personal information to a third party, nor 4. The fact that Data Subjects are entitled utilize such personal information for other to refuse consent, and details of use than the purpose of being provided disadvantage, if any, due to refusal of except the cases specified in other acts. consent. Article 16 (Limitations to Collection of Article 25 (Entrusting Processing of Personal Data) (1) The Personal Data Personal Information) (3) The Information Controller shall collect the minimum and Communications Service Provider, etc. personal data necessary to attain the shall, when it intends to entrust processing purpose in any case applicable to any of personal information, define the purpose subparagraph of Article 15(1). In such case, in advance for which the trustee shall the burden of proof that the minimum process the personal information of Users. personal data is collected shall be borne by The trustee shall not process the personal the Personal Data Controller. information of Users beyond such purpose. (2) The Personal Data Controller may collect personal data only after clearly informing (4) The Information and Communications the Data Subject that he/she may refuse Service Provider, etc. shall manage, consent to the collection of other personal supervise and educate the trustee lest it data other than the minimum necessary. should violate the provisions in this Chapter. (3) The Personal Data Controller shall not (5) The trustee, who caused damage to the refuse the provision of goods or services to Users regarding the work processing the Data Subjects on the ground that the entrusted hereunder in violation of the Data Subject did not consent to the provisions in this Chapter, shall be deemed collection of personal data exceeding the as an employee of the Information and minimum requirement. Communications Service Provider, etc. only with respect to compensation for such Article 17 (Provision of Personal Data) (1) damage. The Personal Data Controller may provide (or share, hereinafter the same applies) the (6) What the Information and personal data of Data Subjects to a third Communications Service Provider, etc. has party in cases applicable to any of the entrusted processing of personal following subparagraphs: information to a trustee shall be in writing. 1. Where the consent of the Data Subject
personal information to a third party, nor utilize such personal information for other use than the purpose of being provided except the cases specified in other acts. Article 25 (Entrusting Processing of Personal Information) (3) The Information and Communications Service Provider, etc. shall, when it intends to entrust processing of personal information, define the purpose in advance for which the trustee shall process the personal information of Users. The trustee shall not process the personal information of Users beyond such purpose. (4) The Information and Communications Service Provider, etc. shall manage, supervise and educate the trustee lest it should violate the provisions in this Chapter. (5) The trustee, who caused damage to the Users regarding the work processing entrusted hereunder in violation of the provisions in this Chapter, shall be deemed as an employee of the Information and Communications Service Provider, etc. only with respect to compensation for such damage. (6) What the Information and Communications Service Provider, etc. has entrusted processing of personal information to a trustee shall be in writing. 4. The fact that Data Subjects are entitled to refuse consent, and details of disadvantage, if any, due to refusal of consent. Article 16 (Limitations to Collection of Personal Data) (1) The Personal Data Controller shall collect the minimum personal data necessary to attain the purpose in any case applicable to any subparagraph of Article 15(1). In such case, the burden of proof that the minimum personal data is collected shall be borne by the Personal Data Controller. (2) The Personal Data Controller may collect personal data only after clearly informing the Data Subject that he/she may refuse consent to the collection of other personal data other than the minimum necessary. (3) The Personal Data Controller shall not refuse the provision of goods or services to the Data Subjects on the ground that the Data Subject did not consent to the collection of personal data exceeding the minimum requirement. Article 17 (Provision of Personal Data) (1) The Personal Data Controller may provide (or share, hereinafter the same applies) the personal data of Data Subjects to a third party in cases applicable to any of the following subparagraphs: 1. Where the consent of the Data Subject