A社では，個人情報保護法に従って，個人情報を取り扱っている。Bさんが所属する営業部では，個人の顧客がインターネット上のA社のWebページに会員登録することで，商品購入ができるという事業を開始することになった。そこで，Bさんは会員登録をするWebページの仕組みとして，次の事項を考えた。 〔会員登録をするWebページの仕組み〕 ① 個人情報の利用目的を記述したWebページを表示し，顧客が同意ボタンを押すと，個人情報を入力するWebページに移動する。 ② 会員登録の項目としては，氏名，住所，電話番号，生年月日，性別，メールアドレス，ID及びパスワードがあり，これらは必ず入力してもらう。メールアドレスとパスワードについては，誤入力を防ぐために，同じ情報を2度入力してもらう。 ③ Webページでの個人情報の入力が終了し，送信ボタンを押した後，入力情報を確認するWebページを表示し，顧客に入力の間違いがないかを確認してもらう。このとき，入力されたIDが他の会員によって既に登録されている場合，変更を求める。 ④ 顧客が入力情報を確認し，登録ボタンを押した後，登録したメールアドレス宛に，A社の会員として登録された旨を伝える電子メール（以下，メールという）を送信する。 ⑤ ②及び③における顧客のPCとA社のWebサーバとのデータのやり取りは，暗号化による通信を行う。 次に示す〔個人情報の適正管理に関する規程〕の各項について，〔会員登録をするWebページの仕組み〕の①～⑤の中で，各項とそれを遵守するために役立つ仕組みの組合せとして，適切なものはどれか。 〔個人情報の適正管理に関する規程〕 第1項 利用目的の達成に必要な範囲内において，個人情報を正確かつ最新の内容に保つように管理しなければならない。 第2項 取り扱う個人情報の漏えい，滅失又はき損の防止その他の個人データの安全管理のために必要かつ適切な措置を講じなければならない。 第3項 従業者に個人情報を取り扱わせるに当たっては，当該個人情報の安全管理が図られるよう，当該従業者に対する必要かつ適切な監督を行わなければならない。 第4項 個人情報の取扱いの全部又は一部を委託する場合は，その取扱いを委託された個人情報の安全管理が図られるよう，委託を受けた者に対する必要かつ適切な監督を行わなければならない。
平成24年度 秋期 ITパスポート試験 問98
This question's explanation and your answers so far.
問 98
Incorrectア
Clause 1 requires that “within the scope necessary to achieve the purpose of use, personal information be managed so as to be kept accurate and up to date” — it is the clause about maintaining the accuracy and currency of the data content. What helps with this is ②, which has the same information entered twice to prevent input errors, and ③, which has the customer check the entered content before it is sent. ① is the mechanism that displays a web page describing the purpose of use of personal information and has the customer press the consent button; it concerns making the purpose of use clear and obtaining the person's consent. It helps with notifying the purpose and obtaining consent, but it does not directly lead to the registered information being kept accurate and up to date, so the combination of Clause 1 and ① is not appropriate.
- イ
正解 The correct answer is “イ” (the combination of Clause 2 and ⑤). Clause 2 requires that “necessary and appropriate measures must be taken to prevent leakage, loss, or damage of the personal information handled, and for other safe management of personal data” — in other words, it is the clause that calls for safety management measures. ⑤ is the mechanism whereby “for the data exchange between the customer's PC and Company A's web server in ② and ③, communication is performed using encryption”, and this is exactly a technical safety management measure: it keeps personal information such as name, address, telephone number, date of birth, and password from being read even if it is intercepted while flowing over the Internet. Therefore “Clause 2 = ⑤” is an appropriate combination of a clause and a mechanism that helps comply with it, and this is the correct answer.
Incorrectウ
Clause 3 requires “necessary and appropriate supervision over employees when having them handle personal information” — that is, it is the clause calling for education and supervision of people inside the company (employees), a personnel-related safety management measure. ③ is a mechanism concerning input on the customer's side: it displays a web page for confirming the entered content so that customers themselves can check for mistakes, and it requests a change if the entered ID has already been registered by another member. It is not at all a measure for supervising Company A's employees, so the combination of Clause 3 and ③ is not appropriate (③ instead helps with maintaining the accuracy required by Clause 1).
Incorrectエ
Clause 4 requires “necessary and appropriate supervision over the entrusted party when all or part of the handling of personal information is entrusted to another party” — that is, it is the clause calling for supervision of an outside contractor. ④ is the mechanism that, after the customer presses the register button, sends an e-mail to the registered e-mail address informing the customer that they have been registered as a member of Company A; its role is to notify the person of the fact of registration so that they can notice a fraudulent registration. This is not a situation where the handling of personal information is entrusted to an outside party, and it has nothing to do with supervising an entrusted party, so the combination of Clause 4 and ④ is not appropriate.
- A representative example of safety management measures (technical, physical, personnel-related, and organizational) is encryption of communications. Encrypting the segment where personal information flows over a network, using SSL/TLS or the like, counts as a technical safety management measure for preventing leakage.
- Remember the clauses on proper management in the Act on the Protection of Personal Information by separating them according to subject and risk. Clause 1 = maintaining the accuracy and currency of the data content, Clause 2 = safety management measures themselves, Clause 3 = supervision of one's own employees, Clause 4 = supervision of entrusted parties. If you identify “whose” risk and “which” risk each mechanism in the question addresses, you can make the match.