This question's explanation and your answers so far.
個人情報取扱事業者における個人情報の管理に関する事例 a～d のうち, 個人情報保護に関する管理上, 適切でないものだけを全て挙げたものはどれか。 a 営業部門では, 許可された者だけが閲覧できるように, 顧客リストを施錠管理できるキャビネットに保管している。 b 総務部門では, 住所と氏名が記載された社員リストを, 管理規程を定めずに社員に配布している。 c 販促部門では, 書店で市販されている名簿を購入し, 不要となったものは溶解処理している。 d 物流部門では, 運送会社に配送作業を委託しており, 配送対象とはならない顧客も含む全顧客の住所録をあらかじめ預けている。
“a, b”. It is correct that b is inappropriate, but a stores the customer list in a locked cabinet so that only authorized persons can view it, which is appropriate as an access-restriction security control measure. This option is wrong because it includes the appropriate case a on the inappropriate side.
“b, c”. It is correct that b is inappropriate, but c purchases a commercially available directory from a bookstore and reliably disposes of the unneeded copies by pulping, which is appropriate as a disposal method. This option is wrong because it includes the appropriate case c and also omits the inappropriate case d.
正解 The question asks for the option that lists all and only the cases that are inappropriate. The inappropriate ones are the two cases b and d, so “ウ (b, d)”, which lists exactly these, is correct. b is inappropriate because the general affairs department distributes an employee list containing personal information such as addresses and names to employees without establishing handling rules (management rules), lacking the security control measures needed to prevent leakage or use beyond the intended purpose. d is inappropriate because the logistics department has entrusted the shipping company handling delivery, in advance, with an address book of all customers, including customers who are not delivery targets, that need not have been handed over at all, thereby providing personal data beyond the scope required for the work (what is handed to a contractor should be kept to the necessary minimum). On the other hand, a (limiting viewers with a locked cabinet) and c (reliably disposing of a commercially available directory by pulping) are both appropriate management, so they are not counted as inappropriate.
“c, d”. It is correct that d is inappropriate, but c is the pulping of a commercially available directory, which is appropriate. This option is wrong because it includes the appropriate case c on the inappropriate side and omits case b, which is actually inappropriate.