Well, I had a vague idea about this from the beginning, but it's disappointing to think that it's really that lax. Article 23 of the Personal Information Protection Act reads as follows: Article 23: A personal information handling business entity shall not provide personal data to a third party without the prior consent of the individual, except in the following cases:
Further display Is the Personal Information Protection Act really that lenient?