I translate PPC Japan’s ” Answers to frequently asked questions on the Personal Information Protection Law consultation dial”into English.Japanese version is here.
Q1. Employees were contacted with new coronavirus infections and close contacts. What are the issues when making internal announcements?
In the case pointed out, the provision of personal data within the same business operator does not correspond to “third-party provision”, and consent from the individual is not required when sharing personal data within the company.
Also, even if it exceeds the scope of the purpose of use specified at the beginning, if it is necessary to prevent secondary infection and continue business activities within the business operator, it is not necessary to obtain the consent of the individual.
Q2. My company’s employees are infected with the new coronavirus, and we are considering providing information to business partners who may have come into contact with the employee. It is difficult to get the consent of the employee himself, but can we provide it?
When providing personal data of the employee to business partners, even if it exceeds the scope of the purpose of use specified at the outset, you do not need your consent, if it is necessary
- to prevent secondary infection at business partners,
- to continue business activities,or
- to improve public health