問10
頻出度★★★
個人情報取扱事業者が個人情報を第三者に渡した事例のうち, 個人情報保護法において, 本人の同意が必要なものはどれか。
平成26年度 春期 ITパスポート試験 問10
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 10
Incorrectア
Providing information to the police based on a search warrant falls under the case “based on laws and regulations”, so it can be provided without the individual's consent. Since a warrant is a legally binding ground, there is no need to wait for the person's consent, and the exception applies.
Incorrectイ
Sharing information about a household where a child may be abused among the child guidance center, the police, schools, and others falls under the case “necessary to protect a person's life or body where obtaining the individual's consent is difficult”, as well as the case “especially necessary to promote the sound development of children”. If consent were sought from the abusing side, protecting the child would become impossible, so sharing without consent is permitted.
- ウ
正解 The correct answer is ウ. Under the Personal Information Protection Act, a Personal Information Handling Business Operator must in principle obtain the individual's prior consent (opt-in) before providing personal data to a third party. The headquarters of a franchise organization and its member stores are separate, independent business operators with different legal personalities, even though they operate under the same brand, so from the member store's viewpoint the headquarters is a “third party”. Therefore, handing over customer personal information that the member store itself collected to the headquarters is a third-party provision. Moreover, the reason “because headquarters made a request” is not a provision based on laws and regulations, nor protection of life, body, or property, nor promotion of the sound development of children, nor cooperation with a national government body; it matches none of the exceptions that make consent unnecessary. Consent from the individual is therefore required. Note that sharing can still be lawful if consent is obtained after clearly stating sharing with the headquarters as a purpose of use in advance, or if the requirements for joint use are met (notifying or publicizing the fact of joint use, the data items, the scope of joint users, the purpose of use, and the person responsible for management).
Incorrectエ
Sharing information about anti-social forces and about malicious individuals who interfere with business operations among companies falls under the case “necessary to protect a person's life, body, or property where obtaining the individual's consent is difficult”. Asking that individual for consent is not realistic in the first place, and trying to obtain it would defeat the purpose of preventing damage, so sharing without consent is allowed as an exception.
ここがポイント
- Principle of third-party provision: a Personal Information Handling Business Operator must in principle obtain the individual's prior consent (opt-in) before handing personal data to a third party. Any separate legal entity counts as a “third party”, even a parent company, franchise headquarters, or group company, which is a trap that appears often.
- Memorize the four exceptions where consent is unnecessary: (1) based on laws and regulations (such as cooperating with an investigation under a warrant); (2) necessary to protect a person's life, body, or property where obtaining the individual's consent is difficult (such as sharing information on anti-social forces or malicious individuals); (3) especially necessary for improving public health or promoting the sound development of children where obtaining the individual's consent is difficult (such as sharing child-abuse information); (4) necessary to cooperate with a national or local government body.
用語