JP2004192173A - Personal information management system and personal information management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a personal information management system for accumulating data under a first-person informed consent so as to be usable while protecting personal information. <P>SOLUTION: Personal identification information 164 and anonymized ID information 165 are retained in an IC card 103-1. When personal information is registered in a server 101 from a terminal 102, it is anonymized by use of the anonymized ID information of the IC card 103-1 and then transmitted to the server 101. In the access to the information in the server 101, its own information is acquired on the basis of the anonymized ID information 165. The risk of leakage of personal information can be reduced, and an information provider can utilize its own information. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a personal information management system and a personal information management method for managing personal information on a server.
[0002]
[Prior art]
Aiming at the development of medicine, research using medical and health-related information such as genetic information, medical examination information, medical records, etc. is being advanced. On the other hand, since such information is personal information including privacy, sufficient handling of personal information protection is required for the handling thereof. Conventionally, as a system for managing and utilizing such personal information, for example, there is a system for analyzing genetic information. Ethical guidelines for human genome and gene analysis research are shown by the Ministry of Education, Culture, Sports, Science and Technology, the Ministry of Health, Labor and Welfare, and the Ministry of Economy, Trade and Industry as operational standards when handling genetic information (see Non-Patent Document 1). In this, in order to use personal information, it is necessary to obtain the consent of the information provider himself / herself, and it is necessary to separate the computer that handles information including information that identifies an individual from other computers That is shown.
[0003]
[Non-patent document 1]
March 2001 Notification No. 1 of Ministry of Education, Culture, Sports, Science and Technology, Ministry of Health, Labor and Welfare and Ministry of Economy, Trade and Industry
[0004]
[Problems to be solved by the invention]
In order to operate the above-mentioned system, it was necessary to obtain a written consent from an information provider and to perform anonymization of removing the collected data from a name and address using a dedicated computer. Therefore, in the conventional system, these operations are troublesome, and it is difficult to collect and utilize a large amount of data. In addition, since a computer having personally identifiable data is disconnected from the network, it has not been considered that the provided information can be used by the information provider itself.
[0005]
SUMMARY OF THE INVENTION An object of the present invention is to provide a personal information management system that can easily accumulate and utilize information for which consent for utilization has been obtained from an information provider while protecting personal information. Another object of the present invention is to provide a personal information management system in which an information provider himself can easily use accumulated personal information.
[0006]
[Means for Solving the Problems]
In order to solve the above-mentioned problems, a personal information management system of the present invention is a system in which personal information is anonymized and managed by a server, and an IC card is used when accessing the server, and has the following features. . (1) The IC card holds personal identification information for identifying the owner of the IC card and anonymized ID information indicating an ID when the owner of the IC card is anonymized. (2) Using personal identification means for confirming that the person using the IC card is the owner of the IC card using personal identification information of the IC card, and using anonymized ID information of the IC card And an anonymized ID confirming means for confirming that the owner of the IC card matches one of the anonymized individuals on the server. (3) Anonymizing means for deleting information such as a name and an address for identifying an individual from personal information, adding anonymous ID information of an IC card to perform anonymization, and sending the anonymized personal information to a server. Have server access means. (4) A server access unit for acquiring personal information of the anonymized individual matched by the anonymized ID confirmation unit from the server. (5) A server access means for deleting personal information of the anonymized individual who has been matched by the anonymized ID confirmation means from the server.
[0007]
The personal information management method according to the present invention is an anonymous method for managing personal information in a server, using an IC card when accessing the server, and identifying the user of the IC card by using personal identification information recorded in the IC card. Using the identity authentication step of confirming that the owner of the IC card matches the anonymous ID and the anonymized ID information recorded on the IC card, confirming that the owner of the IC card matches the anonymized individual on the server Anonymized ID authentication step; anonymizing step of deleting information identifying the individual from the personal information of the IC card owner and adding anonymized ID information recorded on the IC card; Registering information in the server.
[0008]
In addition, the personal information management method of the present invention uses an anonymous personal information managed by a server, uses an IC card when accessing the server, and allows the user of the IC card to use the personal identification information recorded on the IC card. Using the identity authentication step of confirming that the IC card matches the owner of the IC card and using the anonymized ID information recorded on the IC card, the owner of the IC card matching the anonymized individual on the server And an information acquisition step of acquiring anonymized personal information that matches the owner of the IC card.
[0009]
In addition, the personal information management method of the present invention uses an anonymous personal information managed by a server, uses an IC card when accessing the server, and allows the user of the IC card to use the personal identification information recorded on the IC card. Using the identity authentication step of confirming that the IC card matches the owner of the IC card and using the anonymized ID information recorded on the IC card, the owner of the IC card matching the anonymized individual on the server And a canceling step of deleting from the server anonymized personal information that matches the owner of the IC card.
[0010]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Here, a case will be described as an example where information of a medical examination result is handled as personal information.
[0011]
FIG. 1 is a diagram illustrating a configuration example of a personal information management system according to an embodiment of the present invention.
The personal information management system includes a server 101, a terminal 102, and a plurality of IC cards 103-1 to 103-3. The server 101 is installed in a research facility or the like that conducts research based on accumulated personal information. The terminal 102 is installed in a medical examination facility or the like, and manages a result of a medical examination performed in the facility. The plurality of IC cards 103-1 to 103-3 are distributed one by one to each person who has undergone a medical examination. The server 101 includes a CPU 111 that performs processing, an output device 112 such as a display, an input device 113 such as a mouse and a keyboard, a network interface 114 that communicates with other devices, and a storage device 115 such as a memory and a hard disk.
[0012]
The terminal 102 includes a CPU 121 for processing, an output device 122 such as a display, an input device 123 such as a mouse and a keyboard, a network interface 124 for communicating with other devices, a storage device 125 such as a memory and a hard disk, and an IC card. It comprises an IC card reader / writer device 126 for inputting and outputting information. Each of the IC cards 103-1 to 103-3 includes a CPU 131 that performs processing, an input / output interface 132 that performs input and output with an IC card reader / writer, and a storage device 133 that is a memory on the IC card. Programs and data are stored in the storage device 115 of the server 101, the storage device 125 of the terminal 102, and the storage device 133 of the IC cards 103-1 to 103-3, and the CPU (111, 121, 131) is stored as necessary. ) And execute the processing. The storage device 115 of the server 101 holds anonymized ID confirmation means 141, anonymized data management means 142, and data analysis means 143, which are programs, and anonymized data 144, which is anonymized personal information as data. . The storage device 125 of the terminal 102 holds a personal identification unit 151, an anonymization unit 152, a server access unit 153 as a program, and personal information 154 as data. The storage device 133 of each of the IC cards 103-1 to 103-3 includes a personal identification unit 161, an anonymized ID confirmation unit 162, and an anonymization unit 163 as programs, and personal identification information 164 that identifies an IC card owner as data. In the anonymized data 144 of the server 101, anonymized ID information 165 in which an anonymized ID given to the data of the IC card owner is stored.
[0013]
FIG. 4 is a diagram illustrating an example of anonymized data managed by the server in the embodiment of the present invention. The anonymized data 144 of the server 101 manages, for example, a medical examination result which is anonymized personal information in a table shown in FIG. In the table, a serial number 401, an anonymized ID 402, and a medical examination result 403 are recorded.
[0014]
FIG. 5 is a diagram illustrating an example of personal information held by the terminal in the embodiment of the present invention. The personal information 154 of the terminal 102 manages an individual's medical examination result in a format as shown in FIG. 5, for example. ○ In addition to the medical examination result 501-1 of Mr. Yamao, it manages the medical examination results 501-2, 501-3, etc. of the persons who have undergone medical examination at the facility.
[0015]
FIG. 6 is a diagram illustrating an example of the personal identification information and the anonymized ID information held by the IC card in the embodiment of the present invention. The personal identification information 164 and the anonymized ID information 165 of the IC card 103-1 are held, for example, in a form as shown in FIG.
The personal identification information 601 records a password in addition to a name and an ID number. Further, in the anonymized ID information 602, the anonymized ID 402 assigned in the anonymized data 144 of the server 101 is recorded for the data of Mr. Oyama * O.
[0016]
Next, a specific processing procedure will be described using a flowchart.
[0017]
FIG. 2 is a flowchart illustrating an example of a procedure for registering personal information from the terminal to the server in the embodiment of the present invention, and illustrates an example of a method for registering personal information 154 in the terminal 102 to the server 101. . Here, a description will be given of an example of a procedure of registering, in the server 101, a medical examination result 501-1 received by Mr. Yamayama on {///}. At this start point, the anonymized data 144 of the server 101 includes the No. shown in FIG. It is assumed that the row 404 of 5001 does not exist.
[0018]
As a result of receiving a medical examination at the medical examination facility, the terminal 102 of the medical examination facility holds a medical examination result 501-1. If he / she agrees to register this medical checkup result 505-1 in the server 101 of the research facility and use it for research, Mr. Oyama uses his IC card 103-1 as an IC card reader / writer of the terminal 102. Insert at 126. Then, in the personal authentication step 201, it is confirmed that the user of the IC card 103-1 matches the IC card owner indicated by the personal identification information 164 of the IC card 103-1. Here, personal identification is performed using the password in the personal identification information 601. The personal identification means 151 of the terminal 102 displays a password input screen on the display 122, and prompts the user to input a password when agreeing to use of the data.
When Mr. Oyama inputs a password using the keyboard 123, the identity verification unit 151 sends the input password to the IC card 103-1 via the IC card reader / writer device 126. In the IC card 103-1, the password information is received by the input / output I / F 132, the personal identification means 161 compares the password with the personal identification information 601 to confirm the identity, and sends the result back to the terminal 102.
The identity confirmation means 154 of the terminal 102 receives the result and confirms that the user of the IC card 103-1 is the correct Mr. Oyama * O.
[0019]
Next, in the anonymized ID authentication step 202, it is confirmed that the user indicated by the anonymized ID information 165 of the IC card 103-1 matches the person existing in the anonymized data 144 of the server 101. Here, the anonymized ID confirmation unit 162 of the IC card 103-1 extracts the anonymized ID 00010 in the anonymized ID information 602 and sends it to the terminal from the input / output I / F 132. The terminal 102 sends the anonymized ID received by the IC card reader / writer 126 to the server 101 via the network I / F 124. Upon receiving the anonymized ID at the network I / F 114, the anonymized ID confirmation unit 141 of the server 101 searches for the same ID from the anonymized ID 402 of the anonymized data. It is confirmed that the same anonymized ID exists in No. 2 and that the owner of the IC card has the anonymized ID of 00010.
[0020]
Next, in the anonymization step 203, a process of removing information such as a name, an address, and a telephone number identifying the individual from the personal information 154 and adding the information of the anonymization ID information 165 is performed. Here, the anonymization means 152 deletes the name, telephone number, and address from the medical examination result 501-1, and replaces the anonymization ID 000010 of the anonymization ID information 602 acquired from the anonymization ID information 163 of the IC card 103-1. Is added. Then, in registration step 204, the anonymized personal information is registered in the server. Here, the data is transmitted to the server 101 via the network I / F 124 by the server access unit 153 of the terminal 102. The anonymized data management unit 142 of the server 101 stores the anonymized medical examination result received by the network I / F 114 as a new line 404 in the anonymized data 144.
[0021]
As described above, in the personal information management system of the present invention, since the consent of utilizing personal information is obtained by inserting the IC card, there is an effect that the server side can use only the data whose personal consent is surely obtained. Further, since the information for identifying the user and the ID after the anonymization are held in the IC card, there is an effect that the user and the data after the anonymization can be connected only when the IC card is used. Neither the data on the communication between the server and the terminal nor the data managed by the server contains information that identifies the individual, so the person handling the information on the server does not know who the information is, and protects the privacy of the individual. This has the effect of reducing the risk of infringement. Furthermore, since the information with the anonymized ID recorded on the IC card is sent to the server, even when the server adds information to the information stored previously, it is necessary to confirm that the server is the same person. There is an effect that you can check and add. In addition, since the data is sent to the server without the information for identifying the individual, even when the individual provides the personal information for research or the like, the information can be provided with a sense of security for the security of the personal information. effective.
[0022]
FIG. 3 is a flowchart illustrating an example of a procedure for referring to personal information of a server by a terminal in the embodiment of the present invention. An example of a method for referring to personal information stored in the server will be described with reference to the flowchart shown in FIG. ○ When Mr. Yamao refers to the data stored in the server, the terminal 102 at the medical examination facility or the like selects reference to the medical examination information from the menu displayed on the display 122 using the input unit 123. Then, the IC card 103-1 is inserted into the IC card reader / writer 126 of the terminal 102.
[0023]
Then, in the personal authentication step 301, it is confirmed that the user of the IC card 103-1 matches the owner of the IC card. Here, the personal identification means 151 of the terminal 102 displays a password input screen on the display 122, and prompts the user to input a password when agreeing to use of the data. When Mr. Oyama inputs a password using the keyboard 123, the identity verification unit 151 sends the input password to the IC card 103-1 via the IC card reader / writer device 126. In the IC card 103-1, the password information is received by the input / output I / F 132, the personal identification means 161 compares the password with the personal identification information 601 to confirm the identity, and sends the result back to the terminal 102. The identity confirmation means 154 of the terminal 102 receives the result and confirms that the user of the IC card 103-1 is the correct Mr. Oyama * O.
[0024]
Next, in anonymized ID authentication step 302, it is confirmed that the user indicated by anonymized ID information 165 of IC card 103-1 is a person existing in anonymized data 144 of server 101. Here, the anonymized ID confirmation unit of the IC card 103-1 extracts the anonymized ID 00010 in the anonymized ID information 602 and sends it to the terminal from the input / output I / F 132. The terminal 102 sends the anonymized ID received by the IC card reader / writer 126 to the server 101 via the network I / F 124. Upon receiving the anonymized ID via the network I / F 114, the anonymized ID confirmation unit 141 of the server 101 searches for the same ID from the anonymized ID 402 of the anonymized data, and the No. 1 shown in FIG. 2 confirms that the same anonymized ID exists, and confirms that the owner of the IC card is an anonymized ID of 00010.
[0025]
Next, in an information acquisition step 303, the terminal 102 acquires data from the server 101. Here, the server access means 153 of the terminal 102 requests the server 101 via the network I / F 124 to send the medical examination result of the anonymized ID00010. Upon receiving the request through the network I / F 114, the anonymized data management means of the server 101 converts the anonymized data 144 into data of the anonymized ID 00010, as follows: Are extracted and transmitted to the terminal 102 via the network I / F 114. The server access unit 153 displays the result of the medical examination received by the network I / F 124 on the display 122.
[0026]
As described above, in the personal information management system of the present invention, since the server is accessed using the anonymized ID stored in the IC card, even if the information stored in the server is anonymized, There is an effect that the provider himself can access his / her information.
[0027]
FIG. 7 is a flowchart illustrating an example of a procedure for canceling consent to use personal information in the embodiment of the present invention. An example of a method for deleting personal information stored in the server will be described with reference to the flowchart shown in FIG. ○ Mr. Yamao sometimes wants to revoke his consent for his data being stored on the server or being used for research. In such a case, on the terminal 102, from the menu displayed on the display 122, the input means 123 is used to select the cancellation of the consent of storing and utilizing the medical examination information, and the IC card 103-1 is transferred to the IC card reader / writer of the terminal 102. Insert into device 126. Then, in the personal authentication step 701, it is confirmed that the user of the IC card 103-1 matches the owner of the IC card. Here, the personal identification means 151 of the terminal 102 displays a password input screen on the display 122, and prompts the user to input a password when canceling consent to use the data. When Mr. Oyama inputs a password using the keyboard 123, the identity verification unit 151 sends the input password to the IC card 103-1 via the IC card reader / writer device 126. In the IC card 103-1, the password information is received by the input / output I / F 132, the personal identification means 161 compares the password with the personal identification information 601 to confirm the identity, and sends the confirmation result back to the terminal 102. The identity confirmation means 154 of the terminal 102 receives the result and confirms that the user of the IC card 103-1 is the correct Mr. Oyama * O.
[0028]
Next, in anonymized ID authentication step 702, it is confirmed that the user indicated by anonymized ID information 165 of IC card 103-1 is a person existing in anonymized data 144 of server 101. Here, the anonymized ID confirming means of the IC card 103-1 extracts the anonymized ID in the anonymized ID information 602 and sends it to the terminal from the input / output I / F 132. The terminal 102 sends the anonymized ID received by the IC card reader / writer 126 to the server 101 via the network I / F 124.
Upon receiving the anonymized ID at the network I / F 114, the anonymized ID confirmation unit 141 of the server 101 searches for the same ID from the anonymized ID 402 of the anonymized data. 2 confirms that the same anonymized ID exists, and confirms that the owner of the IC card is an anonymized ID of 00010.
[0029]
Then, in a cancellation step 703, the designated personal information in the server is deleted. Here, the server access unit 153 of the terminal 102 requests the server 101 via the network I / F 124 to delete the medical examination result of the anonymized ID00010. Upon receiving the request through the network I / F 114, the anonymized data management unit 142 of the server 101 deletes the data of the anonymized ID 00010 from the anonymized data 144.
[0030]
As described above, in the personal information management system of the present invention, the data of the server is specified to be deleted using the anonymized ID stored in the IC card. The effect is that the consent given to the use of information can be canceled.
[0031]
When performing an epidemiological study or the like based on the medical examination results accumulated in the server 101, the researcher performs statistical processing or the like using the data analysis unit 143. At this time, according to the method described above, all the data in the server is data obtained with the consent of the information provider, and is further anonymized. Therefore, the researcher can conduct the research without touching the information identifying the individual, and the risk of the researcher leaking the personal information can be reduced.
[0032]
In the embodiment described above, the method of connecting the server data and the individual using the anonymized ID stored in the IC card has been described, but other information may be used in combination. For example, it may be used in combination with an encryption technique such as a public key cryptosystem. In an anonymized ID authentication step of 202, 302, and 702, hash data and a random number of transmission data are generated, and this is combined with the anonymized ID to create an electronic signature encrypted with the secret key of the anonymized ID. Then, the electronic signature is sent to the server and decrypted by the server using the public key of the anonymized ID, and it is confirmed that the anonymized ID is correct. According to this method, the anonymized ID given to the IC card owner can be made to exactly match the anonymized ID managed by the server.
Further, in the anonymized ID authentication steps 202, 302, and 702, the registration step 204, the information acquisition step 303, and the cancellation step 703, the data to be communicated is encrypted using the server's public key or a temporarily generated common key. It may be.
According to this method, it is possible to prevent information leakage on a communication path or the like.
[0033]
Further, in the above-described embodiment, an example has been described in which the anonymization means 152 of the terminal removes the information for identifying the individual from the medical examination result and assigns the anonymization ID. May be performed. Further, the electronic signature method described above may be executed in the IC card and then sent to the server. According to this method, the anonymization process can be performed without leaving the anonymized ID information out of the IC card, and the risk of the relationship between the IC card user and the anonymized ID leaking can be reduced.
[0034]
In the embodiment described above, the method of storing the password in the IC card as the personal identification information has been described. However, information other than the password may be used.
For example, by recording biometric information such as a fingerprint, an iris of an eye, and a blood vessel pattern in an IC card and performing identity verification, the identity verification can be performed more accurately.
[0035]
Further, in the above-described embodiment, the method of installing the terminal in the medical examination facility has been described. However, the terminal may be installed in a place other than the medical examination facility. For example, a terminal may be installed in a hospital so that when a disease occurs, the terminal may be used in such a manner that the results of the previous medical examination are shown to a doctor. As a result, the doctor can refer to the accumulated results of the past medical examination to execute the treatment, and can expect more detailed medical treatment. Also, a personal computer at home may serve as a terminal. You can refer to the results of medical examinations yourself and use them for health promotion. Further, in the embodiment described above, one terminal is shown as an example, but the terminal may be installed in a plurality of facilities. For example, when terminals are installed in a plurality of medical examination facilities, and even when a patient moves from one of the medical examination facilities, the server can handle the same person's data.
[0036]
In the embodiment described above, an example in which medical examination information is used as personal information has been described, but other personal information may be used. For example, the present invention can be applied to all kinds of information related to health and illnesses such as medical records of hospitals, medical fee details, and genetic information.
Further, the present invention can be applied to any personal information other than health and illness information.
[0037]
In the embodiment described above, the canceling step has been described with respect to a method of deleting the designated personal information from the server, but another method may be used. For example, a flag indicating use prohibition may be added to a table for managing personal information. Further, a table for storing the data of the suspension of use may be provided, and the data may be moved there. In this case, if the information provider again agrees to the use of the information, the data can be used without newly registering the data. Further, in the embodiment described above, the method of matching the anonymized ID from the table of the anonymized data when authenticating the anonymized ID has been described, but a table for managing the anonymized ID may be provided. . With this method, the anonymized ID can be efficiently matched.
[0038]
As described above, the personal information management system and the personal information management method of the present invention obtain the consent of utilizing personal information by inserting an IC card. There is an effect that can be done. Furthermore, since the information for identifying the user and the ID after the anonymization are stored in the IC card, there is an effect that the user and the anonymized data can be connected only when the IC card is used. In addition, since data for communication between the server and the terminal and data managed by the server do not include information for identifying an individual, there is an effect that the risk of invading the privacy of the individual can be reduced. Further, since the information with the anonymized ID recorded on the IC card is sent to the server, even when the server adds information to the information stored previously, it is necessary to confirm that the same person is exactly the same. There is an effect that you can check and add. Also, since the data is sent to the server without information for identifying the individual, even when the individual provides the personal information for research or the like, the information can be provided with a sense of security for the security of the personal information. effective. Further, since the server is accessed using the anonymized ID stored in the IC card, there is an effect that the information provider can use his / her own information. That is, since the anonymized personal information is managed, the risk of personal information leakage can be reduced, and the information provider can utilize his / her own information.
[0039]
【The invention's effect】
ADVANTAGE OF THE INVENTION According to this invention, the personal information management system and the personal information management method which can easily accumulate and utilize the information in which the consent about utilization was obtained from the information provider, protecting personal information can be provided. Further, according to the present invention, it is possible to provide a personal information management system and a personal information management method in which the information provider can easily utilize the accumulated personal information.
[Brief description of the drawings]
FIG. 1 is a diagram showing an example of the configuration of a personal information management system according to an embodiment of the present invention.
FIG. 2 is a flowchart illustrating an example of a procedure for registering personal information in a server from a terminal in the embodiment of the present invention.
FIG. 3 is a flowchart illustrating an example of a procedure in which a terminal refers to personal information of a server in an embodiment of the present invention.
FIG. 4 is a view for explaining an example of anonymized data managed by a server in the embodiment of the present invention.
FIG. 5 is a view for explaining an example of personal information held by the terminal in the embodiment of the present invention.
FIG. 6 is a view for explaining an example of personal identification information and anonymized ID information held by an IC card in the embodiment of the present invention.
FIG. 7 is a flowchart illustrating an example of a procedure for canceling consent to use personal information in the embodiment of the present invention.
[Explanation of symbols]
101 server, 102 terminal, 103-1 to 103-3 IC card, 111, 121, 131 CPU, 112, 122 output device, 113, 123 input device, 114, 124 network interface, 115, 125, 133: storage device, 126: IC card reader / writer device, 132: input / output interface, 141, 162: anonymized ID confirmation unit, 142: anonymized data management unit, 143: data analysis unit, 144: anonymized data .., 151, 161... Identity verification means, 152, 163... Anonymization means, 153... Server access means, 154... Personal information, 164. , 403: medical examination result, 501-1 to 501-3: medical examination result, 601: identification of the individual Broadcast, 602 ... anonymous ID information.

Claims (8)

A personal information management system in which personal information is anonymized and managed by a server, and an IC card is used when accessing the server, wherein the IC card includes personal identification information for identifying the owner of the IC card; A personal information management system characterized by holding anonymized ID information indicating an ID when the owner of the IC card is anonymized. 2. The personal information management system according to claim 1, wherein the personal identification means for confirming that the user of the IC card is the owner of the IC card using the personal identification information of the IC card; Using the anonymized ID information of the IC card, having an anonymized ID confirming means for confirming that the owner of the IC card matches one of the anonymized individuals on the server Personal information management system characterized by the following. 3. The personal information management system according to claim 2, wherein anonymizing means for deleting information such as a name and an address specifying the individual from the personal information and adding the anonymized ID information of the IC card to perform anonymization. Personal information management system comprising server access means for sending anonymized personal information to the server. 3. The personal information management system according to claim 2, further comprising a server access unit for acquiring from the server the personal information of the anonymized individual who has been matched by the anonymization ID confirmation unit. 3. The personal information management system according to claim 2, further comprising server access means for deleting, from the server, personal information of the anonymized individual matched by the anonymization ID confirmation means. A personal information management method using an IC card when anonymizing personal information and managing the server and accessing the server, wherein the user of the IC card uses the personal identification information recorded on the IC card to identify the user. An identity authentication step of confirming that it matches the IC card owner, and using the anonymized ID information recorded on the IC card, the owner of the IC card matches the anonymized individual on the server. An anonymization ID authentication step of confirming that the identification is performed, and an anonymization step of deleting information for identifying an individual from the personal information of the IC card owner and adding anonymization ID information recorded on the IC card. A registration step of registering anonymized personal information in a server. A personal information management method using an IC card when anonymizing personal information and managing the server and accessing the server, wherein the user of the IC card uses the personal identification information recorded on the IC card to identify the user. An identity authentication step of confirming that it matches the IC card owner, and using the anonymized ID information recorded on the IC card, the owner of the IC card matches the anonymized individual on the server. A personal information management method, comprising: an anonymized ID authentication step of confirming that the information is to be stored; and an information obtaining step of obtaining information of an anonymized individual that matches the owner of the IC card. A personal information management method using an IC card when anonymizing personal information and managing the server and accessing the server, wherein the user of the IC card uses the personal identification information recorded on the IC card to identify the user. Using an anonymized ID information recorded on the IC card to identify the owner of the IC card with an anonymized individual on the server, A personal information management method, comprising: an anonymized ID authentication step of confirming a match; and a canceling step of deleting, from the server, anonymized personal information matching the IC card owner.

Images