問65
頻出度★★★
顧客の氏名, 住所などが記載された住所録の取扱い a～d のうち, 個人情報保護の観点から適切なものだけを全て挙げたものはどれか。 a 顧客から本人の登録内容の確認希望があっても, 情報の保護を理由に開示しない。 b 住所録から全員の氏名と住所を抽出した一覧を作成し, それを顧客全員に配布して誤りがないことを確認してもらう。 c 住所録のデータを書き込んだCD-ROMを破棄するときには破砕する。 d 住所録のデータをファイルに保存するときには暗号化する。
平成28年度 春期 ITパスポート試験 問65
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 65
Incorrectア
It is wrong because it includes a. Item a is the response of “not disclosing the registered information even when the customer wishes to confirm their own registered content,” but a person has the right to request disclosure of their own personal data, and the operator is in principle obligated to comply. Refusing to disclose to the person under the pretext of “protecting the information” is inappropriate, so ア, which includes a, is incorrect.
Incorrectイ
It is wrong because it includes the inappropriate item a and also lacks the appropriate item c. Item a is the inappropriate response of refusing disclosure to the person, and the moment it is included, the condition of “only the appropriate items” is not met.
Incorrectウ
It is wrong because it includes b. Item b is the response of creating a list that extracts everyone's names and addresses and distributing it to all customers, but this is the act of broadly providing and leaking other people's personal information to third parties without the individuals' consent, which is inappropriate. Error checking should be done by methods that do not cause leakage, such as inquiring with each person individually, so ウ, which includes b, is incorrect.
- エ
正解 The correct answer is エ (c, d). The items that are appropriate as “security control measures” for personal information are c and d. Item c shreds the CD-ROM on which the address book data was written when disposing of it, so that the data cannot be read; this prevents information leakage at disposal and is therefore appropriate. Item d encrypts the data when saving it to a file, so that even if the data should leak, its contents are hard to read; this is therefore appropriate. Option エ, which contains only these two items, matches “listing all and only the appropriate items.”
ここがポイント
- Security control measures for personal information: when disposing of storage media, render them unrecoverable by shredding and the like, and encrypt data when saving it to a file — this is the appropriate handling.
- A person has the right to request disclosure of their own personal data and the operator is obligated to comply; on the other hand, distributing or providing personal information to others without the person's consent is inappropriate.
用語