問20
頻出度★★★
個人情報を他社に渡した事例のうち, 個人情報保護法において, 本人の同意が必要なものはどれか。
平成24年度 秋期 ITパスポート試験 問20
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 20
- ア
正解 The correct answer is “ア”. The Act on the Protection of Personal Information in principle prohibits a Personal Information Handling Business Operator from providing personal data to a third party without obtaining the individual's prior consent (restriction on third-party provision). The important point here is that even a parent company, a subsidiary, or a group company counts as a “third party” as long as it is a separate legal entity. In ア, customer information is handed to the parent company for the sales-promotion purpose of introducing the parent company's new products, which amounts to providing it to a separate legal entity beyond the scope of the purpose of use that the company originally stated. It is neither outsourcing nor joint use, and it does not fall under an emergency exception such as protecting life or bodily safety, so the individual's consent is required.
Incorrectイ
Incorrect. Handing data to a data-entry contractor in order to outsource the work of creating a customer list is “entrusting the handling of data within the scope necessary to achieve the purpose of use”, and the contractor is not legally a “third party”. The individual's consent is therefore not required (although the outsourcing company bears responsibility for supervising the contractor).
Incorrectウ
Incorrect. Recovering products subject to a recall that pose a risk to physical safety falls under “a case where it is necessary to protect the life, body, or property of a person and it is difficult to obtain the individual's consent”, so as an exception to the restriction on third-party provision, the information may be provided to the manufacturer without the individual's consent.
Incorrectエ
Incorrect. Outsourcing the delivery of invoices is the outsourcing of work necessary to achieve the original purpose of use, namely billing, and the delivery company is a contractor rather than a “third party”. The individual's consent is therefore not required.
ここがポイント
- Restriction on third-party provision: providing personal data to a third party requires the individual's consent in principle. Even a parent company or a subsidiary counts as a “third party” if it is a separate legal entity.
- Categories where consent is not required: outsourcing within the scope necessary to achieve the purpose of use, business succession, and joint use do not count as a “third party”; in addition, cases based on laws and regulations, and cases where it is necessary to protect the life, body, or property of a person and it is difficult to obtain the individual's consent (such as responding to a recall) are exceptions.
用語