M社は，テレビ番組で商品を紹介し，電話で注文受付を行う通信販売の会社である。M社は，一部地域を除き，東日本エリアと西日本エリア向けに別々のテレビ番組を放送し，地域に関連した商品を紹介して，東西それぞれの電話受付センタで注文受付を行っている。 M社では来年度の施策として，売上増加を目的に，全国ネットのテレビ番組に変更して新たに数量限定の商品を特別価格で提供する特売コーナを設けることと，運用コスト削減を目的に，電話受付センタを1か所に集約することを計画している。 M社の企画部門のYさんは，運用管理部門から電話受付センタの運用データを，販売部門から商品情報をそれぞれ入手し，M社で計画している施策について，実施した場合の効果を〔効果予測する項目〕に従って検討するように上司から指示された。 また，入手する運用データ及び商品情報は社外秘の情報であり，M社の社外秘の情報の取扱いを定めた〔データ管理要領〕に従って取り扱うように指示された。 〔効果予測する項目〕 来年度の施策による効果を，次の項目について試算する。 ① 電話受付センタを集約することで削減可能なオペレータ数と削減費用 ② 特売コーナの新設で増加する利益 なお，来年度の施策によって1日の平均電話受付件数は，現在の東西の両電話受付センタで受け付けている件数の合計の5%増になるものとする。 〔データ管理要領〕 データを受領した場合，データの格納された媒体の種類，媒体の個数，受領日，使用目的，使用期間，保管方法，廃棄・返却予定日をデータ管理簿に記載し，後日，受領したデータの取扱内容を追跡可能にすること。 運用管理部門，販売部門から受領したデータを〔データ管理要領〕に沿って取り扱うとき，データの取扱いに関する記述として，適切でないものはどれか。
平成26年度 春期 ITパスポート試験 問85
This question's explanation and your answers so far.
問 85
Incorrectア
This is appropriate handling, so it is not the inappropriate one. Even if the content of the data is the same, there are two physical media, a CD-R and a USB memory, and both are subject to management, return, and disposal. Recording in the log that two types of media were received prevents management gaps such as returning only one of them while the other stays on hand. Recording each medium separately is in fact the preferable response.
- イ
正解 The correct answer is イ. First, note that this is a negative-form question asking which description is NOT appropriate. A data management log (a ledger of received data) is created in order to track the whole flow of data from receipt, through use, to return or disposal. For that reason, the rule is that at the moment data is received you record when, from whom, which data, on what medium, and for what purpose of use it was received. In イ, the data was returned after it turned out that it could not fulfill the intended purpose of use, but until it was returned that data really was in the hands of the operations management department. “It was before we used it” is not a valid reason to skip recording; both the fact of receipt and the fact of return must be recorded. If no record is left, no one can trace that the data was once held by this department, and if a suspicion of loss or leakage arises later, its location and the route by which it was handed over cannot be confirmed. Therefore the handling in イ is inappropriate.
Incorrectウ
This is appropriate handling, so it is not the inappropriate one. Using data for a purpose other than the purpose of use recorded in the log is use beyond the stated purpose, and it must not be used that way as is. By first returning the data, then receiving the same data again under the new purpose of use and recording that in the log, the description in the log and the actual purpose of use are kept consistent. The procedure looks somewhat roundabout, but it follows the guidelines and is the correct response.
Incorrectエ
This is appropriate handling, so it is not the inappropriate one. Here only a request to obtain the data was made, and the request was canceled before receipt, so the data never reached the operations management department at all. The data management log is a ledger for managing the whereabouts of data that has been received; since no receipt ever occurred, there is nothing to record. This differs decisively from イ, where the data was actually received but not recorded, on exactly this one point of whether or not it was received.
- A data management log is a ledger for tracking the data lifecycle: receipt, use, then return or disposal. The fact of receipt must always be recorded regardless of whether the data was actually used, and returns and disposals are recorded in the same way. Conversely, data that was never received (for example, when the request was canceled) is not subject to recording.
- Received data may be used only within the scope of the purpose of use recorded in the log (use beyond the stated purpose is prohibited). When the purpose changes, you keep the description in the log consistent with actual use, for example by returning the data and receiving it again. This way of thinking is also shared with the safety management measures required by laws such as the Act on the Protection of Personal Information.