問25
頻出度★★★
次の事例のうち, 個人情報保護法の規制の対象にならないものはどれか。
平成30年度 秋期 ITパスポート試験 問25
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 25
Incorrectア
A financial product sales company is a personal information handling business operator, and it obtained the alumni contact list—which is personal information—and used it for solicitation. Not publicizing the purpose of use nor notifying the individuals is, rather, an example of violating the regulation, so it clearly falls under the regulation of the Act on the Protection of Personal Information. Therefore it is not a case that is “not subject to regulation.”
Incorrectイ
The neighborhood association chairperson who runs a shop is a business operator, and he diverted the personal information of the signers collected in the petition campaign to a purpose different from the original one (the petition campaign)—namely, sending out advertising flyers for his own shop. This constitutes use beyond the stated purpose by a personal information handling business operator and is therefore subject to regulation, so it is incorrect.
Incorrectウ
An auto repair shop is a personal information handling business operator, and it used the customer information learned while towing the broken-down vehicle for soliciting satellite broadcasting—a purpose different from the original one of repair. This constitutes use beyond the stated purpose by a personal information handling business operator and is therefore subject to regulation, so it is incorrect.
- エ
正解 What the Act on the Protection of Personal Information regulates is the “personal information handling business operator”, that is, a private-sector operator that uses a personal information database or the like for business purposes. The actor in エ is the police, and administrative agencies such as the police do not fall under the “personal information handling business operator” defined by this Act (which targets the private sector); at that time, administrative agencies were covered by a separate law. Note that protecting a person's life or body is a ground for exceptions that allow use beyond the stated purpose or provision to third parties without the person's consent; it is not a reason the Act does not apply (the 2017 amendment abolished the 5,000-record threshold, so even small bodies such as neighborhood associations became personal information handling business operators). Therefore, エ is not subject to regulation under the Act on the Protection of Personal Information, and this is the correct answer.
ここがポイント
- What the Act on the Protection of Personal Information regulates is the “personal information handling business operator”—a private-sector operator that uses a personal information database or the like for business purposes. Administrative agencies such as the police were, at that time, covered by a separate law rather than this Act, and thus fall outside its regulation.
- Using personal information that a business operator has obtained beyond the scope of the purpose of use that was specified and notified in advance (use beyond the stated purpose), or obtaining and using it without publicizing or notifying the purpose of use, is subject to regulation.
用語