Act on the Protection of Personal Information

The Act on the Protection of Personal Information is presented as a framework for controlling the disclosure of personal data, but not as an absolute barrier to sharing it. Its relevance to the investigation lies in the gap between formal safeguards and the exceptional, difficult-to-reconstruct decisions through which information may pass from one person or organization to another.

Disclosure and institutional practice

When Kaga and his colleague ask a company whether it had shared Kaga’s personal information with a third party, a representative responsible for managing the company’s personal information explains that the law governs such information. She adds that the company had already managed its records rigorously before the law was passed, in order to prevent leaks. The law therefore appears as a formal framework for a concern that had also shaped the company’s earlier practices.

The representative describes disclosure as conditional rather than categorically forbidden. Personal relationships, she says, can complicate the implementation of strict rules; in exceptional circumstances, the company may share information with individuals or organizations it considers trustworthy. The standard depends not only on the kind of information involved but also on the recipient’s perceived reliability.

The inquiry into Kaga’s address

The company cannot establish whether it disclosed Kaga’s information in the case under investigation. Too much time has passed, and staff turnover has further obscured what happened. The representative offers a qualified assurance: if the company was the source, the recipient would have been someone—or an organization—it judged trustworthy, not an arbitrary third party.

Kaga asks whether the company keeps a list of those recipients. It has no official list, but the representative has assembled one for the inquiry, explaining that preparing it took time. This detail makes the practical limits of information governance concrete: a retrospective account depends on reconstructing records and institutional memory, and the resulting list is not an established, complete register.

Significance in the investigation

The law gives the investigators a specific institutional channel to examine as they trace how Kaga’s private address may have become known. Yet the company’s answer neither confirms nor rules out a disclosure. Its safeguards narrow the possible route to a trusted recipient, while elapsed time and incomplete recordkeeping leave the decisive fact unresolved. The episode thus treats privacy protection as a real procedure with boundaries and exceptions, not as a guarantee that information can never circulate.