問27
頻出度★★★
取得した個人情報の管理に関する行為 a～c のうち, 個人情報保護法において, 本人に通知又は公表が必要となるものだけを全て挙げたものはどれか。 a 個人情報の入力業務の委託先の変更 b 個人情報の利用目的の合理的な範囲での変更 c 利用しなくなった個人情報の削除
令和元年度 秋期 ITパスポート試験 問27
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 27
Incorrectア
It is wrong in listing only a (changing the contractor to whom the personal information data-entry work is outsourced). For a change of contractor, the outsourcing itself is treated as an exception that does not constitute third-party provision, so notification or public announcement to the individual is not required. What is required is b, not a.
Incorrectイ
It is wrong in listing a and b. While b (changing the purpose of use) requires notification or public announcement, a (changing the contractor) carries no such obligation. Because it includes the unnecessary a, it is inappropriate.
- ウ
正解 The correct answer is choice “ウ”, which lists only b. Under the Act on the Protection of Personal Information, when the purpose of use is changed after personal information has been acquired, the changed purpose of use must be notified to the individual or publicly announced. As long as the change is within a reasonable scope, the individual's consent is not required, but the “notification or public announcement” is required. Actions a and c carry no obligation to notify or publicly announce to the individual, so the only one required is b. Therefore choice “ウ”, which lists only b, is correct.
Incorrectエ
It is wrong in listing b and c. While b requires notification or public announcement, c (deleting personal information that is no longer used) is only a best-effort obligation, and there is no obligation to notify or publicly announce to the individual that the information has been deleted. Because it includes the unnecessary c, it is inappropriate.
ここがポイント
- Under the Act on the Protection of Personal Information, when the purpose of use is changed, there is an obligation to “notify” the individual of, or to “publicly announce”, the changed purpose of use (within a reasonable scope the individual's consent is not required, but notification or public announcement is required).
- Keep in mind the distinction that changing the contractor, and deleting personal information that is no longer used, carry no obligation to notify or publicly announce to the individual.
用語