問30
頻出度★★★
プライバシーマークを取得している事業者が, 個人情報保護に関する理念や取組みを内外に宣言する文書はどれか。
平成23年度 特別試験 ITパスポート試験 問30
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 30
Incorrectア
Personal information protection guidelines are prepared by administrative bodies such as the Personal Information Protection Commission, or by industry associations, in order to show how the law should be interpreted and what concrete measures businesses ought to take, and they are presented to businesses. In other words, the writer of the document is the supervising authority or the industry association, and the business is on the side that must comply with it. It is not a document in which a business declares its own philosophy and initiatives in its own words, so it does not match the condition in the question.
Incorrectイ
Personal information protection regulations are internal company rules that, in order to put the philosophy set out in the policy into practice, define the management structure at each stage of acquiring, using, storing, providing, and disposing of personal information, the roles of the persons in charge, the rules employees must follow, and the measures to be taken when they are broken. In the document hierarchy it sits below the policy, and it applies only to employees inside the company; it is an internal set of rules and is not a document meant to be declared to the outside. It is therefore wrong.
- ウ
正解 The correct answer is ウ. A personal information protection policy (privacy policy) is the top-level document in which a business states, under the responsibility of its representative, what beliefs it holds about protecting personal information and what initiatives it carries out, and declares them both inside and outside the company. JIS Q 15001 (Personal Information Protection Management Systems — Requirements), the standard on which the Privacy Mark system is based, requires a business to first establish this policy in documented form, make it known to all employees, and also keep it available to the general public at any time, for example by posting it on its website or displaying it at its offices. Typical contents of the policy include: acquiring, using, and providing personal information appropriately in light of the nature and scale of the business; taking measures to prevent use beyond the stated purpose; complying with laws, guidelines set by the state, and other norms; taking measures to prevent and correct leakage, loss, or damage of personal information; setting up a contact point for complaints and inquiries; continually improving the management system; and the date of establishment, the date of the latest revision, and the name of the representative. Only this personal information protection policy matches the condition asked in the question — a document that declares the philosophy and initiatives both internally and externally, that is, a top-level document serving both internal communication and external publication. The other choices are either operational documents used inside the organization or guidelines presented to businesses by an outside body, not a declaration by the business itself. Therefore ウ is correct.
Incorrectエ
A personal information protection manual is a practical handbook that writes out, as concrete procedures for the staff in charge, how the rules set in the regulations are actually carried out in daily work. It mainly describes task-level matters such as how to receive application forms, how to keep storage media locked, and the flow for handling a request for disclosure of personal information. In the document hierarchy it sits even below the policy and the regulations. It is not a document that sets out a philosophy and declares it inside and outside the company, so it does not satisfy the condition in the question.
ここがポイント
- Definition of the personal information protection policy (privacy policy) — the top-level document that puts the basic beliefs and initiatives on protecting personal information into writing in the name of the representative, and is both made known to employees and published to the general public. It is a requirement for obtaining the Privacy Mark under JIS Q 15001, and it covers compliance with laws, a ban on use beyond the stated purpose, security control measures, a contact point for complaints and inquiries, continual improvement, and so on.
- Document hierarchy of a personal information protection management system (PMS) — from the top down: policy (what the company aims for) → regulations (what must be observed inside the company) → manuals and procedure documents (how to carry it out) → forms and records (evidence of what was done), each level more concrete than the one above. Remembering that the policy is what is published to the outside while the regulations and everything below them are run inside the company lets you separate the choices. Guidelines are something different from this hierarchy: they are advice presented to businesses by administrative bodies or industry associations.
用語