問33
頻出度★★★
個人情報保護法における, 個人情報取扱事業者の義務はどれか。
平成28年度 秋期 ITパスポート試験 問33
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 33
- ア
正解 The Act on the Protection of Personal Information requires a personal information handling business operator to take “security control measures” to prevent the leakage, loss, and so on of the personal data it handles. As part of this, when the handling of personal data is outsourced to an external contractor, the law clearly makes it an obligation to “supervise the contractor” — that is, to check whether the contractor is properly implementing security control measures. Therefore, choice “ア”, “Supervise the contractor to whom work is outsourced so that the safe management of personal information is ensured,” is correct.
Incorrectイ
The Act on the Protection of Personal Information requires the business operator to take appropriate security control measures on its own, but it does not make it an obligation to “undergo a system audit conducted by the government (the supervisory authority).” Undergoing a government audit is not a legal obligation.
Incorrectウ
The Act on the Protection of Personal Information does not, as a general obligation, require filing a “notification” with the supervisory authority regarding ordinary use of personal information. While specifying and notifying the purpose of use are required, there is no prior-notification system for use.
Incorrectエ
The Privacy Mark is a voluntary system in which a third-party organization certifies that a business operator has a system in place to handle personal information appropriately; obtaining it is not a legal obligation. Not obtaining it does not constitute a legal violation.
ここがポイント
- Among the obligations under the Act on the Protection of Personal Information, “security control measures” include supervision of employees as well as “supervision of the contractor” (even if handling is outsourced, the business operator is not relieved of responsibility).
- Undergoing a government audit, filing a notification with the supervisory authority, and obtaining the Privacy Mark are all not legal obligations (the Privacy Mark is a voluntary third-party certification).
用語