This question's explanation and your answers so far.
問91
頻出度★★☆
日用雑貨の製造を行う W 社では，業務拡大に向けて販売管理のためのシステム（以下，販売管理システムという）構築を予定している。システム構築のメンバである G 君は，上司の指導の下に RFP を作成して，X 社から提案を受けた。RFP の概要と X 社からの提案は，次のとおりである。
なお，W 社にとって重要な顧客情報の扱いについては，契約時に必要な処置を講じることにした。
〔RFP の概要〕
システムの目的：製造した商品に関して，顧客に対する受注から出荷までの管理を行う。
システムの要件：商品数は，当初は 2,000 品目で，最大 5,000 品目を管理する。顧客数は，当初は 500 社で，最大 2,000 社を管理する。1 日の受注件数は，最大 200 件とする。弊社の規模と業務に合った適切なソフトウェアパッケージの利用を前提とする。
納期：発注から 6 か月以内とする。
〔X 社からの提案〕
導入費用：700 万円
前提条件：Y 社の販売管理ソフトウェアパッケージと Z 社のデータベースソフトを利用し，不足する機能の開発を行います。サーバは CPU が一つのものを 2 台導入します。1 台は本番機とし，もう 1 台は，本番機に障害が発生した場合に稼働させるコールドスタンバイ機とします。
契約条件：要件定義からシステムテストまでの一括請負契約とします。弊社の開発物に関する瑕疵担保期間は，検収後 6 か月とします。
導入期間：4 か月
保守：保守契約を結ぶことによって，導入したシステムに関する問合せ，障害の切分けの対応を行います。
販売管理システムの開発で顧客情報を X 社に直接利用させるために, W 社が行っておくべきことはどれか。
出典 平成23年度 特別試験 ITパスポート試験 問91
解説
問 91
//
×Incorrectア
A lump-sum turnkey contract is an agreement about the development work itself — ordering the whole set of development work from requirements definition through system testing from Company X, with Company X bearing responsibility for completing it — and it does not lay down rules for handling information. Even if such a contract is signed early, nothing is settled about for what purpose and how far Company X may use the customer information, whether it may pass it to a third party, or how it must dispose of it afterwards. If anything, signing promptly means placing the order without checking whether the estimate and the requirements are sound, which is undesirable for the client side. It does not answer the point the question asks about, namely the protection of customer information.
×Incorrectイ
Handing over detailed customer information data at a stage before the formal contract, with no confidentiality terms agreed, is the worst thing to do. Without a contract, Company X has no obligation to protect the information, and if a leak or use beyond the intended purpose occurs, there is no basis for holding it responsible. Furthermore, if the proposal is not adopted and no contract is reached, the customer information that was handed over may remain with the vendor. This also runs counter to the supervision of contractors required by the Act on the Protection of Personal Information, and it cannot be justified on the grounds of making development go smoothly.
○ウ
正解The correct answer is ウ: to prevent the customer information from being leaked externally or handled improperly by Company X, conclude a confidentiality (non-disclosure) agreement with Company X. This question is part of a case in which Company W, a maker of daily household goods, orders the construction of a sales management system from an outside vendor, Company X; the situation here is that Company W is about to let Company X directly handle Company W's customer information for the development work. Customer information is important information for Company W, and letting the outside firm Company X use it directly means putting information that is under Company W's own control into a state where another company's employees can handle it, which creates new risks such as leakage, use beyond the intended purpose, and unauthorized copying. Therefore, before handing over the information, the parties conclude a confidentiality agreement (non-disclosure agreement, NDA) and set down in writing (1) the scope of the confidential information, (2) that the purpose of use is limited to this development project, (3) a ban on disclosure to third parties and on subcontracting, (4) return or deletion of the information when the contract ends, and (5) responsibilities such as damages in the event of a breach. With this in place, Company X also bears a legal obligation as an organization to protect the information, and if a leak should occur, where the responsibility lies is clear. In addition, if the customer information contains personal information such as the names and contact details of staff at business partners, the Act on the Protection of Personal Information obliges the outsourcing party to exercise necessary and appropriate supervision over the contractor, and setting terms by contract is the first step of that supervision. Therefore, what Company W should do before letting Company X directly use the customer information is to conclude a confidentiality agreement with Company X.
×Incorrectエ
Company Y is the vendor of the sales management software package that Company X uses, and a license agreement is an agreement on permitted use — how many copies of that software may be used and up to what scale. Buying licenses matching the number of customers is indeed necessary in order to introduce the system, but it does not thereby restrict how Company X handles the customer information, and it has no effect in preventing information leakage. The question of license scale is the subject of a different question (which combination of licenses Company W should buy) and is unrelated to the measure for protecting customer information that this question asks about.
ここがポイント
A confidentiality agreement (non-disclosure agreement, NDA) is a contract concluded before information is handed over, whenever an outside party is to handle your own company's confidential information or personal information. It defines the scope of the confidential information, limits on the purpose of use, a ban on disclosure to third parties and on subcontracting, return or deletion when it ends, and responsibility in case of breach, thereby imposing on the other party a legal obligation to protect the information.
When the handling of data containing personal information is outsourced, the outsourcing party has a duty to exercise necessary and appropriate supervision over the contractor. The basic means of doing so is setting terms by contract; responses such as handing over the data before any contract exists, or merely arranging the form of contract (contract for work or mandate contract) or a license agreement, do not count as having taken measures to protect the information.