KR102011980B1 - Automatic apparatus for probating and writing privacy policy - Google Patents

Abstract

The present invention relates to an apparatus for automatically creating and verifying a personal information processing policy which can automatically verify the propriety of detailed items to provide the same and a method thereof. According to the present invention, the method comprises the steps of: inputting required information; creating a personal information processing policy; performing verification on legal requirements of content; and processing the created personal information processing policy in a file format desired by a customer and providing the same.

Description

AUTOMATIC APPARATUS FOR PROBATING AND WRITING PRIVACY POLICY}

The present invention relates to an apparatus and method for automating personal information processing policy creation and verification.

Services for the privacy policy are provided by public institutions (eg, the Ministry of Public Administration and Security).

The service on the privacy policy provided by public institutions helps to prepare the items that should be included in the privacy policy in order, but there is a lack of detailed explanations or guides on how and how to write the information. There is a limit.

In addition, there is a problem that it is necessary to separately review the adequacy of the contents of the written personal information processing policy (legal requirements).

Patent Publication No. 10-2010-0075131

The problem to be solved by the present invention is to provide an automatic device and method for creating and verifying a privacy policy that can solve the conventional problems.

Method for automating the creation and verification of personal information processing policy according to an embodiment of the present invention comprises the steps of a) inputting the input information necessary for the personal information processing policy prepared by the customer terminal; B) creating a personal information processing policy based on the required information by the personal information processing policy creating unit; C) performing verification of the details of the details of the personal information processing policy created by the verification unit and the legal requirements of the contents; If the adequacy of the verification results does not meet the standard value, the statistics on the personal information processing policy used by industry, service, and size similar to the customer in the preparation guide, and personal information corresponding to the customer of any one of public institutions, small businesses and individuals After providing the example information of the essential information for preparing the details of the processing policy with a check box and a textual manual, requesting additional personal information, and when the appropriateness reaches the reference value, the privacy policy created at the output unit The method includes the step d) of processing the file into a desired file format of the customer, and the step b) includes a template corresponding to a form including essential items that the personal information processing policy preparation unit should include in the customer's personal information processing policy. Comprising a step of writing using a creation guide comprising a, step c) is the term association plate of the verification unit Determining, at an end, the association between the words described in the created privacy policy and the response (output value) according to the query (input value); And judging adequacy of legal requirements of contents included in each sub-item of the created personal information processing policy by the legal requirement adequacy determining unit of the verification unit, wherein each of the templates includes a plurality of pre-stored queries and the queries. And a plurality of inquiries and responses are provided based on statistical data including the type and size of the data of the customer's privacy policy similar to the customer, and the manual is based on the type of business, The above required information for checking the size of the company, the use of the Internet service, the number of users, the electronic transaction (payment type), the collection of credit information, the collection of sensitive information, the number of employees, the use of personal information, the customer inflow information, and the number of customers Is recorded, and the manual provided in the preparation guide section is provided to the customer after the adequacy of legal requirements.

Therefore, using the apparatus and method for automating the creation and verification of personal information processing policy according to an embodiment of the present invention, the items of the personal information processing policy of other customers having a similar business type, service, and scale as the customer based on big data analysis And by creating the details of the privacy policy based on the details can minimize the content error, furthermore, there is an advantage that can automatically verify and provide the appropriateness of each of the details of the privacy policy.

Through the above-described advantages, small businesses and individuals can significantly reduce the time required to prepare the privacy policy and the cost of requesting experts.

1 is a block diagram illustrating an apparatus for creating and verifying a privacy policy according to an embodiment of the present invention.
2 is an exemplary view illustrating a process of determining a term fitness.
3 to 6 are exemplary views showing an example of legal requirement verification.
7 is a flowchart illustrating a method for automating the creation and verification of a privacy policy according to an embodiment of the present invention.
FIG. 8 is a flowchart illustrating the S730 process illustrated in FIG. 7 in more detail.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is "connected" with another part, this includes not only a "direct connection" but also an "electrical connection" between other elements in between. In addition, when a part is said to "include" a certain component, which means that it may further include other components, except to exclude other components unless specifically stated otherwise, one or more other It is to be understood that the present invention does not exclude the possibility of the presence or the addition of features, numbers, steps, operations, components, parts, or combinations thereof.

As used throughout the specification, the terms "about", "substantially", and the like, are used at, or in close proximity to, numerical values when manufacturing and material tolerances inherent in the meanings indicated are intended to aid the understanding of the invention. It is used to help prevent unscrupulous infringers' use of postings that contain accurate or absolute figures to assist. As used throughout the specification of the present invention, the term "step of" or "step of" does not mean "step for /".

In the present specification, the term 'unit' includes a unit realized by hardware, a unit realized by software, and a unit realized by both. In addition, one unit may be realized using two or more pieces of hardware, or two or more units may be realized by one piece of hardware.

Some of the operations or functions described as being performed by the terminal, the apparatus, or the device may be performed instead in the server connected to the terminal, the apparatus, or the device. Similarly, some of the operations or functions described as being performed by the server may be performed by the terminal, apparatus or device connected to the server.

In the present specification, some of the operations or functions described as mapping or matching with a terminal mean that a unique number of a terminal or identification information of an individual, which is identification data of the terminal, is mapped or matched. Can be interpreted as

Hereinafter, an apparatus for creating and verifying a privacy policy according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating an apparatus for automatically creating and verifying a personal information processing policy according to an embodiment of the present invention, FIG. 2 is an exemplary diagram illustrating a process of determining a term fitness, and FIGS. 3 to 6 are legal requirements verification. An illustration showing an example of the.

As shown in FIG. 1, the apparatus 100 for creating and verifying a personal information processing policy according to an embodiment of the present invention receives essential information from a customer terminal 10 and is suitable for a corresponding customer based on the essential information. It may be a device for creating and verifying a privacy policy.

The personal information processing policy preparation and verification automation device 100 may transmit and receive data through the network with the customer terminal 10.

The configuration of the network may include more or fewer components, connections and interactions than shown in FIG.

The network may be a medium used to provide a communication link between data processing systems, computers, servers, and various devices.

A network is a world of networks and gateways that use the Transmission Control Protocol Internet Protocol (TCP / IP) suite of protocols for the automated device 100 and the customer terminal 10 to communicate with each other. Can represent a wide collection. In some examples, the network may include or be an intranet, a local area network (LAN), or a wide area network (WAN). In yet some other examples, the network may be part of the Internet.

The customer 10 terminal is a PC, a laptop, a smartphone, a tablet, a wearable computer, or the like, and accesses a web / mobile site related to the personal information processing policy creation and verification automation device 100. Alternatively, this may mean all terminal devices capable of installing and executing a service-only application. In this case, the customer terminal 10 may perform overall service operations such as service screen configuration, data input, data transmission, and data storage under the control of a web / mobile site or a dedicated application.

On the other hand, the personal information processing policy creation and verification automation device 100 is the input unit 110, the creation guide unit 120, personal information processing policy writing unit 130, verification unit 140 and output unit 150 It may include.

The input unit 110 receives the necessary information provided by the customer terminal 10 of the customer (public institution, small business, individual).

The essential information is information provided by the customer terminal 10 according to a manual provided by the creation guide unit 120 to be described later, and may vary according to a customer (public institution, small business, individual).

In addition, the input unit 110 may receive a previously created personal information processing policy from a new customer and provide the verification unit 140 to be described later.

The manual may be provided in the form of a check box. In the check box, a business type, a company size, an Internet service, a number of users, an electronic transaction (payment type), whether credit information is collected, Essential information to check whether sensitive information is collected, the number of employees, whether personal information is used, customer inflow information, and the number of customers can be recorded.

Meanwhile, the manual may include text written as exemplary information of essential information required for detailed items of a privacy policy corresponding to each customer. Thus, the customer can enter the necessary information corresponding to or similar to the exemplary information in the manual provided.

The creation guide unit 120 provides a creation guide composed of markup language-based templates corresponding to a form containing essential contents to be included in a personal information processing policy corresponding to a customer (public institution, small business, individual). do.

Each template may consist of a plurality of pre-stored queries and sets of responses according to the queries. Here, the plurality of questions and responses may be provided based on statistical data (industry type, size, etc.) of data of a privacy policy of a customer similar to the corresponding customer.

On the other hand, the manual provided by the creation guide unit 120 may be provided to the customer after the legal requirements verification of the legal requirement adequacy determination unit 142 to be described later.

Next, the personal information processing policy creating unit 130 creates items of the "personal information processing policy" suitable for the customer by using the necessary information provided by the customer terminal and the template provided by the creation guide unit 120.

The verification unit 140 functions to verify legal adequacy of detailed items of the personal information processing policy provided from the outside or created in the personal information processing policy preparing unit 130.

Here, the verification unit 140 extracts at least one or more words described in the detailed items, and then determines whether the extracted symbols, numbers, words, and connection relations between the words can be included in the corresponding items.

For example, if the customer is a small business, the written privacy policy may contain details such as 1) the purpose of processing personal information, 2) the period of processing and retention of personal information, 3) the provision of third parties for personal information, and 4 Matters concerning the entrustment of the processing of personal information, 5) Matters concerning the rights and obligations of the data subject and the legal representative, and how to exercise them, 6) Items of personal information to be processed, 7) Matters concerning the destruction of personal information, 8) Matters concerning the person in charge of personal information protection, 9) Matters concerning the change of the personal information processing policy, 10) Matters concerning the measures to ensure the safety of personal information, 11) Matters concerning the installation, operation and rejection of automatic personal information collection devices; Verifies the suitability of the legal requirements and contents of Article 30 of the relevant Personal Information Protection Act, Article 31 of the Enforcement Decree, and Article 19 of the Standard Privacy Guidelines.

The verification unit 140 includes a term association determination unit 141 and a legal requirement adequacy determination unit 142.

The term association determination unit 141 determines the association between the words described in the written personal information processing policy and the response (output value) according to the query (input value).

For example, if the question of “Consignee (consignee)” is entered in the subcategory “Concerning the entrustment of personal information processing”, it is determined whether the subject is listed as a response (output value). As another example, when the query of "content of the task entrusted" is input, it is determined whether a word associated with the task is output as a response (output value).

If a subject is input as a response (output value) when an inquiry of “content of the task to be entrusted” is determined, it may be determined as a preparation error and then a rewrite may be requested to the personal information processing policy preparing unit 130.

The legal requirement adequacy determining unit 142 determines the legal requirements of words described in each item of the prepared personal information processing policy.

For example, when judging the legal requirements of “mandatory items” and “optional items” in the sub-items of “collecting personal information items and collection methods”, the words in the required items and optional items are extracted, and then the information subject such as social security number Whether items that cannot be collected after consent have been included (Article 24-2 of the Personal Information Protection Act), whether unnecessary information is collected in the service entered in the prerequisites, for example, family relationships, etc., in which the customer is listed as a shopping mall operator. Whether the information is collected or not is determined by the legal requirement adequacy determination unit 142.

As another example, we verify whether the log is kept for a specified period of time, such as transaction records and complaint records, according to the law in the subsection “Retention and Use of Personal Information”.

As another example, we verify that we have the right to refuse consent and, if there is a disadvantage of refusal to consent, whether it includes the content of the disadvantage.

As another example, whether the details of the “Destruction Procedures and Methods of Personal Information” include the categories of Personal Information Destruction Procedures and Destruction Methods, as described in the Destruction Procedures and Destruction Methods, etc. Verify that the information on complete destruction is provided.

The output unit 150 provides the verified personal information processing policy in the form of a file desired by the customer.

In addition, the output unit 150 may additionally provide a file conversion program when the file is provided, and when the customer receives a file for the privacy policy, the output unit 150 executes the file conversion program and exists in the corresponding file to be transmitted. It can isolate various malicious codes.

For example, a file conversion program may convert the transferred file into a file format that is compatible with each other, such as “and '* .pptx', '* .doc' and '* .docx' or '* .xls' and '* .xlsx'. After the primary conversion, it can be provided through a secondary conversion that restores the original file format again.

By converting these file types, various malicious codes attached to the file are separated, and the file can be provided as filtered and secure data.

On the other hand, the personal information processing policy preparation and verification automation apparatus 100 according to an embodiment of the present invention may include a memory, a bus, a network interface and a database.

The memory is a computer-readable recording medium, and may include a permanent mass storage device such as random access memory (RAM), read only memory (ROM), and a disk drive. In addition, the program code for the operating system and the service providing routine may be stored in the memory.

These software components may be loaded from a computer readable recording medium separate from the memory 240 using a drive mechanism (not shown). These separate computer-readable recording media

A computer-readable recording medium (not shown), such as a hard drive, a disk, a tape, a DVD / CD-ROM drive, a memory card, and the like, may be included. In other embodiments, software components may be loaded into memory via a network interface rather than a computer readable recording medium.

The bus may enable communication and data transmission between the components of the privacy policy creation and verification automation device 100.

The bus may be configured using a high-speed serial bus, a parallel bus, a storage area network and / or other suitable communication technology.

The network interface may be a computer hardware component for connecting the privacy policy creation and verification automation device 100 to a computer network. The network interface 230 may be a network interface card such as an Ethernet card, an optical transceiver, a radio frequency transceiver, or any other type of device capable of transmitting and receiving information.

Other examples of such network interfaces may be wireless devices including mobile computing devices and Bluetooth, 3G and WiFi, etc. in USB. In some examples, the computing device may use a network interface to communicate wirelessly with an external device, such as a server, mobile phone, or other networked computing device. The network interface may connect the device 100 to a computer network through a wireless or wired connection.

The database may be composed of public institution statistics DB, small and medium business statistics DB, personal statistics DB for storing essential information, preparation guide information, legal information, etc. for creating a personal information processing policy suitable for the customer type.

Here, each statistics DB is a relational database management system (RDBMS) such as Oracle, MYSQL, MSSQL, Infomix, Sybase, DB2, Gemston, Orion, O2. By using an object-oriented database management system (OODBMS) such as OODBMS and an XML Native Database such as Excelon, Tamino, Sekaiju, etc. (field) or element may be included.

Each field or element may be formed of a field or element of a higher concept or a lower concept.

7 is a flowchart illustrating a method for automating the creation and verification of a personal information processing policy according to an embodiment of the present invention, and FIG. 8 is a flowchart illustrating the S730 process illustrated in FIG. 7 in more detail.

Referring to FIGS. 7 and 8, when the personal information processing policy creation and verification automation method according to an embodiment of the present invention (S700) requests the required personal information necessary for creating a suitable personal information processing policy (S710), The customer provides essential information through the customer terminal 10.

The customer inputs necessary information corresponding to a manual provided by the personal information processing policy preparation and verification automation device 100.

The manual may be provided in the form of a check box. In the check box, a business type, a company size, an Internet service, a number of users, an electronic transaction (payment type), whether credit information is collected, Essential information to check whether sensitive information is collected, the number of employees, whether personal information is used, customer inflow information, and the number of customers can be recorded.

Meanwhile, the manual may include text written as exemplary information of essential information required for detailed items of a privacy policy corresponding to each customer. Thus, the customer can enter the necessary information corresponding to or similar to the exemplary information of the manual provided.

When the required information is input, a personal information processing policy is prepared based on the required information (S720).

The S720 process is applied to the customer by using a writing guide composed of markup language-based templates corresponding to a form including essential items that should be included in the personal information processing policy corresponding to the customer (public institution, small business, individual). This may be the process of creating items in the appropriate “Privacy Policy”.

Each of the templates may consist of a plurality of pre-stored queries and sets of responses according to the queries. Here, the plurality of questions and responses may be provided based on statistical data (industry type, size, etc.) of data of a privacy policy of a customer similar to the corresponding customer.

Next, the legal adequacy of the created personal information processing policy is determined (S730).

The process S730 may include a process of determining an association between the words described in the created personal information processing policy and a response (output value) according to a query (input value) (S731).

For example, if the question of “Consignee (consignee)” is entered in the “Matter of Consignment of Personal Information Processing”, it is determined whether the subject is described as a response (output value). As another example, when the query of "content of the task entrusted" is input, it is determined whether a word associated with the task is output as a response (output value).

If an error is determined in step S731, the user may request to rewrite the privacy policy.

In addition, the step S730 may include a step (S732) of determining whether the legal requirements contained in each item of the created personal information processing policy is properly included.

For example, when judging the legal requirements of “mandatory items” and “optional items” in the sub-items of “collecting personal information items and collection methods”, the words in the required items and optional items are extracted, and then the information subject such as social security number Whether items containing items that cannot be collected even with the consent are included (Article 24-2 of the Personal Information Protection Act), and whether unnecessary information is collected in the service entered in the prerequisites, for example, when a customer is listed as a shopping mall operator, The legal requirements adequacy determination unit 142 determines whether to collect information.

As another example, we verify whether the log is kept for a specified period of time, such as transaction records and complaint records, according to the law in the subsection “Retention and Use of Personal Information”.

As another example, we verify that we have the right to refuse consent and, if there is a disadvantage of refusal to consent, whether it includes the content of the disadvantage.

As another example, whether the details of the “Destruction Procedures and Methods of Personal Information” include the categories of Personal Information Destruction Procedures and Destruction Methods, as described in the Destruction Procedures and Destruction Methods, etc. Verify that the information on complete destruction is provided.

Upon completion of the S730 process, the created personal information processing policy is processed and provided in the form of a customer's desired file, and if the adequacy is less than the standard value, the statistics of the personal information processing policy used for each industry, service, and size similar to the object And after providing the creation guide, and requests additional essential information (S740).

Therefore, using the apparatus and method for automating the creation and verification of personal information processing policy according to an embodiment of the present invention, the items of the personal information processing policy of other customers having a similar business type, service, and scale as the customer based on big data analysis And by creating the details of the privacy policy based on the details can minimize the content error, furthermore, there is an advantage that can automatically verify and provide the appropriateness of each of the details of the privacy policy.

Through the above-described advantages, small businesses and individuals can significantly reduce the time required to prepare the privacy policy and the cost of requesting experts.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the devices and components described in the embodiments are, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), It may be implemented using one or more general purpose or special purpose computers, such as a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of understanding, one processing device may be described as being used, but one of ordinary skill in the art will appreciate that the processing device includes a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of these, and configure the processing device to operate as desired, or process it independently or in combination. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device for the purpose of interpreting or providing instructions or data to the processing device. Or may be permanently or temporarily embodied in a signal wave to be transmitted. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored on one or more computer readable recording media.

Method according to the embodiment is implemented in the form of program instructions that can be executed by various computer means may be recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present disclosure, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

The foregoing description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, the exemplary embodiments described above are exemplary in all aspects and the scope of the present invention is represented by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts or Modified forms are to be construed as being included in the scope of the present invention.

100: Automatic personal information policy creation and verification
110: input unit
120: creation guide part
130: Privacy Policy Department
140: verification unit
141: term association determining unit
142: Legal adequacy judgment
150: output unit

Claims (1)

In the method of automating the creation and verification of personal information processing policy using automated personal information processing policy creation and verification,
A) step of inputting, by the input unit, essential information for preparing a personal information processing policy provided by a customer terminal;
B) creating a personal information processing policy based on the required information by the personal information processing policy creating unit;
C) performing verification of the details of the details of the personal information processing policy created by the verification unit and the legal requirements of the contents;
If the adequacy of the verification results does not meet the standard value, the statistics on the personal information processing policy used by industry, service, and size similar to the customer in the preparation guide, and personal information corresponding to the customer of any one of public institutions, small businesses and individuals After providing the example information of the essential information for preparing the details of the processing policy with a check box and a textual manual, requesting additional personal information, and when the appropriateness reaches the reference value, the privacy policy created at the output unit D) processing the data into a desired file format of the customer and providing the same;
Step b)
The personal information processing policy writing unit is a step of creating using a creation guide including a template corresponding to the form containing the necessary items to be included in the customer's personal information processing policy,
Step c)
Determining, by the term association determining unit of the verification unit, the association between the words described in the created personal information processing policy and the response (output value) according to a query (input value); And
Determining the adequacy of the legal requirements of the content contained in each detail item of the prepared personal information processing policy in the legal requirements adequacy determination unit of the verification unit,
Each of the above templates
Consisting of a plurality of pre-stored queries and sets of responses according to the queries, the plurality of queries and responses being based on statistical data including the type and size of data of a customer's privacy policy similar to the customer Provided by
The manual checks the type of business, company size, internet service usage, number of users, electronic transactions (payment type), whether credit information is collected, whether sensitive information is collected, the number of employees, whether personal information is used, customer inflow information, and the number of customers. The necessary information for recording is recorded,
The manual provided by the preparation guide part passes the appropriateness of legal requirements, and then provides a personal information processing policy and automated verification provided to the customer.

Images