本人]{ほんにん:the person themselves:N5}に[通知]{つうち:notification:N4}し、もしくは[本人]{ほんにん:the person themselves:N5}が[容易]{ようい:easy:N3}に[知り得る]{しりうる:able to know:N3}[状態]{じょうたい:state:N1}に[置く]{おく:to put:N3}ことである。この2つの[要件]{ようけん:requirement:N3}を[満たさ]{みたさ:to satisfy:N3}なければ、オプトアウトによる[提供]{ていきょう:provision:N1}は[認め]{みとめ:to permit:N3}られない。\n\n#en\nTo use the opt-out mechanism, two procedures are required. First, a notification must be filed with the Personal Information Protection Commission in advance. Second, prescribed matters must be publicly announced, or the individual must be notified, or the information must be placed in a state where the individual can easily learn of it. If these two requirements are not met, provision through opt-out is not permitted.\n::\n\n::para\n[公表]{こうひょう:public announcement:N3}すべき[事項]{じこう:matters:N1}は[以下]{いか:the following:N4}のとおりである。（1）[個人情報]{こじんじょうほう:personal information:N2}[取扱]{とりあつかい:handling:N1}[事業者]{じぎょうしゃ:business operator:N4}の[氏名]{しめい:name:N1}[又]{また:or:N1}は[名称]{めいしょう:name, title:N1}および[住所]{じゅうしょ:address:N3}ならびに[法人]{ほうじん:corporation:N3}にあってはその[代表者]{だいひょうしゃ:representative:N3}の[氏名]{しめい:name:N1}。（2）[第三者]{だいさんしゃ:third party:N1}[提供]{ていきょう:provision:N1}を[利用]{りよう:use:N3}[目的]{もくてき:purpose:N4}とすること。（3）[提供]{ていきょう:provision:N1}される[個人]{こじん:personal:N2}データの[項目]{こうもく:item, category:N1}。（4）[提供]{ていきょう:provision:N1}の[方法]{ほうほう:method:N3}。（5）[本人]{ほんにん:the person themselves:N5}の[求め]{もとめ:request:N3}に[応じて]{おうじて:in response to:N1}[提供]{ていきょう:provision:N1}を[停止]{ていし:cessation:N2}すること。（6）[本人]{ほんにん:the person themselves:N5}の[求め]{もとめ:request:N3}を[受け付ける]{うけつける:to accept:N3}[方法]{ほうほう:method:N3}。\n\n#en\nThe matters that must be publicly announced are as follows: (1) the name and address of the personal information handling business operator, and in the case of a corporation, the name of its representative; (2) that the purpose of use includes third-party provision; (3) the categories of personal data to be provided; (4) the method of provision; (5) that provision will be stopped at the individual's request; and (6) the method for accepting the individual's requests.\n::\n\n::para\n2020[年]{ねん:year:N5}[改正]{かいせい:amendment:N2}（[令和]{れいわ:Reiwa:N2}2[年]{ねん:year:N5}[改正]{かいせい:amendment:N2}）により、オプトアウト[方式]{ほうしき:method:N3}の[利用]{りよう:use:N3}に[重要]{じゅうよう:important:N3}な[制限]{せいげん:restriction:N3}が[加え]{くわえ:to add:N3}られた。[以下]{いか:the following:N4}の3つの[類型]{るいけい:type, category:N2}の[個人]{こじん:personal:N2}データについては、オプトアウトによる[第三者]{だいさんしゃ:third party:N1}[提供]{ていきょう:provision:N1}が[禁止]{きんし:prohibition:N2}されている。[第]{だい:number:N1}[一]{いち:one:N5}に、[要配慮]{ようはいりょ:requiring special care:N1}[個人情報]{こじんじょうほう:personal information:N2}。[人種]{じんしゅ:race:N3}、[信条]{しんじょう:creed, beliefs:N1}、[病歴]{びょうれき:medical history:N2}、[犯罪]{はんざい:crime:N3}[歴]{れき:history:N2}など、[不当]{ふとう:unjust:N3}な[差別]{さべつ:discrimination:N3}を[生じさせる]{しょうじさせる:to cause:N5}おそれのある[情報]{じょうほう:information:N3}はオプトアウトで[提供]{ていきょう:provision:N1}できない。[第]{だい:number:N1}[二]{に:two:N5}に、[不正]{ふせい:illicit, wrongful:N4}に[取得]{しゅとく:acquisition:N3}された[個人]{こじん:personal:N2}データ。[第]{だい:number:N1}[三]{さん:three:N5}に、オプトアウトにより[他]{た:other:N3}の[事業者]{じぎょうしゃ:business operator:N4}から[取得]{しゅとく:acquisition:N3}した[個人]{こじん:personal:N2}データである。この[第]{だい:number:N1}[三]{さん:three:N5}の[制限]{せいげん:restriction:N3}は「[二重]{にじゅう:double:N4}オプトアウトの[禁止]{きんし:prohibition:N2}」と[呼ばれ]{よばれ:to be called:N3}、[個人]{こじん:personal:N2}データがオプトアウトの[連鎖]{れんさ:chain:N1}で[際限]{さいげん:limit:N3}なく[拡散]{かくさん:spread:N1}することを[防ぐ]{ふせぐ:to prevent:N2}[趣旨]{しゅし:purpose, intent:N1}である。\n\n#en\nThe 2020 amendment (Reiwa 2 amendment) added important restrictions on the use of the opt-out mechanism. The following three types of personal data are prohibited from being provided to third parties via opt-out. First, sensitive personal information — information such as race, creed, medical history, and criminal record that may give rise to unjust discrimination cannot be provided via opt-out. Second, personal data obtained through illicit means. Third, personal data obtained from other business operators via opt-out. This third restriction is called the \"prohibition of double opt-out\" and is intended to prevent personal data from spreading endlessly through a chain of opt-outs.\n::\n\n::para\n[個人情報]{こじんじょうほう:personal information:N2}[保護]{ほご:protection:N1}[委員会]{いいんかい:commission:N2}は、オプトアウトの[届出]{とどけで:notification:N2}を[受けた]{うけた:received:N3}[事業者]{じぎょうしゃ:business operator:N4}の[一覧]{いちらん:list:N1}を[公表]{こうひょう:public announcement:N3}する[義務]{ぎむ:obligation:N1}がある（[法]{ほう:law:N3}27[条]{じょう:article:N1}4[項]{こう:paragraph:N1}）。これにより、[消費者]{しょうひしゃ:consumer:N3}は、どの[事業者]{じぎょうしゃ:business operator:N4}がオプトアウトを[利用]{りよう:use:N3}しているかを[確認]{かくにん:confirmation:N3}できる。\n\n#en\nThe Personal Information Protection Commission is obligated to publicly announce a list of business operators that have filed opt-out notifications (Article 27, Paragraph 4). This allows consumers to check which business operators are using the opt-out mechanism.\n::\n\n::callout\nオプトアウトを[利用]{りよう:use:N3}する[典型的]{てんけいてき:typical:N1}な[事業者]{じぎょうしゃ:business operator:N4}は[名簿]{めいぼ:directory, register:N1}[業者]{ぎょうしゃ:dealer, trader:N4}である。[名簿]{めいぼ:register:N1}[業者]{ぎょうしゃ:dealer:N4}は、[住所]{じゅうしょ:address:N3}・[氏名]{しめい:name:N1}・[電話番号]{でんわばんごう:phone number:N3}などの[個人]{こじん:personal:N2}データを[収集]{しゅうしゅう:collection:N3}し、それを[第三者]{だいさんしゃ:third party:N1}に[販売]{はんばい:sale:N2}するビジネスモデルを[持つ]{もつ:to have:N4}。[試験]{しけん:exam:N4}では、「オプトアウトを[利用]{りよう:use:N3}できるのはどのような[事業者]{じぎょうしゃ:business operator:N4}か」という[形式]{けいしき:format, form:N3}で[出題]{しゅつだい:to set a question:N4}されることがある。\n\n#en\nThe typical business operators that use the opt-out mechanism are directory (name list) dealers. These dealers have a business model of collecting personal data such as addresses, names, and phone numbers, and selling it to third parties. The exam may ask in the format: \"What kind of business operators can use the opt-out mechanism?\"\n::\n\n::heading\n「[第三者]{だいさんしゃ:third party:N1}」に[該当]{がいとう:to correspond, apply:N1}しない[場合]{ばあい:case:N3}（[法]{ほう:law:N3}27[条]{じょう:article:N1}5[項]{こう:paragraph:N1}）\n\n#en\nCases That Do Not Constitute a \"Third Party\" (Article 27, Paragraph 5)\n::\n\n::para\n[法]{ほう:law:N3}27[条]{じょう:article:N1}5[項]{こう:paragraph:N1}は、[形式的]{けいしきてき:formal:N3}には[個人]{こじん:personal:N2}データが[外部]{がいぶ:external:N3}に[移転]{いてん:transfer:N2}するものの、「[第三者]{だいさんしゃ:third party:N1}」には[該当]{がいとう:to apply:N1}しないとされる3つの[類型]{るいけい:type:N2}を[規定]{きてい:provision:N3}している。これらの[場合]{ばあい:case:N3}は、[本人]{ほんにん:the person themselves:N5}の[同意]{どうい:consent:N4}も、オプトアウトの[手続]{てつづき:procedure:N3}も[不要]{ふよう:unnecessary:N3}である。ただし、それぞれに[固有]{こゆう:inherent:N2}の[義務]{ぎむ:obligation:N1}や[条件]{じょうけん:condition:N1}が[課されて]{かされて:imposed:N2}いる。\n\n#en\nArticle 27, Paragraph 5 provides for three types of cases where personal data formally moves externally but the recipient is not deemed a \"third party.\" In these cases, neither consent from the individual nor the opt-out procedure is required. However, each type has its own inherent obligations and conditions.\n::\n\n::para\n[第]{だい:number:N1}1[号]{ごう:item:N3}：[委託]{いたく:outsourcing, entrustment:N1}。[個人]{こじん:personal:N2}データの[取扱い]{とりあつかい:handling:N1}の[全部]{ぜんぶ:all:N3}[又]{また:or:N1}は[一部]{いちぶ:part:N3}を[委託]{いたく:outsourcing:N1}する[場合]{ばあい:case:N3}、[委託先]{いたくさき:contractor:N1}は[第三者]{だいさんしゃ:third party:N1}に[該当]{がいとう:to apply:N1}しない。[例えば]{たとえば:for example:N3}、[給与]{きゅうよ:salary:N3}[計算]{けいさん:calculation:N2}を[外部]{がいぶ:external:N3}の[社会]{しゃかい:social:N4}[保険]{ほけん:insurance:N1}[労務士]{ろうむし:labor and social security attorney:N1}に[委託]{いたく:outsourcing:N1}する[場合]{ばあい:case:N3}、クラウドサービス[事業者]{じぎょうしゃ:business operator:N4}にデータ[処理]{しょり:processing:N3}を[委託]{いたく:outsourcing:N1}する[場合]{ばあい:case:N3}、ダイレクトメールの[発送]{はっそう:dispatch:N4}を[外部]{がいぶ:external:N3}[業者]{ぎょうしゃ:dealer:N4}に[委託]{いたく:outsourcing:N1}する[場合]{ばあい:case:N3}などが[典型]{てんけい:typical:N1}[例]{れい:example:N3}である。\n\n#en\nItem 1: Outsourcing (entrustment). When the handling of personal data is outsourced in whole or in part, the contractor does not constitute a third party. For example, outsourcing salary calculation to an external labor and social security attorney, outsourcing data processing to a cloud service provider, or outsourcing the dispatch of direct mail to an external vendor are typical examples.\n::\n\n::para\nただし、[委託]{いたく:outsourcing:N1}の[場合]{ばあい:case:N3}、[委託]{いたく:outsourcing:N1}[元]{もと:source:N4}は[法]{ほう:law:N3}25[条]{じょう:article:N1}に[基づき]{もとづき:based on:N1}、[委託先]{いたくさき:contractor:N1}に[対する]{たいする:toward:N3}[必要]{ひつよう:necessary:N3}かつ[適切]{てきせつ:appropriate:N3}な[監督]{かんとく:supervision:N1}を[行う]{おこなう:to carry out:N5}[義務]{ぎむ:obligation:N1}を[負う]{おう:to bear:N3}。[具体的]{ぐたいてき:specifically:N3}には、[委託]{いたく:outsourcing:N1}[契約]{けいやく:contract:N1}において[安全]{あんぜん:safety:N3}[管理]{かんり:management:N2}[措置]{そち:measure:N1}の[内容]{ないよう:content:N3}を[明確]{めいかく:clear:N3}にし、[委託先]{いたくさき:contractor:N1}における[取扱い]{とりあつかい:handling:N1}[状況]{じょうきょう:situation:N2}を[把握]{はあく:grasp, understanding:N1}することが[求め]{もとめ:to require:N3}られる。[委託先]{いたくさき:contractor:N1}が[漏えい]{ろうえい:leakage:N1}[事故]{じこ:incident:N1}を[起こした]{おこした:caused:N4}[場合]{ばあい:case:N3}、[監督]{かんとく:supervision:N1}[義務]{ぎむ:obligation:N1}を[怠って]{おこたって:to neglect:N1}いた[委託]{いたく:outsourcing:N1}[元]{もと:source:N4}も[責任]{せきにん:responsibility:N3}を[問われ]{とわれ:to be questioned:N4}うる。\n\n#en\nHowever, in the case of outsourcing, the outsourcing party bears an obligation under Article 25 to exercise necessary and appropriate supervision over the contractor. Specifically, the content of safety management measures must be made clear in the outsourcing contract, and the outsourcing party must understand the handling situation at the contractor. If the contractor causes a data breach, the outsourcing party that neglected its supervision obligation may also be held responsible.\n::\n\n::para\n[第]{だい:number:N1}2[号]{ごう:item:N3}：[事業]{じぎょう:business:N4}[承継]{しょうけい:succession, transfer:N1}。[合併]{がっぺい:merger:N1}、[会社]{かいしゃ:company:N4}[分割]{ぶんかつ:split, division:N3}、[事業]{じぎょう:business:N4}[譲渡]{じょうと:transfer:N1}などにより[事業]{じぎょう:business:N4}が[承継]{しょうけい:succession:N1}される[場合]{ばあい:case:N3}、[個人]{こじん:personal:N2}データは[事業]{じぎょう:business:N4}とともに[移転]{いてん:transfer:N2}する。[承継先]{しょうけいさき:successor:N1}は[第三者]{だいさんしゃ:third party:N1}に[該当]{がいとう:to apply:N1}しない。これは[事業]{じぎょう:business:N4}の[継続性]{けいぞくせい:continuity:N1}を[確保]{かくほ:to secure:N1}し、M&Aなどの[円滑]{えんかつ:smooth:N1}な[実施]{じっし:implementation:N1}を[可能]{かのう:possible:N3}にするための[規定]{きてい:provision:N3}である。\n\n#en\nItem 2: Business succession. When a business is succeeded through a merger, company split, business transfer, or similar event, personal data transfers together with the business. The successor does not constitute a third party. This is a provision to ensure business continuity and enable the smooth implementation of M&A and similar transactions.\n::\n\n::para\nただし、[承継先]{しょうけいさき:successor:N1}は、[承継]{しょうけい:succession:N1}[前]{まえ:before:N5}の[利用]{りよう:use:N3}[目的]{もくてき:purpose:N4}の[範囲]{はんい:scope:N1}[内]{ない:within:N3}で[個人]{こじん:personal:N2}データを[取り扱わ]{とりあつかわ:to handle:N1}なければならない。[合併]{がっぺい:merger:N1}によって[取得]{しゅとく:acquisition:N3}した[個人]{こじん:personal:N2}データを、[元]{もと:original:N4}の[利用]{りよう:use:N3}[目的]{もくてき:purpose:N4}と[全く]{まったく:completely:N3}[異なる]{ことなる:to differ:N1}[目的]{もくてき:purpose:N4}で[利用]{りよう:use:N3}する[場合]{ばあい:case:N3}は、[改めて]{あらためて:anew, again:N2}[本人]{ほんにん:the person themselves:N5}の[同意]{どうい:consent:N4}を[取得]{しゅとく:acquisition:N3}するか、[利用]{りよう:use:N3}[目的]{もくてき:purpose:N4}の[変更]{へんこう:change:N3}[手続]{てつづき:procedure:N3}を[経る]{へる:to go through:N3}[必要]{ひつよう:necessity:N3}がある。\n\n#en\nHowever, the successor must handle personal data within the scope of the purpose of use prior to the succession. If personal data acquired through a merger is used for a purpose completely different from the original purpose of use, it is necessary to either obtain the individual's consent anew or go through the procedure for changing the purpose of use.\n::\n\n::para\n[第]{だい:number:N1}3[号]{ごう:item:N3}：[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}。[特定]{とくてい:specific:N3}の[者]{もの:party:N4}との[間]{あいだ:between:N5}で[共同]{きょうどう:joint:N3}して[個人]{こじん:personal:N2}データを[利用]{りよう:use:N3}する[場合]{ばあい:case:N3}、[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}する[者]{もの:party:N4}は[第三者]{だいさんしゃ:third party:N1}に[該当]{がいとう:to apply:N1}しない。グループ[企業]{きぎょう:company:N1}[間]{かん:between:N5}での[顧客]{こきゃく:customer:N1}データの[共有]{きょうゆう:sharing:N3}や、[同業者]{どうぎょうしゃ:industry peers:N4}[間]{かん:between:N5}での[情報]{じょうほう:information:N3}[共有]{きょうゆう:sharing:N3}が[典型]{てんけい:typical:N1}[例]{れい:example:N3}である。\n\n#en\nItem 3: Joint use. When personal data is used jointly with specified parties, those joint-use parties do not constitute a third party. Sharing customer data among group companies or sharing information among industry peers are typical examples.\n::\n\n::para\n[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}を[行う]{おこなう:to carry out:N5}ためには、[以下]{いか:the following:N4}の5つの[事項]{じこう:matters:N1}をあらかじめ[本人]{ほんにん:the person themselves:N5}に[通知]{つうち:notification:N4}するか、[本人]{ほんにん:the person themselves:N5}が[容易]{ようい:easy:N3}に[知り得る]{しりうる:able to know:N3}[状態]{じょうたい:state:N1}に[置か]{おか:to put:N3}なければならない。（1）[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}をする[旨]{むね:the effect that:N1}。（2）[共同]{きょうどう:joint:N3}して[利用]{りよう:use:N3}される[個人]{こじん:personal:N2}データの[項目]{こうもく:item:N1}。（3）[共同]{きょうどう:joint:N3}して[利用]{りよう:use:N3}する[者]{もの:party:N4}の[範囲]{はんい:scope:N1}。（4）[利用]{りよう:use:N3}する[者]{もの:party:N4}の[利用]{りよう:use:N3}[目的]{もくてき:purpose:N4}。（5）[当該]{とうがい:the relevant:N1}[個人]{こじん:personal:N2}データの[管理]{かんり:management:N2}について[責任]{せきにん:responsibility:N3}を[有する]{ゆうする:to have:N4}[者]{もの:party:N4}の[氏名]{しめい:name:N1}[又]{また:or:N1}は[名称]{めいしょう:name, title:N1}および[住所]{じゅうしょ:address:N3}ならびに[法人]{ほうじん:corporation:N3}にあってはその[代表者]{だいひょうしゃ:representative:N3}の[氏名]{しめい:name:N1}。\n\n#en\nTo carry out joint use, the following five matters must be notified to the individual in advance, or placed in a state where the individual can easily learn of them: (1) that joint use will take place; (2) the categories of personal data to be jointly used; (3) the scope of the parties who will jointly use the data; (4) the purpose of use by those parties; and (5) the name and address of the party responsible for managing the personal data, and in the case of a corporation, the name of its representative.\n::\n\n::callout\n[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}の[公表]{こうひょう:public announcement:N3}[事項]{じこう:matters:N1}は5つ — [試験]{しけん:exam:N4}では「[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}にあたって[公表]{こうひょう:public announcement:N3}しなければならない[事項]{じこう:matters:N1}はどれか」という[形式]{けいしき:format:N3}で[頻出]{ひんしゅつ:frequently appearing:N1}する。[特に]{とくに:especially:N4}、（5）の[管理]{かんり:management:N2}[責任者]{せきにんしゃ:person in charge:N3}の[名称]{めいしょう:name:N1}は[見落とし]{みおとし:oversight:N3}やすい[項目]{こうもく:item:N1}なので[注意]{ちゅうい:caution:N4}すること。\n\n#en\nThere are five matters that must be publicly announced for joint use — the exam frequently asks \"Which items must be publicly announced for joint use?\" In particular, item (5), the name of the management responsible party, is an item that is easy to overlook, so be careful.\n::\n\n::callout\n[委託]{いたく:outsourcing:N1}と[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}の[違い]{ちがい:difference:N3}は[試験]{しけん:exam:N4}[頻出]{ひんしゅつ:frequently appearing:N1}テーマである。[委託]{いたく:outsourcing:N1}の[場合]{ばあい:case:N3}、[委託]{いたく:outsourcing:N1}[元]{もと:source:N4}が[引き続き]{ひきつづき:continuously:N3}[責任]{せきにん:responsibility:N3}を[負い]{おい:to bear:N3}、[委託先]{いたくさき:contractor:N1}を[監督]{かんとく:supervision:N1}する[義務]{ぎむ:obligation:N1}がある（[法]{ほう:law:N3}25[条]{じょう:article:N1}）。[一方]{いっぽう:on the other hand:N4}、[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}の[場合]{ばあい:case:N3}は、[管理]{かんり:management:N2}[責任者]{せきにんしゃ:person in charge:N3}が[第一次的]{だいいちじてき:primarily:N1}に[責任]{せきにん:responsibility:N3}を[負う]{おう:to bear:N3}。[委託]{いたく:outsourcing:N1}は「[自社]{じしゃ:own company:N4}の[業務]{ぎょうむ:business operations:N3}を[外注]{がいちゅう:outsourcing:N4}する」[関係]{かんけい:relationship:N3}であり、[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}は「[複数]{ふくすう:multiple:N2}の[事業者]{じぎょうしゃ:business operator:N4}が[対等]{たいとう:equal:N3}にデータを[共有]{きょうゆう:sharing:N3}する」[関係]{かんけい:relationship:N3}である。\n\n#en\nThe difference between outsourcing and joint use is a frequently tested exam topic. In the case of outsourcing, the outsourcing party continues to bear responsibility and has an obligation to supervise the contractor (Article 25). On the other hand, in the case of joint use, the management responsible party bears primary responsibility. Outsourcing is a relationship of \"subcontracting one's own business operations,\" while joint use is a relationship of \"multiple business operators sharing data on an equal basis.\"\n::\n\n::heading\n[試験]{しけん:exam:N4}の[ポイント]{ポイント:point}\n\n#en\nExam Key Points\n::\n\n::para\n[第三者]{だいさんしゃ:third party:N1}[提供]{ていきょう:provision:N1}の[制限]{せいげん:restriction:N3}に[関]{かん:related:N3}する[試験]{しけん:exam:N4}[対策]{たいさく:preparation:N1}として、[以下]{いか:the following:N4}の[点]{てん:point:N3}を[確実]{かくじつ:certain, reliable:N3}に[押さえて]{おさえて:to master:N3}おきたい。[法]{ほう:law:N3}27[条]{じょう:article:N1}1[項]{こう:paragraph:N1}の[例外]{れいがい:exception:N3}[事由]{じゆう:reason:N3}は[全]{ぜん:all:N3}[号]{ごう:item:N3}を[暗記]{あんき:memorization:N3}し、[具体]{ぐたい:concrete:N3}[例]{れい:example:N3}と[紐づけ]{ひもづけ:linking:N1}ること。オプトアウトの[届出]{とどけで:notification:N2}[事項]{じこう:matters:N1}6つ、[共同]{きょうどう:joint:N3}[利用]{りよう:use:N3}の[公表]{こうひょう:public announcement:N3}[事項]{じこう:matters:N1}5つはそれぞれ[正確]{せいかく:accurate:N3}に[列挙]{れっきょ:enumeration:N1}できるようにすること。2020[年]{ねん:year:N5}[改正]{かいせい:amendment:N2}で[追加]{ついか:addition:N3}された[制限]{せいげん:restriction:N3}（[要配慮]{ようはいりょ:requiring special care:N1}[個人情報]{こじんじょうほう:personal information:N2}・[不正]{ふせい:illicit:N4}[取得]{しゅとく:acquisition:N3}・[二重]{にじゅう:double:N4}オプトアウト）は[出題]{しゅつだい:setting a question:N4}[頻度]{ひんど:frequency:N1}が[高い]{たかい:high:N5}。「[第三者]{だいさんしゃ:third party:N1}に[該当]{がいとう:to apply:N1}しない[場合]{ばあい:case:N3}」の3[類型]{るいけい:type:N2}と、それぞれの[責任]{せきにん:responsibility:N3}[構造]{こうぞう:structure:N2}の[違い]{ちがい:difference:N3}を[理解]{りかい:understanding:N3}すること。\n\n#en\nFor exam preparation regarding restrictions on third-party provision, the following points should be firmly mastered. Memorize all exception grounds under Article 27, Paragraph 1, and link them with concrete examples. Be able to accurately enumerate the six notification items for opt-out and the five announcement items for joint use. The restrictions added by the 2020 amendment (sensitive personal information, illicit acquisition, and double opt-out) are tested frequently. Understand the three types of cases that do not constitute a \"third party\" and the differences in the responsibility structure for each.\n::\n",{"id":255,"title":261,"titleEn":262,"topicPath":263,"questions":264},"第４編 個人データに関する義務 確認テスト","Chapter 4: Obligations Regarding Personal Data — Practice Test","software\u002Fkojin-joho-hogo\u002Fkadai-1\u002Fhen-04-kojin-data-gimu",[265,293,317,341,364,386],{"id":266,"articleId":267,"question":268,"options":271,"correctLabel":281,"explanation":288,"tags":291},"kjh-k1-h04-q01","kjh-k1-h04-anzen-kanri",{"en":269,"jp":270},"Which of the following is NOT one of the four types of safety management measures?","[安全]{あんぜん:safety}[管理]{かんり:management}[措置]{そち:measures}の4[種類]{しゅるい:types}に[該当]{がいとう:applicable}しないものはどれか。",[272,276,280,284],{"label":273,"jp":274,"en":275},"ア","[組織的]{そしきてき:organizational}[安全]{あんぜん:safety}[管理]{かんり:management}[措置]{そち:measures}","Organizational safety management measures",{"label":277,"jp":278,"en":279},"イ","[人的]{じんてき:human}[安全]{あんぜん:safety}[管理]{かんり:management}[措置]{そち:measures}","Human safety management measures",{"label":281,"jp":282,"en":283},"ウ","[財務的]{ざいむてき:financial}[安全]{あんぜん:safety}[管理]{かんり:management}[措置]{そち:measures}","Financial safety management measures",{"label":285,"jp":286,"en":287},"エ","[技術的]{ぎじゅつてき:technical}[安全]{あんぜん:safety}[管理]{かんり:management}[措置]{そち:measures}","Technical safety management measures",{"en":289,"jp":290},"The four types of safety management measures are organizational, human, physical, and technical. \"Financial\" is not included.","[安全]{あんぜん:safety}[管理]{かんり:management}[措置]{そち:measures}は、[組織的]{そしきてき:organizational}、[人的]{じんてき:human}、[物理的]{ぶつりてき:physical}、[技術的]{ぎじゅつてき:technical}の4[種類]{しゅるい:types}である。「[財務的]{ざいむてき:financial}」は[含]{ふく:included}まれない。",[292],"安全管理措置",{"id":294,"articleId":267,"question":295,"options":298,"correctLabel":281,"explanation":311,"tags":314},"kjh-k1-h04-q02",{"en":296,"jp":297},"Which of the following is INCORRECT as a requirement for mandatory breach reporting (Article 26)?","[漏]{ろう:leak}えい[報告]{ほうこく:report}（[法]{ほう:law}[第]{だい:article}26[条]{じょう:article}）が[義務]{ぎむ:obligation}づけられる[要件]{ようけん:requirement}として[誤]{あやま:incorrect}っているものはどれか。",[299,302,305,308],{"label":273,"jp":300,"en":301},"[要]{よう:requiring}[配慮]{はいりょ:consideration}[個人]{こじん:personal}[情報]{じょうほう:information}の[漏]{ろう:leak}えい","Leakage of special care-required personal information",{"label":277,"jp":303,"en":304},"[不正]{ふせい:unauthorized}アクセスによる[漏]{ろう:leak}えいのおそれ","Risk of leakage due to unauthorized access",{"label":281,"jp":306,"en":307},"1[件]{けん:case}でも[漏]{ろう:leak}えいがあれば[必]{かなら:always}ず[報告]{ほうこく:report}が[必要]{ひつよう:necessary}","Reporting is always required even for a single case of leakage",{"label":285,"jp":309,"en":310},"[財産的]{ざいさんてき:financial}[被害]{ひがい:damage}が[生]{しょう:occur}じるおそれがある[漏]{ろう:leak}えい","Leakage where financial damage may occur",{"en":312,"jp":313},"Mandatory breach reporting applies to four categories: leakage of special care-required information, unauthorized access, risk of financial damage, and leakage exceeding 1,000 persons. A single case of leakage does not always trigger reporting obligations.","[漏]{ろう:leak}えい[報告]{ほうこく:report}が[義務]{ぎむ:obligation}づけられるのは、[要]{よう:requiring}[配慮]{はいりょ:consideration}[個人]{こじん:personal}[情報]{じょうほう:information}の[漏]{ろう:leak}えい、[不正]{ふせい:unauthorized}アクセス、[財産的]{ざいさんてき:financial}[被害]{ひがい:damage}のおそれ、1,000[人]{にん:persons}[超]{ちょう:exceeding}の[漏]{ろう:leak}えいの4[類型]{るいけい:types}である。1[件]{けん:case}の[漏]{ろう:leak}えいでも[必]{かなら:always}ず[報告]{ほうこく:report}[義務]{ぎむ:obligation}が[生]{しょう:occur}じるわけではない。",[315,316],"漏えい報告","26条",{"id":318,"articleId":6,"question":319,"options":322,"correctLabel":281,"explanation":335,"tags":338},"kjh-k1-h04-q03",{"en":320,"jp":321},"Which of the following is NOT an exception allowing third-party provision without the individual's consent?","[第三者]{だいさんしゃ:third party}[提供]{ていきょう:provision}の[例外]{れいがい:exception}（[本人]{ほんにん:individual}の[同意]{どうい:consent}なく[提供]{ていきょう:provision}できる[場合]{ばあい:case}）に[該当]{がいとう:applicable}しないものはどれか。",[323,326,329,332],{"label":273,"jp":324,"en":325},"[法令]{ほうれい:laws}に[基]{もと:based}づく[場合]{ばあい:case}","Cases based on laws and regulations",{"label":277,"jp":327,"en":328},"[委託]{いたく:entrustment}に[伴]{ともな:accompanying}う[提供]{ていきょう:provision}","Provision accompanying entrustment",{"label":281,"jp":330,"en":331},"グループ[会社]{がいしゃ:company}[間]{かん:between}の[情報]{じょうほう:information}[共有]{きょうゆう:sharing}","Information sharing between group companies",{"label":285,"jp":333,"en":334},"[事業]{じぎょう:business}[承継]{しょうけい:succession}に[伴]{ともな:accompanying}う[提供]{ていきょう:provision}","Provision accompanying business succession",{"en":336,"jp":337},"Entrustment, business succession, and joint use are stipulated as cases not constituting third-party provision. Merely being between group companies does not create an exception — the requirements for joint use must be satisfied.","[委託]{いたく:entrustment}、[事業]{じぎょう:business}[承継]{しょうけい:succession}、[共同]{きょうどう:joint}[利用]{りよう:use}は[第三者]{だいさんしゃ:third party}に[該当]{がいとう:applicable}しない[場合]{ばあい:case}として[規定]{きてい:stipulated}されている。グループ[会社]{がいしゃ:company}[間]{かん:between}というだけでは[例外]{れいがい:exception}にならず、[共同]{きょうどう:joint}[利用]{りよう:use}の[要件]{ようけん:requirements}を[満]{み:satisfy}たす[必要]{ひつよう:necessary}がある。",[339,340],"第三者提供","例外",{"id":342,"articleId":6,"question":343,"options":346,"correctLabel":281,"explanation":359,"tags":362},"kjh-k1-h04-q04",{"en":344,"jp":345},"Which of the following is correct about third-party provision through opt-out?","オプトアウトによる[第三者]{だいさんしゃ:third party}[提供]{ていきょう:provision}について[正]{ただ:correct}しいものはどれか。",[347,350,353,356],{"label":273,"jp":348,"en":349},"[要]{よう:requiring}[配慮]{はいりょ:consideration}[個人]{こじん:personal}[情報]{じょうほう:information}もオプトアウトで[提供]{ていきょう:provision}できる","Special care-required personal information can also be provided through opt-out",{"label":277,"jp":351,"en":352},"[個人]{こじん:personal}[情報]{じょうほう:information}[保護]{ほご:protection}[委員会]{いいんかい:commission}への[届出]{とどけで:notification}は[不要]{ふよう:unnecessary}である","Notification to the PPC is unnecessary",{"label":281,"jp":354,"en":355},"オプトアウトには[個人]{こじん:personal}[情報]{じょうほう:information}[保護]{ほご:protection}[委員会]{いいんかい:commission}への[届出]{とどけで:notification}が[必要]{ひつよう:necessary}である","Opt-out requires notification to the PPC",{"label":285,"jp":357,"en":358},"[不正]{ふせい:illegally}に[取得]{しゅとく:acquired}した[個人]{こじん:personal}データもオプトアウトで[提供]{ていきょう:provision}できる","Illegally acquired personal data can also be provided through opt-out",{"en":360,"jp":361},"Third-party provision through opt-out requires notification to the PPC. The 2020 amendment prohibited opt-out provision of special care-required information, illegally acquired data, and data obtained through opt-out.","オプトアウトによる[第三者]{だいさんしゃ:third party}[提供]{ていきょう:provision}にはPPCへの[届出]{とどけで:notification}が[必要]{ひつよう:necessary}。2020[年]{ねん:year}[改正]{かいせい:amendment}で、[要]{よう:requiring}[配慮]{はいりょ:consideration}[個人]{こじん:personal}[情報]{じょうほう:information}や[不正]{ふせい:illegally}[取得]{しゅとく:acquired}データ、オプトアウトで[取得]{しゅとく:acquired}したデータはオプトアウト[提供]{ていきょう:provision}が[禁止]{きんし:prohibited}された。",[363],"オプトアウト",{"id":365,"articleId":6,"question":366,"options":369,"correctLabel":277,"explanation":382,"tags":385},"kjh-k1-h04-q05",{"en":367,"jp":368},"Which of the following is correct about joint use?","[共同]{きょうどう:joint}[利用]{りよう:use}について[正]{ただ:correct}しいものはどれか。",[370,373,376,379],{"label":273,"jp":371,"en":372},"[共同]{きょうどう:joint}[利用]{りよう:use}[者]{しゃ:user}の[範囲]{はんい:scope}を[本人]{ほんにん:individual}に[通知]{つうち:notify}する[必要]{ひつよう:necessary}はない","There is no need to notify the individual of the scope of joint users",{"label":277,"jp":374,"en":375},"[共同]{きょうどう:joint}[利用]{りよう:use}[者]{しゃ:user}の[範囲]{はんい:scope}、[利用]{りよう:use}[目的]{もくてき:purpose}、[管理]{かんり:management}[責任者]{せきにんしゃ:responsible person}を[本人]{ほんにん:individual}に[通知]{つうち:notify}または[公表]{こうひょう:publicize}する[必要]{ひつよう:necessary}がある","The scope of joint users, purpose of use, and responsible manager must be notified or publicized to the individual",{"label":281,"jp":377,"en":378},"[共同]{きょうどう:joint}[利用]{りよう:use}はPPCへの[届出]{とどけで:notification}が[必要]{ひつよう:necessary}","Joint use requires notification to the PPC",{"label":285,"jp":380,"en":381},"[共同]{きょうどう:joint}[利用]{りよう:use}では[安全]{あんぜん:safety}[管理]{かんり:management}[措置]{そち:measures}の[義務]{ぎむ:obligation}は[免除]{めんじょ:exempt}される","Joint use exempts the obligation for safety management measures",{"en":383,"jp":384},"Joint use requires notifying or publicizing the scope of joint users, purpose of use, data items, and the name\u002Ftitle of the responsible manager. Notification to the PPC is not required.","[共同]{きょうどう:joint}[利用]{りよう:use}には、[共同]{きょうどう:joint}[利用]{りよう:use}[者]{しゃ:user}の[範囲]{はんい:scope}、[利用]{りよう:use}[目的]{もくてき:purpose}、データ[項目]{こうもく:items}、[管理]{かんり:management}[責任者]{せきにんしゃ:responsible person}の[氏名]{しめい:name}・[名称]{めいしょう:title}を[本人]{ほんにん:individual}に[通知]{つうち:notify}または[公表]{こうひょう:publicize}する[必要]{ひつよう:necessary}がある。PPCへの[届出]{とどけで:notification}は[不要]{ふよう:unnecessary}。",[220],{"id":387,"articleId":388,"question":389,"options":392,"correctLabel":281,"explanation":405,"tags":408},"kjh-k1-h04-q06","kjh-k1-h01-hotaikei",{"en":390,"jp":391},"Which of the following is correct about provision to third parties in foreign countries?","[外国]{がいこく:foreign}にある[第三者]{だいさんしゃ:third party}への[提供]{ていきょう:provision}について[正]{ただ:correct}しいものはどれか。",[393,396,399,402],{"label":273,"jp":394,"en":395},"[本人]{ほんにん:individual}の[同意]{どうい:consent}[取得]{しゅとく:acquisition}[時]{じ:time}に[外国]{がいこく:foreign}の[個人]{こじん:personal}[情報]{じょうほう:information}[保護]{ほご:protection}[制度]{せいど:system}に[関]{かん:related}する[情報]{じょうほう:information}[提供]{ていきょう:provision}は[不要]{ふよう:unnecessary}","Information about the foreign country's personal information protection system is unnecessary when obtaining consent",{"label":277,"jp":397,"en":398},"EU[加盟国]{かめいこく:member states}への[提供]{ていきょう:provision}は[常]{つね:always}に[同意]{どうい:consent}が[必要]{ひつよう:necessary}","Provision to EU member states always requires consent",{"label":281,"jp":400,"en":401},"2020[年]{ねん:year}[改正]{かいせい:amendment}で[本人]{ほんにん:individual}への[情報]{じょうほう:information}[提供]{ていきょう:provision}[義務]{ぎむ:obligation}が[強化]{きょうか:strengthened}された","The 2020 amendment strengthened the obligation to provide information to the individual",{"label":285,"jp":403,"en":404},"[外国]{がいこく:foreign}への[提供]{ていきょう:provision}は[一律]{いちりつ:uniformly}[禁止]{きんし:prohibited}されている","Provision to foreign countries is uniformly prohibited",{"en":406,"jp":407},"The 2020 amendment mandated providing information about the destination country's system when obtaining consent for foreign third-party provision. EU member states and the UK are PPC-approved countries, enabling provision without consent.","2020[年]{ねん:year}[改正]{かいせい:amendment}により、[外国]{がいこく:foreign}[第三者]{だいさんしゃ:third party}[提供]{ていきょう:provision}の[同意]{どうい:consent}[取得]{しゅとく:acquisition}[時]{じ:time}に[移転先]{いてんさき:transfer destination}[国]{くに:country}の[制度]{せいど:system}[情報]{じょうほう:information}[提供]{ていきょう:provision}が[義務化]{ぎむか:mandatory}された。EU[加盟国]{かめいこく:member states}や[英国]{えいこく:UK}はPPCが[認定]{にんてい:approved}した[国]{くに:country}であり、[同意]{どうい:consent}なしでの[提供]{ていきょう:provision}が[可能]{かのう:possible}。",[409],"外国第三者提供"]