JP2019144723A - Anonymity processing device and information anonymity method and program - Google Patents

Abstract

To accelerate distribution and utilization of anonymity processing information.SOLUTION: An anonymity processing device comprises an anonymity processing means that acquires anonymity processing rule information from a rule information database storing anonymity processing rule information in which a rule about processing described in a guideline conformed to the laws is made to be electric data and generates anonymity processing information by processing personal information based on the acquired anonymity processing rule information.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an anonymization device, an information anonymization method, and a program for anonymizing information, particularly personal information.

  When acquiring and distributing personal information (providing to a third party), it is necessary to obtain the consent of the person. The personal information is, for example, information about a living individual, and is information that can identify a specific individual by name, date of birth, address, and the like.

  On the other hand, anonymous processing information does not need to obtain the person's consent. Anonymously processed information is information obtained by processing personal information, and is information that cannot identify an individual and cannot return to personal information before processing. Therefore, anonymized information can be used relatively freely unlike personal information.

  In relation to the above, for example, Patent Literature 1 describes a technique for selecting an attribute to be anonymized based on an appearance rate and a remaining rate. Patent Documents 2 and 3 describe techniques for performing anonymization based on predetermined anonymization processing rules for anonymization.

JP 2013-200659 A JP 2017-168130 A Special table 2012-063546 gazette

  In November 2016, the personal information protection committee, which is an external office of the Japanese Cabinet Office, will process anonymously processed information until the “Guidelines on the Act on the Protection of Personal Information” is issued. There were no anonymous processing rules in line with the guidelines.

  Moreover, even if it is a case where anonymous processing information is created, a trader must observe a predetermined anonymous processing rule. In the above, a trader is, for example, a holding trader that holds anonymous processing information or a utilization trader that uses anonymous processing information. In the above, the predetermined anonymous processing rule is a rule for maintaining a state in which an individual cannot be specified and cannot be returned to personal information before processing. Failure to follow this anonymous processing rule may result in violation of the law. Therefore, for example, the owner has dealt with by deleting all the data items that can identify the individual so as not to violate the law.

  If there is no anonymous processing rule, the information is generalized more than necessary, or the data specifications are uneven for each supplier. As a result, the distribution and utilization of anonymous processing information is hindered.

  Since the anonymization rules used in Patent Documents 2 and 3 are not anonymous processing rules in accordance with the above guidelines, there is a problem in promoting the distribution and utilization of anonymous processing information.

  The present invention has been made to solve the above problems, and provides an anonymization device, an information anonymization method, and a program capable of easily promoting the distribution and utilization of anonymous processing information. Objective.

  The anonymous processing apparatus of the present invention acquires the anonymous processing rule information from a rule information database that stores anonymous processing rule information obtained by converting the rules for processing described in the guidelines in accordance with the law into electronic data. Anonymization processing means for processing personal information based on the anonymous processing rule information to create anonymous processing information is provided.

  The anonymous processing method of the present invention acquires the anonymous processing rule information from the rule information database storing anonymous processing rule information obtained by converting the rules for processing described in the guidelines in accordance with the law into electronic data. Anonymized processing information is created by processing personal information based on anonymous processing rule information.

  The program of the present invention obtains the anonymous processing rule information from a rule information database that stores anonymous processing rule information obtained by converting the rules for processing described in the guidelines in accordance with the law into electronic data in the computer of the anonymous processing device. And it is a program for performing the process which processes personal information based on the acquired said anonymous processing rule information, and produces anonymous processing information.

  According to the present invention, it is possible to easily promote the distribution and utilization of anonymously processed information.

It is a block diagram which shows the structural example of the anonymous processing apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart explaining the operation example (anonymous processing method) of the anonymous processing apparatus shown by FIG. It is a block diagram which shows the structural example of the anonymous processing apparatus which concerns on the 2nd Embodiment of this invention. The example of a data structure of personal information is shown. The example of a data structure of anonymous processing rule information is shown. An example of the data structure of personal information for disclosure is shown. It is a flowchart for demonstrating the operation example (anonymous processing method) of the anonymous processing apparatus shown by FIG. It is a block diagram which shows the structural example of the anonymous processing apparatus which concerns on the 3rd Embodiment of this invention. It is a block diagram which shows the structural example of the anonymous processing system which concerns on the 4th Embodiment of this invention.

[First Embodiment]
FIG. 1 is a block diagram illustrating a configuration example of an anonymous processing apparatus 10 according to the first embodiment of the present invention. The anonymous processing device 10 is a device that performs anonymous processing on personal information to create anonymous processing information.

  Personal information is information about a living individual, and is information that can identify a specific individual by name, date of birth, address, and the like. On the other hand, according to the “Guidelines on the Act on the Protection of Personal Information”, anonymously processed information cannot be used to identify a specific individual by taking measures determined according to the classification of personal information. It is information about individuals obtained by processing. The “Guidelines on the Act on the Protection of Personal Information” was issued in November 2016 by the Personal Information Protection Committee, which is an external office of the Japanese Cabinet Office. Hereinafter, in this document, the “Guidelines on the Law Concerning the Protection of Personal Information” is abbreviated as “Guidelines for the Protection of Personal Information”.

  The anonymous processing device 10 includes an anonymous processing unit 14 (an example of an anonymous processing unit).

  The anonymous processing processing unit 14 acquires anonymous processing rule information from a rule information database (not shown in FIG. 1) that stores anonymous processing rule information in which rules for processing described in the guidelines in accordance with the law are converted into electronic data. To do. The anonymous processing unit 14 processes the personal information based on the acquired anonymous processing rule information and creates anonymous processing information.

  The rule information database stores anonymized processing rule information obtained by converting electronic rules into processing rules described in guidelines in accordance with the law, for example, personal information protection law guidelines.

  The rule information database may exist inside the anonymous processing device 10 or may exist outside the anonymous processing device 10. When the rule information database exists outside the anonymous processing device 10, the rule information database is connected to the anonymous processing device 10 through a predetermined communication interface so as to be communicable.

  FIG. 2 is a flowchart for explaining an operation example (anonymous processing method) of the anonymous processing apparatus 10 shown in FIG. It is assumed that the anonymous processing rule information described above is stored in advance in the rule information database prior to the execution of the anonymous processing. Moreover, in the following description, the case where the guideline according to the law is, for example, a personal information protection law guideline is given as an example.

  First, the anonymous processing unit 14 acquires personal information. The acquisition method of personal information is arbitrary. For example, the personal information is read from a personal information database (not shown in FIG. 1) provided inside the anonymous processing device 10 or is supplied from a device outside the anonymous processing device 10.

  The anonymous process part 14 acquires anonymous process rule information from the rule information database (step S1).

  Anonymization processing part 14 processes personal information based on anonymous processing rule information, and creates anonymous processing information (Step S2).

  In addition, what is demonstrated in the following 2nd Embodiment may be employ | adopted about each content of personal information and anonymous processing rule information, and the anonymous processing process in the anonymous processing process part 14. FIG.

According to the first embodiment described above, in the anonymous processing device 10, the anonymous processing is performed based on anonymized processing rule information defined in guidelines in accordance with the law, for example, the Personal Information Protection Law Guidelines. . In short, since anonymous processing can be performed based on anonymous processing rule information authorized by a public institution, there is no need to be aware of violations of the law, and personal information is not anonymized more than necessary, Furthermore, the data specification does not become uneven for each supplier. That is, according to the first embodiment, it is possible to easily promote the distribution and utilization of anonymous processing information.
[Second Embodiment]
(Description of configuration)
FIG. 3 is a block diagram illustrating a configuration example of the anonymous processing apparatus 100 according to the second embodiment of the present invention. The anonymous processing device 100 includes a configuration based on the anonymous processing device 10 shown in FIG. 1, and similarly to the anonymous processing device 10, performs anonymous processing on personal information to create anonymous processing information.

  The anonymous processing device 100 includes an anonymous processing unit 102 (an example of an anonymous processing unit), a personal information database 104, a rule information database 106, and a public personal information database 108.

  The personal information database 104 stores personal information 200. FIG. 4 shows a data configuration example of the personal information 200. The personal information 200 includes first attribute information 202 that is information indicating attributes, and individual personal information 204 that is information indicating attribute values of the first attribute information 202.

  FIG. 4 illustrates a case where there is one personal information 200 and the first attribute information 202 is each of four attributes (for example, “name”, “age”, “address”, and “profession”). The In this case, the individual personal information 204, which is the attribute value of the first attribute information 202, has four attribute values (for example, “Taro Nikko”, “39”, “Nakahara-ku, Kawasaki City, Kanagawa Prefecture”, and “Office worker”). Each. Of course, the number of personal information 200 may be two or more. Further, the number of the first attribute information 202 may be 3 or less, or 5 or more.

  The rule information database 106 stores anonymous processing rule information 210 in which processing rules described in guidelines complying with laws are digitized.

  In this embodiment, a case where anonymous processing rule information 210 is anonymous processing rule information described in the Personal Information Protection Law Guidelines is taken as an example. FIG. 5 shows a data configuration example of the anonymous processing rule information 210. As shown in FIG. 5, the anonymous processing rule information 210 includes second attribute information 212 (for example, “name”, “age”, “address”, and “profession”) and second attribute information 212. Each processing rule is composed of individual processing rule information 214 (for example, “delete”, “truncate the first digit”, “leave only the prefecture and city”, and “leave”), respectively. . Of course, the number of the second attribute information 212 may be 3 or less, or 5 or more.

  The public personal information database 108 is personal information obtained by anonymizing at least one individual personal information 204, and stores public personal information 220 that can be disclosed to a third party. FIG. 6 shows a data configuration example of the public personal information 220. The public personal information 220 includes processed individual personal information 222 (for example, “30s”, “Kawasaki City, Kanagawa Prefecture”, and “Office worker”).

  The anonymous processing unit 102 basically performs anonymous processing on the acquired personal information 200 based on the anonymous processing rule information 210 as in the anonymous processing unit 14 shown in FIG.

  Specifically, the anonymization processing unit 102 acquires the personal information 200 from the personal information database 104. The anonymous processing unit 102 compares the first attribute information 202 of the acquired personal information 200 with all the second attribute information 212 in the anonymous processing rule information 210 in a brute force manner. That is, the anonymous processing unit 102 determines whether or not the second attribute information 212 identical to the first attribute information 202 exists in the anonymous processing rule information 210.

  When it is determined that the second attribute information 212 that is the same as the certain first attribute information 202 exists, the anonymous processing processing unit 102 acquires the individual processing rule information 214 of the same second attribute information 212. Based on the acquired individual processing rule information 214, the anonymous processing unit 102 performs anonymous processing on the individual personal information 204 corresponding to the first attribute information 202 that is the same as the second attribute information 212 in the personal information 200.

  The anonymization processing unit 102 stores public personal information 220, which is personal information obtained by anonymizing at least one individual personal information 204, in the public personal information database 108.

  The personal information 200 may include information that is not subject to anonymous processing. That is, the personal information 200 may include information having the first attribute information 202 that does not match all the second attribute information 212 in the anonymous processing rule information 210. Such information is called attribute mismatch information in this embodiment. Anonymization processing is not performed for attribute mismatch information. The handling of attribute mismatch information is arbitrary. For example, the attribute mismatch information may be stored in the public personal information database 108 as it is without being processed anonymously.

The anonymous processing unit 102 may be configured by an electronic circuit such as an IC (Integrated Circuit) or an FPGA (Field Programmable Gate Array), for example. Alternatively, the anonymous processing unit 102 may be configured such that a computer (for example, a CPU (Central Processing Unit)) executes a program stored in a memory. Of course, the anonymous processing unit 102 may be configured by a combination of an electronic circuit and a computer.
(Description of operation)
FIG. 7 is a flowchart for explaining an operation example (anonymous processing method) of the anonymous processing apparatus 100 shown in FIG. Note that steps S <b> 10 to S <b> 14 described with reference to FIG. 7 describe processing executed by the anonymous processing unit 102. Prior to the execution of these processes, it is assumed that anonymous processing rule information 210 is stored in the rule information database 106 in advance.

  The anonymous process part 102 acquires the personal information 200 (step S10).

  The anonymous process part 102 determines whether or not the second attribute information 212 identical to the first attribute information 202 exists in the anonymous process rule information 210 (step S11). The anonymization processing unit 102 compares one piece of first attribute information 202 of one piece of personal information 200 with all the second attribute information 212 in the anonymous processing rule information 210 in a brute force manner. Information in which the same second attribute information 212 does not exist is called attribute mismatch information as described above.

  When the second attribute information 212 that is the same as a certain first attribute information 202 exists (Yes in step S11), the anonymous processing unit 102 changes the individual personal information 204 of the first attribute information 202 to the same first attribute information 202. Anonymization processing is performed based on the individual processing rule information 214 of the two attribute information 212 (step S12).

  For example, when one piece of first attribute information 202 is “name”, the anonymous processing unit 102 sets “Nippon Taro” in the individual personal information 204 whose first attribute information 202 is “name” to “name”. The individual processing rule information 214 is deleted according to “delete”.

  On the other hand, when there is no second attribute information 212 that is the same as one certain first attribute information 202 (No in step S11), the anonymous processing unit 102 performs the process for the individual personal information 204 of the first attribute information 202. Anonymization processing is not performed (step S13).

  Although not shown in FIG. 7, the processes in steps S11 to S13 are repeatedly executed until the brute force comparison for all the first attribute information 202 of one piece of personal information 200 is completed. Further, when a plurality of pieces of personal information 200 are stored in the personal information database 104, the processes in steps S10 to S13 are repeatedly executed until the processes for all the personal information 200 are completed.

The anonymous processing unit 102 stores the public personal information 220, which is personal information obtained by processing the individual personal information 204 anonymously, in the public personal information database 108 (step S14). The anonymous processing unit 102 stores the public information 220 shown in FIG. 6 in the public information database 108 for example. FIG. 6 shows the public personal information 220 obtained by anonymizing the personal information 200 shown in FIG. 4 based on the anonymous processing rule information 210 shown in FIG.
(Explanation of effect)
In the second embodiment described above, the anonymous processing is performed based on the anonymous processing rule information 210. The anonymous processing rule information 210 is anonymous processing rule information in accordance with the Personal Information Protection Law Guidelines, which is a guideline regarding the law concerning the protection of personal information. In short, since anonymous processing can be performed based on anonymous processing rule information authorized by a public institution, there is no need to be aware of violations of the law, and personal information is not anonymized more than necessary, Furthermore, the data specification does not become uneven for each supplier. That is, according to the second embodiment, the distribution and utilization of anonymous processing information is promoted. Specifically, data distribution is promoted between businesses that collect personal information and businesses that use personal information for public use (anonymized personal information). Utilization is activated.

  The holding of the rule information database 106 storing the anonymous processing rule information 210 which is anonymous processing rule information in accordance with the Personal Information Protection Law Guidelines can also be used for the accountability (accountability) of a trader oriented to data distribution.

  Furthermore, in the anonymous processing device 100 of the second embodiment, the public information 220 that is personal information in which at least one individual personal information 204 is processed anonymously is a personal information database for disclosure that is different from the personal information database 104. 108. That is, since the public personal information 220 that is public information is stored separately from the personal information 200 that cannot be disclosed basically, the risk of personal information leakage can be reduced.

In the second embodiment described above, an example in which the personal information database 104 storing the personal information 200 is built in the anonymous processing device 100 is shown. However, the personal information database 104 is stored in the anonymous processing device 100. It may be outside of. In this case, however, measures are taken to prevent personal information from leaking to the network between the personal information database 104 and the anonymous processing device 100.
[Third Embodiment]
FIG. 8 is a block diagram showing a configuration example of the anonymous processing device 300 according to the third embodiment of the present invention. Specifically, the anonymous processing device 10 shown in FIG. 1 or the anonymous processing device 100 shown in FIG. It is a block diagram of the anonymous processing apparatus 300 which implement | achieved by computer. The anonymous processing device 300 includes a storage device 302 and an arithmetic device 304 (computer) including a processor and the like. The storage device 302 is a computer-readable recording medium and stores a computer program 350. The computer program 350 is a program for causing the arithmetic device 304 to execute the operation described in the first embodiment or the operation described in the second embodiment, for example. For example, the computer program 350 acquires the anonymous processing rule information from the rule information database that stores the anonymous processing rule information obtained by converting the rules for processing described in the guidelines in accordance with the law into electronic data. It is a process of processing personal information based on information to create anonymously processed information.

  Examples of the arithmetic unit 304 include one or more CPUs that read and execute a program and a memory that stores instructions executed by the CPU. The computer-readable recording medium is, for example, a non-transitory storage device. Examples of the non-temporary storage device include an optical disk, a magnetic disk, a portable medium such as a ROM (Read Only Memory) and a nonvolatile semiconductor memory, and a hard disk built in a computer system. The computer-readable recording medium may be a temporary storage device. Examples of the temporary storage device include a signal line for transmitting a program via a network such as the Internet or a communication line such as a telephone line, or a volatile memory inside the computer system.

According to the third embodiment described above, similarly to the first and second embodiments, according to the third embodiment, the distribution and utilization of anonymous processing information is promoted.
[Fourth Embodiment]
FIG. 9 is a block diagram showing a configuration example of the anonymous processing system 400 according to the fourth embodiment of the present invention. The anonymous processing system 400 includes an anonymous processing device 402 and an information processing device 404. The anonymous processing device 402 is connected to the information processing device 404 via a network 406 such as the Internet so as to be communicable.

  The information processing device 404 is a device of a user who desires anonymous processing for personal information. The anonymous processing device 402 is, for example, any one of the anonymous processing devices according to the first to third embodiments. The anonymous processing device 402 performs anonymous processing on personal information based on a request from the information processing device 404. The anonymous processing is as described above.

  According to the fourth embodiment described above, for example, the anonymous processing device 402 can be provided on the cloud. That is, according to the present embodiment, it is possible to provide an anonymous processing service over a network.

  As mentioned above, although this invention was demonstrated using each embodiment, the technical scope of this invention is not limited to description of said each embodiment. It is obvious to those skilled in the art that various modifications or improvements can be added to the above embodiments. Therefore, it is needless to say that embodiments with such changes or improvements are also included in the technical scope of the present invention. The numerical values and names of the components used in the embodiments described above are illustrative and can be changed as appropriate.

DESCRIPTION OF SYMBOLS 10 Anonymous processing apparatus 14 Anonymous processing processing part 100 Anonymous processing apparatus 102 Anonymous processing processing part 104 Personal information database 106 Rule information database 108 Personal information database for disclosure 200 Personal information 202 First attribute information 204 Individual personal information 210 Anonymous processing rule information 212 Second attribute information 214 Individual processing rule information 220 Personal information for disclosure 300 Anonymous processing device 302 Storage device 304 Computing device 350 Computer program 400 Anonymous processing system 402 Anonymous processing device 404 Information processing device 406 Network

Claims (10)

From the rule information database storing the anonymous processing rule information obtained by converting the rules for processing described in the guidelines in accordance with the law into electronic data, the anonymous processing rule information is acquired, and the individual based on the acquired anonymous processing rule information Anonymization processing device comprising anonymization processing means for processing information and creating anonymous processing information.   The anonymous processing apparatus according to claim 1, wherein the guideline is a guideline regarding a law concerning protection of personal information. The personal information includes first attribute information and individual personal information about the first attribute information, and the anonymous processing rule information includes second attribute information and individual processing rule information about the second attribute information. And consists of
The anonymization processing means determines whether or not the second attribute information identical to the first attribute information exists in the anonymous processing rule information. Processing equipment.   When it is determined that the same second attribute information is present, the anonymous processing unit is configured to perform the first processing that is the same as the second attribute information based on the individual processing rule information of the same second attribute information. The anonymous processing apparatus according to claim 3, wherein the individual personal information of the attribute information is processed anonymously.   When it is determined that the same second attribute information does not exist, the anonymous processing means does not anonymously process the individual personal information of the first attribute information for which the same second attribute information does not exist. The anonymous processing apparatus according to claim 3 or 4.   The anonymous processing means stores the anonymous personal information obtained by anonymously processing the individual personal information in a public personal information database as public personal information that can be disclosed to a third party. The anonymous processing apparatus of any one of 1-5.   The anonymous processing device according to claim 1, wherein the rule information database is built in. Anonymous processing device according to any one of claims 1 to 7,
An information processing apparatus for a user who desires anonymous processing for the personal information;
With
The anonymous processing device is communicably connected to the information processing device via a network,
The anonymous processing system, wherein the anonymous processing system performs an anonymous processing on the personal information based on a request from the information processing apparatus. From the rule information database storing the anonymous processing rule information obtained by converting the rules for processing described in the guidelines in accordance with the law into electronic data, the anonymous processing rule information is acquired, and the individual based on the acquired anonymous processing rule information An anonymous processing method characterized by processing information to create anonymous processed information. To the computer of the anonymous processing device,
From the rule information database storing the anonymous processing rule information obtained by converting the rules for processing described in the guidelines in accordance with the law into electronic data, the anonymous processing rule information is acquired, and the individual based on the acquired anonymous processing rule information A program for executing processing to create anonymously processed information by processing information.

Images