問2
頻出度★★★
個人情報保護法において, “個人情報”の対象となるものはどれか。
平成21年度 春期 ITパスポート試験 問2
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 2
Incorrectア
A company's name, telephone number, and address are information that identifies a corporation (an organization), not information about an individual. What the Personal Information Protection Act protects is information about a living “individual”, so information about the corporation itself is not personal information. Note, however, that even within corporate information, if it contains the name or e-mail address of an individual contact person, that part does become personal information.
Incorrectイ
Even though the questionnaire was collected on a named basis, the report created by aggregating only the responses no longer retains identifying information such as names, and the figures it records do not let you determine whose answer is whose. Through the processing step of aggregation it has reached a state in which individuals can no longer be identified, so the report itself is not personal information. The original signed answer sheets that the aggregation was based on, however, do carry names and therefore are personal information.
- ウ
正解 The correct answer is ウ. Under the Personal Information Protection Act, “personal information” means information about a living individual that can identify that specific individual by name, date of birth, or other description (including information that can easily be cross-referenced with other information and thereby identify the individual). A customer ledger records the name, date of birth, and address; the name alone already tells you whose information it is, and combining it with the date of birth and address makes identifying the individual even more certain. Because it satisfies both conditions — it is information about a living individual, and it can identify a specific individual — it counts as personal information. Note that a company using such a customer ledger in its business is a Personal Information Handling Business Operator and bears obligations such as specifying and notifying the purpose of use, taking security control measures, and restricting provision to third parties.
Incorrectエ
The distribution of the number of customers by age group and the sales amounts are statistical information that groups customers by the category of age group; they do not point to any individual customer. Figures such as how many customers are in their twenties and how much the sales were cannot identify any specific person, so this is not personal information. It is a typical example of information produced by statistically processing personal information so that individuals can no longer be identified (statistical information), which falls outside the scope of protection.
ここがポイント
- The definition of personal information has two conditions: it is information about a living individual, and it can identify a specific individual. A name is the most representative piece of identifying information, so a ledger or roster containing names counts as personal information. Information that can easily be cross-referenced with other information to identify someone is included as well, and a Personal Identification Code such as a passport number or a driver's license number is personal information on its own.
- Information about a corporation itself (company name, location, and so on), together with statistical or aggregated information from which individuals cannot be identified, falls outside the protection of the Personal Information Protection Act. When a question asks whether something qualifies as personal information, sort it out on two points: whether the subject is an individual or a corporation, and whether identifiability still remains or has been lost through aggregation.
用語