問27
頻出度★★★
個人情報保護法における個人情報に該当するものだけを全て挙げたものはどれか。 a 顔がはっきり映った防犯カメラの映像 b 従業員名が記載された人事考課表 c 話者が判別できる通話記録の音声
平成25年度 春期 ITパスポート試験 問27
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 27
- ア
正解 The correct answer is ア, “a, b, c” — all three qualify as personal information. Under the Act on the Protection of Personal Information, personal information means information about a living individual that can identify a specific individual by the name, date of birth, or other description contained in it (including information that cannot identify anyone on its own but can be easily cross-referenced with other information and thereby identify a specific individual), or information that contains a Personal Identification Code. The key point is that the test is whether a specific individual can be identified, not the medium or format in which the information is recorded. A name list written in text is not the only kind of personal information; video and audio are covered as well. In a, surveillance camera footage that clearly shows a person's face reveals who that person is from their facial features, so it is personal information (and facial recognition data, which converts facial features into a form that computers can process, is itself a Personal Identification Code). In b, a personnel evaluation sheet on which an employee's name is recorded identifies a specific individual through that name, and the evaluation content is also information about that person, so it is personal information. It is not exempt simply because it is information about the company's own employee. In c, audio of a call recording from which the speaker can be identified lets you determine whose statement it is from the voice, so it is personal information too (a voiceprint, which turns voice features into data, is also a Personal Identification Code). Therefore ア, which lists all of a, b, and c, is correct.
Incorrectイ
Treating a and c as personal information is right, but leaving out b is wrong. A personnel evaluation sheet is an evaluation document created and used inside the company, yet if an employee's name is recorded on it, that description identifies a specific individual, so it is personal information. Moreover, the evaluations and comments themselves are information about that employee. The Act on the Protection of Personal Information does not protect only information about customers and business partners; information about a company's own employees and job applicants is covered in the same way. The idea that a document is out of scope because it is an internal document, or because it holds work-related evaluation information, is a misunderstanding, so a combination that drops b is incomplete.
Incorrectウ
Counting only b as personal information and excluding a and c is wrong. The reasoning was probably that only b qualifies because it contains text in the form of a name, but whether something is personal information is not decided by whether it is written as text — it is decided by whether a specific individual can be identified. The surveillance camera footage in a clearly shows the person's face, and anyone who watches it can tell who that person is, so it is personal information. The call recording audio in c is the same: listening to it lets you tell who the speaker is, so it too is personal information. By treating video and audio as out of scope, this option narrows the definition of personal information to text alone, which is where it goes wrong.
Incorrectエ
Saying that none of them qualify is wrong. Each of a, b, and c satisfies the condition that a specific individual can be identified from the information, so all three are personal information. Surveillance camera footage shot for crime prevention, a call recording made to check the quality of service, and a personnel evaluation sheet that stays inside the company do not stop being personal information because of the purpose for which they were obtained or the scope in which they are used. Purpose and intended use bear on the rules for handling the data (specifying the purpose of use, taking security control measures, and so on), which is a separate question from whether the information qualifies as personal information.
ここがポイント
- Get the definition of personal information exactly right. Personal information is information about a living individual that can identify a specific individual by a name, date of birth, or other description (including information that can be easily cross-referenced with other information and thereby identify someone), or that contains a Personal Identification Code. The dividing line is whether identification is possible; the medium or format of the record does not matter. So it covers not only paper name lists and databases but also video showing a face, audio in which the speaker can be told apart, and photographs of the person. Personal Identification Codes include codes converted from physical characteristics such as facial recognition data, voiceprints, fingerprints, and irises, as well as the My Number, passport numbers, and driver's license numbers.
- Do not confuse the range of people covered with the role that purpose plays. The Act on the Protection of Personal Information covers not only customer information but broadly any information about living individuals, including employees, job applicants, and the contact persons at business partners, so an internal document such as a personnel evaluation sheet must also be managed as a document that contains personal information. Also, the fact that information was obtained for a purpose such as crime prevention or quality management does not affect whether it qualifies as personal information. Purpose is a point that comes up on the handling-rules side instead: specifying and notifying the purpose of use, whether the data may be provided to third parties, and security control measures.
用語