PPC Japan’s Answers to frequently asked questions on the Personal Information Protection Law consultation dial (Covid-19)

I translate PPC Japan’s ” Answers to frequently asked questions on the Personal Information Protection Law consultation dial”into English.Japanese version is here.

Q1. Employees were contacted with new coronavirus infections and close contacts. What are the issues when making internal announcements?
(Answer)
In the case pointed out, the provision of personal data within the same business operator does not correspond to “third-party provision”, and consent from the individual is not required when sharing personal data within the company.
Also, even if it exceeds the scope of the purpose of use specified at the beginning, if it is necessary to prevent secondary infection and continue business activities within the business operator, it is not necessary to obtain the consent of the individual.

Q2. My company’s employees are infected with the new coronavirus, and we are considering providing information to business partners who may have come into contact with the employee. It is difficult to get the consent of the employee himself, but can we provide it?

(Answer)
When providing personal data of the employee to business partners, even if it exceeds the scope of the purpose of use specified at the outset, you do not need your consent, if  it is necessary

  1. to prevent secondary infection at business partners,
  2. to continue business activities,or
  3. to improve public health

“About treatment of the personal data for the prevention of Spread of Covid-19 infections” by Personal Information Protection Commission Japan

Japan’s Personal Information Protection Commission published the memorandum named “About treatment of the personal data for the prevention of expanding of infection of Covid-19”.The memo is in Japanese and link is here.

Here I translate into English.


About treatment of Personal Data to Prevent the Spread of New Coronavirus Infections

2 April,2020
Secretariat of the Personal Information Protection Committee

Opportunities to handle personal information to prevent the spread of new coronavirus infections are increasing.So PPC introduce the relating articles of the  Act on the Protection of Personal Information (Act No. 57 of 2003; hereinafter referred to as “the Act”). (hereinafter referred to as “the Act”).

A business operator handling personal information is prohibited to use personal data to hold  for any purpose other than the purpose of use, or to provide it to a third party without the consent of the person in question.
However, as an exception, it is permitted to use the information for other purposes or to provide it to a third party in the following cases.It is possible for  business operator to take countermeasures including  these exceptions application for prevention of the spread of new coronavirus infections

(1) A business operator may use the information for other purposes or to provide it to a third party based on its own discretion in the following condition (Article 16, paragraph 3, item 4; Article 23, paragraph 1, item 4).;

  1. when a national organization, etc. request  for information and such request is in charge of the implementation of the affairs prescribed by laws and regulations,
  2. There is a risk of hindrance to the performance of the work in question in the event that the business operator handling personal information does not cooperate with the business operator, and
  3. the business operator may not be able to perform the relevant affairs properly when obtaining the consent of the person concerned.

(2)A business operator may use the information for other purposes or to provide it to a third party including a national organisation also  in the following condition

(Article 16, Paragraph 3, Items 2 and 3, Article 23, Paragraph 1,Items  2 and 3).

;

  1. When it is necessary for the protection of a person’s life, body or property, or
  2. When it is particularly necessary for the improvement of public health and difficult to obtain the consent of the person in question, personal information may also be taken.

Considering  applicability of the above provisions,please take into consideration the purpose of use and safety management measures.

In addition, the new coronavirus, which has been receiving a lot of calls to the Commission’s Personal Information Protection Law Consultation Dial
Please refer to the attached document for answers to questions from business operators regarding infectious diseases. Please do.
In addition, “Guidelines for the Act on the Protection of Personal Information (General Rules)
(https://www.ppc.go.jp/files/pdf/190123_guidelines01.pdf), and
Please also refer to the Q&A (https://www.ppc.go.jp/files/pdf/1911_APPI_QA.pdf).

For individual consultations, please contact the Personal Information Protection Law Consultation Dial (03-6457-9849)) or the PPC Business Support Desk (03-6457-9771: New Business)