個人情報の保護に関する法律施行令(平成十五年政令第五百七号)
Order for Enforcement of the Act on the Protection of Personal Information(Cabinet Order No. 507 of 2003)
最終更新:平成二十年政令第百六十六号
Last Version: Cabinet Order No. 166 of 2008
目次
履歴
  • 平成29年7月10日
    • 最終更新:平成二八年政令第三二四号
    • 翻訳日:平成28年11月24日
    • 辞書バージョン:11.0
  • 平成28年2月4日
    • 最終更新:平成二十年政令第百六十六号
    • 翻訳日:平成26年3月18日
    • 辞書バージョン:8.0

個人情報の保護に関する法律施行令
Order for Enforcement of the Act on the Protection of Personal Information
平成十五年十二月十日政令第五百七号
Cabinet Order No. 507 of December 10, 2003
内閣は、個人情報の保護に関する法律(平成十五年法律第五十七号)第二条第二項第二号、第三項第四号及び第五項、第二十四条第一項第四号、第二十五条第一項、第二十九条第一項及び第三項、第三十七条第二項、第四十条第一項、第五十一条、第五十二条並びに第五十五条の規定に基づき、この政令を制定する。
The Cabinet hereby enacts this Cabinet Order pursuant to Article 2, paragraph (2), item (ii) of the Act on the Protection of Personal Information (Act No. 57 of 2003) and pursuant to paragraph (3), item (iv) and paragraph (5) of that Article; Article 24, paragraph (1), item (iv) of that Act; Article 25 paragraph (1) of that Act; Article 29, paragraph (1) and paragraph (3) of that Act; Article 37, paragraph (2) of that Act; Article 40, paragraph (1) of that Act; and Article 51, Article 52, and Article 55 of that Act.
(個人情報データベース等)
(Databases, etc. of Personal Information )
第一条個人情報の保護に関する法律(以下「法」という。)第二条第二項第二号の政令で定めるものは、これに含まれる個人情報を一定の規則に従って整理することにより特定の個人情報を容易に検索することができるように体系的に構成した情報の集合物であって、目次、索引その他検索を容易にするためのものを有するものをいう。
Article 1The set of data that Cabinet Order provides for which is referred to in Article 2, paragraph (2), item (ii) of the Act on the Protection of Personal Information (hereinafter referred to as "the Act") is any set of data to which a fixed set of rules is applied to arrange the personal information contained therein so that it is structurally organized to enable personal information to be easily retrieved from it, and which has a table of contents, an index, or anything else that aids in retrieval.
(個人情報取扱事業者から除外される者)
( Business operators Excluded from Consideration as Business Operators Handling Personal Information)
第二条法第二条第三項第五号の政令で定める者は、その事業の用に供する個人情報データベース等を構成する個人情報によって識別される特定の個人の数(当該個人情報データベース等の全部又は一部が他人の作成に係る個人情報データベース等であって、次の各号のいずれかに該当するものを編集し、又は加工することなくその事業の用に供するときは、当該個人情報データベース等の全部又は一部を構成する個人情報によって識別される特定の個人の数を除く。)の合計が過去六月以内のいずれの日においても五千を超えない者とする。
Article 2The business operator that Cabinet Order provides for which is referred to in Article 2, paragraph (3), item (v) of the Act is any business operator with a database, etc. of personal information for business use which is made up of personal information that could be used to identify no more than a total of five thousand certain individuals on any single day in the past six months (if all or part of that database, etc. of personal information was created by another business operator and the entity using it for business has not edited or reworked any of the data set forth in the following items, the certain individuals that can be identified using the personal information that makes up the whole or the relevant part of that database, etc. of personal information are excluded from being calculated as among the number of certain individuals that the personal information could be used to identify on any single day during the past six months):
個人情報として次に掲げるもののみが含まれるもの
(i)data that contains only the following details as personal information:
氏名
(a)an individual's name;
住所又は居所(地図上又は電子計算機の映像面上において住所又は居所の所在の場所を示す表示を含む。)
(b)an individual's residence or domicile (including any indication on a map or computer screen showing where the individual's residence or domicile is located);
電話番号
(c)an individual's telephone number.
不特定かつ多数の者に販売することを目的として発行され、かつ、不特定かつ多数の者により随時に購入することができるもの又はできたもの
(ii)data that has been released for sale to the general public and that can now or could formerly be purchased by the general public at any time.
(保有個人データから除外されるもの)
(Data Excluded from Consideration as Retained Personal Data)
第三条法第二条第五項の政令で定めるものは、次に掲げるものとする。
Article 3The personal data that Cabinet Order provides for which is referred to in Article 2, paragraph (5) of the Act is:
当該個人データの存否が明らかになることにより、本人又は第三者の生命、身体又は財産に危害が及ぶおそれがあるもの
(i)any personal data whose known presence or absence of a database is likely to threaten the life, body, or property of the identifiable person;
当該個人データの存否が明らかになることにより、違法又は不当な行為を助長し、又は誘発するおそれがあるもの
(ii)any personal data whose known presence or absence of a database is likely to prompt or trigger an illegal activity or wrongful conduct;
当該個人データの存否が明らかになることにより、国の安全が害されるおそれ、他国若しくは国際機関との信頼関係が損なわれるおそれ又は他国若しくは国際機関との交渉上不利益を被るおそれがあるもの
(iii)any personal data whose known presence or absence of a database is likely to undermine national security, damage a relationship of confidence with a foreign country or international organization, or put the country at a disadvantage in negotiations with another country or with an international organization;
当該個人データの存否が明らかになることにより、犯罪の予防、鎮圧又は捜査その他の公共の安全と秩序の維持に支障が及ぶおそれがあるもの
(iv)any personal data whose known presence or absence of a database is likely to interfere with crime prevention, crime control, or criminal investigations or with otherwise upholding public safety and order.
(保有個人データから除外されるものの消去までの期間)
(Period to Deletion of Data Excluded from Consideration as Retained Personal Data )
第四条法第二条第五項の政令で定める期間は、六月とする。
Article 4The period that Cabinet Order specifies which is referred to in Article 2, paragraph (5) of the Act is six months.
(保有個人データの適正な取扱いの確保に関し必要な事項)
(Matters That Needs to Be Made Accessible in Order to Ensure the Proper Handling of Retained Personal Data)
第五条法第二十四条第一項第四号の政令で定めるものは、次に掲げるものとする。
Article 5The matters specified by Cabinet Order which is referred to in Article 24, paragraph (1), item (iv) of the Act is:
当該個人情報取扱事業者が行う保有個人データの取扱いに関する苦情の申出先
(i)where to file a complaint about the handling, by the business operator handling personal information, of the retained personal data;
当該個人情報取扱事業者が認定個人情報保護団体の対象事業者である場合にあっては、当該認定個人情報保護団体の名称及び苦情の解決の申出先
(ii)if the business operator handling personal information is the covered enterprise of an accredited personal information protection organization, the name of the accredited personal information protection organization and where to file for it to resolve the complaint.
(個人情報取扱事業者が保有個人データを開示する方法)
(Means by Which a Business Operator Handling Personal Information Discloses the Retained Personal Data)
第六条法第二十五条第一項の政令で定める方法は、書面の交付による方法(開示の求めを行った者が同意した方法があるときは、当該方法)とする。
Article 6The means that Cabinet Order provides for which is referred to in Article 25, paragraph (1) of the Act is any paper-based means of delivery (or a means agreed to by the person requesting disclosure, if any).
(開示等の求めを受け付ける方法)
(How a Business Operator Handling Personal Information Accepts Requests for Disclosure and Other Handling)
第七条法第二十九条第一項の規定により個人情報取扱事業者が開示等の求めを受け付ける方法として定めることができる事項は、次に掲げるとおりとする。
Article 7The matters that a Business Operators Handling Personal Information may establish, pursuant to the provisions of Article 29, paragraph (1) of the Act, as how that business operator will accept requests for disclosure and other handling are:
開示等の求めの申出先
(i)where to file a request for disclosure or other handling;
開示等の求めに際して提出すべき書面(電子的方式、磁気的方式その他人の知覚によっては認識することができない方式で作られる記録を含む。)の様式その他の開示等の求めの方式
(ii)the format of any paper document (or of any record created in electronic form, magnetic form, or any other form that cannot be perceived with the human senses) a person must submit when requesting disclosure or other handling, and other ways of requesting disclosure or other handling;
開示等の求めをする者が本人又は次条に規定する代理人であることの確認の方法
(iii)the way of verifying that the person requesting disclosure or other handling is the identifiable person or the representative prescribed in the following Article;
法第三十条第一項の手数料の徴収方法
(iv)how the fee referred to in Article 30, paragraph (1) of the Act is collected.
(開示等の求めをすることができる代理人)
(Representatives That May Request Disclosure or Other Handling)
第八条法第二十九条第三項の規定により開示等の求めをすることができる代理人は、次に掲げる代理人とする。
Article 8The following representatives may request disclosure or other handling pursuant to the provisions of Article 29, paragraph (3) of the Act:
未成年者又は成年被後見人の法定代理人
(i)the statutory agent of a minor or of an adult ward;
開示等の求めをすることにつき本人が委任した代理人
(ii)a representative appointed by the identifiable person to request the disclosure or other handling.
(認定個人情報保護団体の認定の申請)
(Applying for Accreditation as an Accredited Personal Information Protection Organization)
第九条法第三十七条第二項の規定による申請は、次に掲げる事項を記載した申請書を主務大臣に提出してしなければならない。
Article 9(1)To apply for certification pursuant to the provisions of Article 37, paragraph (2) of the Act, a person must submit a written application to the competent minister, stating:
名称及び住所並びに代表者又は管理人の氏名
(i)the name and address of the applicant and the name of its representative or manager;
認定の申請に係る業務を行おうとする事務所の所在地
(ii)the location of the office where the applicant seeks to perform the services for which it is applying to be accredited;
認定の申請に係る業務の概要
(iii)an outline of the services for which the applicant is applying to be accredited.
前項の申請書には、次に掲げる書類を添付しなければならない。
(2)The following documents must accompany the written application referred to in the preceding paragraph:
定款、寄附行為その他の基本約款
(i)the applicant's articles of incorporation, articles of endowment, and other governing documents;
認定を受けようとする者が法第三十八条各号の規定に該当しないことを誓約する書面
(ii)a document in which the business operator applying to be accredited pledges that it does not fall under the provisions of any item of Article 38 of the Act;
認定の申請に係る業務の実施の方法を記載した書類
(iii)documents describing how the applicant will implement the services for which it is applying to be accredited;
認定の申請に係る業務を適正かつ確実に行うに足りる知識及び能力を有することを明らかにする書類
(iv)documents showing that the applicant's knowledge and capabilities are sufficient to allow it to perform the services for which it is applying to be accredited properly and reliably;
最近の事業年度における事業報告書、貸借対照表、収支決算書、財産目録その他の経理的基礎を有することを明らかにする書類(申請の日の属する事業年度に設立された法人にあっては、その設立時における財産目録)
(v)business reports, balance sheets, inventories of assets, and any other documents to show that the applicant has a financial base in the most recent business year (for a corporation incorporated in the business year in which it is applying for accreditation, an inventory of property at the time of incorporation);
役員の氏名、住所及び略歴を記載した書類
(vi)documents giving the names, addresses, and career summaries of the applicant's officers;
対象事業者の氏名又は名称を記載した書類及び当該対象事業者が認定を受けようとする者の構成員であること又は認定の申請に係る業務の対象となることについて同意した者であることを証する書類
(vii)a document giving the names of the covered enterprises and documents evidencing that those covered enterprises are members of the business operator applying to be accredited or are entities that have agreed to be covered by the services for which the applicant is applying to be accredited;
認定の申請に係る業務以外の業務を行っている場合は、その業務の種類及び概要を記載した書類
(viii)if the applicant engages in services other than the services for which it is applying to be accredited, a document describing the type of services and giving a business outline;
その他参考となる事項を記載した書類
(ix)documents giving other information of reference.
認定個人情報保護団体は、第一項第一号若しくは第二号に掲げる事項又は前項第二号から第四号まで、第六号若しくは第八号に掲げる書類に記載した事項に変更があったときは、遅滞なく、その旨(同項第三号に掲げる書類に記載した事項に変更があったときは、その理由を含む。)を記載した届出書を主務大臣に提出しなければならない。
(3)If matters set forth in paragraph (1), item (i) or item (ii) or matters given in a document set forth in item (ii) through item (iv), item (vi), or item (viii) of the preceding paragraph change, the accredited personal information protection organization must submit written notice of this to the competent minister without delay (and must also give the reason for the change, if the matters given in the document set forth in item (iii) of that paragraph changes).
(認定業務の廃止の届出)
(Notification of Discontinuation of Accredited Services)
第十条認定個人情報保護団体は、認定業務を廃止しようとするときは、廃止しようとする日の三月前までに、次に掲げる事項を記載した届出書を主務大臣に提出しなければならない。
Article 10Before discontinuing accredited services, an accredited personal information protection organization must submit written notice to the competent minister three months prior to the date it plans to discontinue the services, giving the following information:
名称及び住所並びに代表者又は管理人の氏名
(i)the name and address of the organization and the name of its representative or manager;
法第四十二条第一項の申出の受付を終了しようとする日
(ii)the last date the organization plans to accept requests referred to in Article 42, paragraph (1) of the Act;
認定業務を廃止しようとする日
(iii)the date the organization plans to discontinue its accredited services;
認定業務を廃止する理由
(iv)its reasons for discontinuing the accredited services.
(地方公共団体の長等が処理する事務)
(Affairs Handled by the Head, etc. of the Local Government or Chief Executive)
第十一条法第三十二条から第三十四条までに規定する主務大臣の権限に属する事務は、個人情報取扱事業者が行う事業であって当該主務大臣が所管するものについての報告の徴収、検査、勧告その他の監督に係る権限に属する事務の全部又は一部が他の法令の規定により地方公共団体の長その他の執行機関(以下この条において「地方公共団体の長等」という。)が行うこととされているときは、当該地方公共団体の長等が行う。この場合において、当該事務を行うこととなる地方公共団体の長等が二以上あるときは、法第三十二条及び第三十三条に規定する主務大臣の権限に属する事務は、各地方公共団体の長等がそれぞれ単独に行うことを妨げない。
Article 11(1)If, pursuant to any other law or regulation, it has been decided that the head of a local government or other executive agencies (hereinafter referred to as the "Head, etc. of the Local Government or Chief Executive" in this Article) is to collect reports, conduct investigations, or issue recommendations in connection with business that Business Operators Handling Personal Information conduct which falls under the administrative jurisdiction of the competent minister, or that the Head, etc. of the Local Government or Chief Executive is to otherwise perform all or a part of the functions that are part of the supervisory authority of the competent minister, the Head of the Local Government or Chief Executive performs the affairs that Article 32 through Article 34 of the Act prescribe as being part of the authority of the competent minister. If, in such a case, there are multiple Heads, etc. of Local Government or Chief Executives that are to perform those affairs, nothing prevents each of those Heads, etc. of Local Government or Chief Executives from independently performing the affairs that Article 32 and Article 33 of the Act prescribe as being part of the authority of the competent minister.
法第三十七条、第四十条及び第四十六条から第四十八条までに規定する主務大臣の権限に属する事務は、認定個人情報保護団体(法第三十七条第一項の認定を受けようとする者を含む。)であってその設立の許可又は認可に係る主務大臣の権限に属する事務が他の法令の規定により地方公共団体の長等が行うこととされているときは、当該地方公共団体の長等が行う。
(2)If, pursuant to any other law or regulation, it is decided that the Head, etc. of the Local Government or Chief Executive is to perform affairs connected with the permission or authorization for incorporation of an accredited personal information protection organization (or of a business operator seeking to be accredited as referred to in Article 37, paragraph (1) of the Act) which are part of the authority of the competent minister, the Head, etc. of the Local Government or Chief Executive performs affairs that Article 37, Article 40, and Article 46 through Article 48 of the Act prescribe as being part of the authority of the competent minister.
第一項の規定は、主務大臣が自ら同項に規定する事務を行うことを妨げない。
(3)The provisions of paragraph (1) do not prevent the competent minister from independently performing the affairs provided for in that paragraph.
第一項の規定により同項に規定する主務大臣の権限に属する事務を行った地方公共団体の長等は、速やかに、その結果を主務大臣に報告しなければならない。
(4)A Head, etc. of Local Government or Chief Executive performing, pursuant to paragraph (1), affairs that that paragraph prescribes to be part of the authority of the competent minister must promptly report the results of this affair to the competent minister.
第一項及び第二項に規定する場合においては、法及びこの政令中これらの規定に規定する事務に係る主務大臣に関する規定は、地方公共団体の長等に関する規定として地方公共団体の長等に適用があるものとする。
(5)In cases as provided in paragraph (1) and paragraph (2), the provisions of the Act and of this Cabinet Order concerning the competent minister, as they relate to the functions provided for in paragraph (1) and paragraph (2), apply to the Head, etc. of the Local Government or Chief Executive as provisions of the Act and of this Order which concern the Head, etc. of the Local Government or Chief Executive.
(権限又は事務の委任)
(Delegation of Authority or Affairs)
第十二条主務大臣は、法第五十二条の規定により、内閣府設置法(平成十一年法律第八十九号)第四十九条第一項の庁の長、国家行政組織法(昭和二十三年法律第百二十号)第三条第二項の庁の長又は警察庁長官に法第三十二条から第三十四条まで、第三十七条、第三十九条、第四十条及び第四十六条から第四十八条までに規定する権限又は事務のうちその所掌に係るものを委任することができる。
Article 12(1)The competent minister, pursuant to the provisions of Article 52 of the Act, may delegate any authority or affairs that is within the minister's jurisdiction and is prescribed in Article 32 through Article 34, Article 37, Article 39, Article 40, or Article 46 through Article 48 of the Act to the head of an agency provided for in Article 49, paragraph (1) of the Act for Establishment of the Cabinet Office (Act No. 89 of 1999), to the head of an agency provided for in Article 3, paragraph (2) of the National Government Organization Act (Act No. 120 of 1948), or to the Commissioner General of the National Police Agency.
主務大臣(前項の規定によりその権限又は事務が内閣府設置法第四十九条第一項の庁の長又は国家行政組織法第三条第二項の庁の長に委任された場合にあっては、その庁の長)は、法第五十二条の規定により、内閣府設置法第十七条若しくは第五十三条の官房、局若しくは部の長、同法第十七条第一項若しくは第六十二条第一項若しくは第二項の職、同法第四十三条若しくは第五十七条の地方支分部局の長又は国家行政組織法第七条の官房、局若しくは部の長、同法第九条の地方支分部局の長若しくは同法第二十条第一項若しくは第二項の職に法第三十二条から第三十四条まで、第三十七条、第三十九条、第四十条及び第四十六条から第四十八条までに規定する権限又は事務のうちその所掌に係るものを委任することができる。
(2)The competent minister (or the head of the relevant agency, if the competent minister's authority or affairs are delegated to the head of an agency provided for in Article 49, paragraph (1) of Act for Establishment of the Cabinet Office or to the head of an agency provided for in Article 3, paragraph (2) of the National Government Organization Act, pursuant to the preceding paragraph), pursuant to the provisions of Article 52 of the Act, may delegate any authority or affairs that is within the minister's jurisdiction and is prescribed in Article 32 through Article 34, Article 37, Article 39, Article 40, or Article 46 through Article 48 of the Act to the head of a secretariat, bureau, or department provided for in Article 17 or Article 53 of the Act for Establishment of the Cabinet Office; to a person in a position provided for in Article 17, paragraph (1) or Article 62, paragraph (1) or paragraph (2) of that Act; to the head of a local branch office provided for in Article 43 or Article 57 of that Act; to the head of a secretariat, bureau, or department provided for in Article 7 of the National Government Organization Act; to the head of a local branch office provided for in Article 9 of that Act; or to a person in a position provided for in Article 20, paragraph (1) or paragraph (2) of that Act.
警察庁長官は、法第五十二条の規定により、警察法(昭和二十九年法律第百六十二号)第十九条第一項の長官官房若しくは局、同条第二項の部又は同法第三十条第一項の地方機関の長に第一項の規定により委任された権限又は事務を委任することができる。
(3)The Commissioner General of the National Police Agency, pursuant to the provisions of Article 52 of the Act, may delegate any authority or affairs with which the commissioner has been delegated pursuant to paragraph (1) to the head of the Commissioner General's Secretariat; to the head of a bureau provided for in Article 19, paragraph (1) of the Police Act (Act No. 162 of 1954); to the head of a department provided for in paragraph (2) of that Article; or to the head of a regional institution provided for in Article 30, paragraph (1) of that Act.
主務大臣、内閣府設置法第四十九条第一項の庁の長、国家行政組織法第三条第二項の庁の長又は警察庁長官は、前三項の規定により権限又は事務を委任しようとするときは、委任を受ける職員の官職、委任する権限又は事務及び委任の効力の発生する日を公示しなければならない。
(4)Before delegating authority or an affair pursuant to the provisions of one of the preceding three paragraphs, the competent minister, head of an agency provided for in Article 49, paragraph (1) of the Act for Establishment of the Cabinet Office, head of an agency provided for in Article 3, paragraph (2) of the National Government Organization Act, or Commissioner General of the National Police Agency must issue public notice of the official position of the member of personnel being delegated, the authority or affair being delegated, and the date the delegation comes into effect.
(主務大臣による権限の行使)
(Exercise of Authority by the Competent Minister)
第十三条個人情報取扱事業者が行う個人情報の取扱いについて、法第三十六条第一項の規定による主務大臣が二以上あるときは、法第三十二条及び第三十三条に規定する主務大臣の権限は、各主務大臣がそれぞれ単独に行使することを妨げない。
Article 13(1)If multiple competent ministers under Article 36, paragraph (1) of the Act have jurisdiction over the handling of personal information that a Business Operator Handling Personal Information carries out, nothing prevents each competent minister from independently exercising the authority prescribed in Article 32 and Article 33 of the Act.
前項の規定によりその権限を単独に行使した主務大臣は、速やかに、その結果を他の主務大臣に通知するものとする。
(2)A competent minister independently exercising authority pursuant to the provisions of the preceding paragraph must promptly report the results to the other competent ministers.
附 則
Supplementary Provisions
この政令は、公布の日から施行する。ただし、第五条から第十三条までの規定は、平成十七年四月一日から施行する。
This Cabinet Order comes into effect as of the date of its promulgation; provided, however, that the provisions of Article 5 through Article 13 come into effect as of April 1, 2005.
附 則〔平成十六年十二月十日法律第三百八十九号〕
Supplementary Provisions[Cabinet Order No. 389 of December 10, 2004]
この政令は、公布の日から施行し、この政令による改正後の個人情報の保護に関する法律施行令第二条の規定は、平成十六年十月一日から適用する。
This Cabinet Order comes into effect as of the date of its promulgation, and the provisions of Article 2 of the Order for Enforcement of the Act on the Protection of Personal Information following its revision by this Cabinet Order apply beginning on October 1, 2004.
附 則〔平成二十年五月一日法律第百六十六号〕
Supplementary Provisions[Cabinet Order No. 166 of May 1, 2008]
(施行期日)
(Effective Date)
この政令は、公布の日から施行する。
(1)This Cabinet Order comes into effect as of the date of its promulgation.
(経過措置)
(Transitional Measures)
この政令の施行前に個人情報の保護に関する法律第三十二条の規定により報告を求められ、又は同法第三十四条第二項若しくは第三項の規定による命令を受けた個人情報取扱事業者で、この政令による改正後の第二条第二号の規定の適用により個人情報取扱事業者に該当しなくなったものに係る当該報告の求め又は命令及びこれらに係る同法第五十七条又は第五十六条の違反行為に対する罰則の適用については、その個人情報取扱事業者に該当しなくなった後も、なお従前の例による。
(2)If, before this Cabinet Order comes into effect, a business operator that handles personal information is requested to make a report pursuant to Article 32 of the Act on the Protection of Personal Information or is issued an order pursuant to Article 34, paragraph (2) or paragraph (3) of that Act but, based on the application of Article 2, item (ii) as revised by this Cabinet Order, that business operator comes to no longer fall under the category of a business operator that handles personal information, the report or order of which the laws in force at the time of the request or order in question, and penal provisions apply to any violation as referred to in Article 57 or 58 of that Act in connection with such a request or order continue to be in effect, even after the enterprise is no longer considered to be a business operator handling personal information.