JP7201326B2 - Anonymous processing device, information anonymization method, and program - Google Patents

Description

The present invention relates to an anonymization device, an information anonymization method, and a program for anonymizing information, particularly personal information.

When acquiring and distributing personal information (providing it to a third party), it is necessary to obtain the consent of the individual. Personal information is, for example, information about a living individual, and is information that can identify a specific individual by name, date of birth, address, or the like.

On the other hand, anonymously processed information does not require the consent of the individual. Anonymously processed information is information obtained by processing personal information, and is information that cannot be used to identify an individual and cannot be restored to the personal information before processing. Therefore, unlike personal information, anonymously processed information can be used relatively freely.

In relation to the above, for example, Patent Literature 1 describes a technique for selecting attributes to be anonymized based on appearance rate and survival rate. Further, Patent Literatures 2 and 3 describe techniques for performing anonymization based on predetermined anonymization rules for anonymization.

JP 2013-200659 A JP 2017-168130 A Japanese translation of PCT publication No. 2012-063546

Process anonymously processed information until November 2016, when the Personal Information Protection Commission, an external bureau of the Cabinet Office of Japan, issues the "Guidelines for the Act on the Protection of Personal Information." There were no anonymization rules in line with the guidelines for

In addition, even when creating anonymously processed information, the trader must comply with predetermined anonymous processing rules. In the above, the trader is, for example, a holding trader who holds anonymously processed information and a utilization trader who utilizes anonymously processed information. Further, in the above, the predetermined anonymization rule is a rule for maintaining a state in which an individual cannot be identified and personal information cannot be restored to the state before processing. Failure to comply with this anonymization rule may be considered a violation of the law. Therefore, for example, in order not to violate the law, the holding company has taken measures such as deleting all data items that can identify individuals.

If there is no anonymization rule, information will be generalized more than necessary, and data specifications will be non-uniform for each trader. As a result, the distribution and utilization of anonymously processed information are hindered.

Since the anonymization rules used in Patent Literatures 2 and 3 are not anonymization rules in accordance with the above guidelines, there is a problem in promoting the distribution and utilization of anonymously processed information.

The present invention has been made to solve the above problems, and aims to provide an anonymization device, an information anonymization method, and a program that can facilitate the distribution and utilization of anonymously processed information. aim.

The anonymization device of the present invention acquires the anonymization rule information from a rule information database that stores the anonymization rule information, which is electronic data of the rules for processing described in legal guidelines, and acquires the acquired anonymization rule information. Anonymization processing means is provided for processing personal information based on anonymization rule information to create anonymously processed information.

The anonymization method of the present invention acquires the anonymization rule information from a rule information database that stores the anonymization rule information, which is electronic data of rules for processing described in legal guidelines, and acquires the acquired anonymization rule information. Anonymously processed information is created by processing personal information based on anonymous processing rule information.

The program of the present invention acquires the anonymous processing rule information from the rule information database that stores the anonymous processing rule information, which is electronic data of the processing rules described in the guideline in accordance with the law, in the computer of the anonymous processing device. and processing personal information based on the obtained anonymous processing rule information to create anonymously processed information.

According to the present invention, it becomes possible to facilitate the distribution and utilization of anonymously processed information.

1 is a block diagram showing a configuration example of an anonymous processing device according to a first embodiment of the present invention; FIG. 2 is a flowchart for explaining an operation example (anonymization method) of the anonymization device shown in FIG. 1; FIG. 11 is a block diagram showing a configuration example of an anonymous processing device according to a second embodiment of the present invention; A data configuration example of personal information is shown. A data configuration example of anonymous processing rule information is shown. A data configuration example of public personal information is shown. FIG. 4 is a flow chart for explaining an operation example (anonymization method) of the anonymization device shown in FIG. 3; FIG. FIG. 11 is a block diagram showing a configuration example of an anonymous processing device according to a third embodiment of the present invention; FIG. 14 is a block diagram showing a configuration example of an anonymous processing system according to a fourth embodiment of the present invention;

[First embodiment]
FIG. 1 is a block diagram showing a configuration example of an anonymous processing device 10 according to the first embodiment of the present invention. The anonymization device 10 is a device that creates anonymously processed information by performing anonymization processing on personal information.

Personal information is information about a living individual, and is information that can identify a specific individual by name, date of birth, address, or the like. On the other hand, according to the "Guidelines for the Act on the Protection of Personal Information," anonymously processed information refers to personal information that is processed in such a way that it is impossible to identify a specific individual by taking measures determined according to the classification of personal information. It is information about individuals obtained by processing into "Guidelines for the Act on the Protection of Personal Information" was issued in November 2016 by the Personal Information Protection Commission, an external bureau of the Cabinet Office of Japan. Hereinafter, in this document, the "Guidelines for the Act on the Protection of Personal Information" will be abbreviated as the "Guidelines for the Act on the Protection of Personal Information."

The anonymization device 10 includes an anonymization processing unit 14 (an example of anonymization processing means).

The anonymization processing unit 14 acquires anonymization rule information from a rule information database (not shown in FIG. 1) that stores anonymization rule information in which processing rules described in legal guidelines are converted into electronic data. do. The anonymous processing unit 14 processes personal information based on the acquired anonymous processing rule information to create anonymously processed information.

The rule information database stores anonymous processing rule information, which is electronic data of processing rules described in guidelines in accordance with laws, for example, personal information protection law guidelines.

The rule information database may exist inside the anonymous processing device 10 or may exist outside the anonymous processing device 10 . When the rule information database exists outside the anonymization device 10, the rule information database is communicably connected to the anonymization device 10 via a predetermined communication interface.

FIG. 2 is a flowchart for explaining an operation example (anonymization method) of the anonymization device 10 shown in FIG. It is assumed that the above-described anonymous processing rule information is stored in advance in the rule information database prior to the execution of the anonymous processing. Also, in the following description, a case where the guideline in accordance with the law is, for example, the personal information protection law guideline will be taken as an example.

First, the anonymous processing unit 14 acquires personal information. The acquisition method of personal information is arbitrary. For example, the personal information is read from a personal information database (not shown in FIG. 1) provided inside the anonymous processing device 10, or supplied from a device external to the anonymous processing device 10. FIG.

The anonymous processing unit 14 acquires anonymous processing rule information from the rule information database (step S1).

The anonymous processing unit 14 processes the personal information based on the anonymous processing rule information to create anonymously processed information (step S2).

The content of the personal information and the anonymization rule information and the anonymization processing in the anonymization processing unit 14 may be those described in the second embodiment below.

According to the first embodiment described above, in the anonymization device 10, the anonymization processing is performed based on legal guidelines, for example, anonymization rule information defined in the Personal Information Protection Act guidelines. . In short, since anonymization processing can be performed based on information on anonymization rules authorized by public institutions, there is no need to be aware of legal violations, and personal information is not anonymized more than necessary. Furthermore, the data specifications do not become non-uniform for each trader. That is, according to the first embodiment, it is possible to easily promote the distribution and utilization of anonymously processed information.
[Second embodiment]
(Description of configuration)
FIG. 3 is a block diagram showing a configuration example of an anonymous processing device 100 according to the second embodiment of the present invention. The anonymous processing device 100 includes a configuration based on the anonymous processing device 10 shown in FIG.

The anonymization device 100 includes an anonymization processing unit 102 (an example of anonymization processing means), a personal information database 104, a rule information database 106, and a public personal information database 108.

Personal information database 104 stores personal information 200 . FIG. 4 shows a data configuration example of the personal information 200. As shown in FIG. The personal information 200 is composed of first attribute information 202 which is information indicating an attribute and individual personal information 204 which is information indicating an attribute value of the first attribute information 202 .

FIG. 4 illustrates a case where there is one piece of personal information 200 and the first attribute information 202 is each of four attributes (for example, "name", "age", "address", and "occupation"). be. In this case, the individual personal information 204, which is the attribute value of the first attribute information 202, has four attribute values (for example, "Taro Nichiden", "39", "Nakahara Ward, Kawasaki City, Kanagawa Prefecture", and "company employee"). Each of Of course, the number of pieces of personal information 200 may be two or more. Also, the number of pieces of first attribute information 202 may be 3 or less, or may be 5 or more.

The rule information database 106 stores anonymous processing rule information 210 in which processing rules described in legal guidelines are digitized.

In this embodiment, the case where the anonymous processing rule information 210 is the anonymous processing rule information described in the Personal Information Protection Law guidelines is taken as an example. FIG. 5 shows a data configuration example of the anonymous processing rule information 210. As shown in FIG. The anonymous processing rule information 210, as shown in FIG. Each processing rule is composed of individual processing rule information 214 (for example, "delete", "truncate the first digit", "leave prefecture and city only", and "leave", respectively). . Of course, the number of pieces of second attribute information 212 may be three or less, or may be five or more.

The public personal information database 108 stores public personal information 220 which is personal information in which at least one piece of individual personal information 204 is anonymized and which can be disclosed to a third party. FIG. 6 shows a data configuration example of the public personal information 220. As shown in FIG. Public personal information 220 is composed of processed individual personal information 222 (for example, each of “30s”, “Kawasaki City, Kanagawa Prefecture”, and “office worker”).

The anonymous processing unit 102 basically performs anonymous processing on the acquired personal information 200 based on the anonymous processing rule information 210, similarly to the anonymous processing unit 14 shown in FIG.

Specifically, the anonymous processing unit 102 acquires the personal information 200 from the personal information database 104 . The anonymization processing unit 102 compares the first attribute information 202 of each of the acquired personal information 200 with all the second attribute information 212 in the anonymization rule information 210 in round robin fashion. That is, the anonymous processing unit 102 determines whether or not the second attribute information 212 identical to each first attribute information 202 exists in the anonymous processing rule information 210 .

When the anonymous processing unit 102 determines that the same second attribute information 212 as the certain first attribute information 202 exists, it acquires the individual processing rule information 214 of the same second attribute information 212 . The anonymous processing unit 102 anonymously processes the individual personal information 204 corresponding to the same first attribute information 202 as the second attribute information 212 in the personal information 200 based on the acquired individual processing rule information 214 .

The anonymization processor 102 stores public personal information 220 , which is personal information obtained by anonymizing at least one piece of individual personal information 204 , in the public personal information database 108 .

The personal information 200 may include information that is not subject to anonymous processing. In other words, personal information 200 may include information having first attribute information 202 that does not match all second attribute information 212 in anonymization rule information 210 . Such information is referred to as attribute mismatch information in this embodiment. Anonymization is not performed on attribute mismatch information. Also, handling of attribute mismatch information is optional. For example, attribute mismatch information may be stored in public personal information database 108 as it is without anonymization processing.

The anonymous processing unit 102 may be configured by an electronic circuit such as an IC (Integrated Circuit) or FPGA (Field Programmable Gate Array). Alternatively, the anonymous processing unit 102 may be configured such that a computer (for example, a CPU (Central Processing Unit)) executes a program stored in memory. Of course, the anonymous processing unit 102 may be configured by a combination of an electronic circuit and a computer.
(Description of operation)
FIG. 7 is a flow chart for explaining an operation example (anonymization method) of the anonymization device 100 shown in FIG. Note that steps S10 to S14 described with reference to FIG. 7 describe the processing executed by the anonymization processing unit 102. FIG. It is assumed that anonymization rule information 210 is stored in advance in the rule information database 106 prior to execution of these processes.

The anonymous processing unit 102 acquires the personal information 200 (step S10).

The anonymous processing unit 102 determines whether or not the second attribute information 212 identical to each first attribute information 202 exists in the anonymous processing rule information 210 (step S11). The anonymization processing unit 102 compares one piece of first attribute information 202 of one piece of personal information 200 with all of the second attribute information 212 in the anonymization rule information 210 in a brute-force manner. Information for which the same second attribute information 212 does not exist is called attribute mismatch information as described above.

If the same second attribute information 212 as one piece of first attribute information 202 exists (Yes in step S11), the anonymous processing unit 102 converts the individual personal information 204 of the first attribute information 202 into the same Anonymous processing is performed based on the individual processing rule information 214 of the 2 attribute information 212 (step S12).

For example, if one piece of the first attribute information 202 is “name”, the anonymization processing unit 102 converts “Nichiden Taro” of the individual personal information 204 whose first attribute information 202 is “name” to The individual processing rule information 214 is deleted according to "delete".

On the other hand, if there is no second attribute information 212 that is the same as one of the first attribute information 202 (No in step S11), the anonymous processing unit 102 processes the individual personal information 204 of the first attribute information 202 Anonymization processing is not performed (step S13).

Although not shown in FIG. 7, the processes of steps S11 to S13 are repeatedly executed until the round-robin comparison of all the first attribute information 202 of one piece of personal information 200 is completed. Furthermore, when a plurality of pieces of personal information 200 are stored in the personal information database 104, the processing of steps S10 to S13 is repeatedly executed until the processing of all the pieces of personal information 200 is completed.

The anonymization processor 102 stores public personal information 220, which is personal information obtained by anonymizing the individual personal information 204, in the public personal information database 108 (step S14). The anonymous processing unit 102 stores the public personal information 220 shown in FIG. 6, for example, in the public personal information database 108 . FIG. 6 shows public personal information 220 obtained by anonymizing the personal information 200 shown in FIG. 4 based on the anonymous processing rule information 210 shown in FIG.
(Explanation of effect)
In the second embodiment described above, the anonymous processing is performed based on the anonymous processing rule information 210. FIG. The anonymous processing rule information 210 is anonymous processing rule information in accordance with the Personal Information Protection Act guidelines, which are guidelines for the Act on the Protection of Personal Information. In short, since anonymization processing can be performed based on information on anonymization rules authorized by public institutions, there is no need to be aware of legal violations, and personal information is not anonymized more than necessary. Furthermore, the data specifications do not become non-uniform for each trader. That is, according to the second embodiment, circulation and utilization of anonymously processed information are promoted. Specifically, data distribution will be promoted between businesses that collect personal information and businesses that use personal information for disclosure (anonymized personal information). Active utilization.

In addition, the holding of the rule information database 106 that stores the anonymous processing rule information 210, which is the anonymous processing rule information in accordance with the Personal Information Protection Act guidelines, can be used for the accountability of traders who are oriented toward data distribution.

Furthermore, in the anonymization device 100 of the second embodiment, the public personal information 220, which is personal information obtained by anonymizing at least one individual personal information 204, is stored in a public personal information database separate from the personal information database 104. 108. That is, since the public personal information 220, which is information for public use, is stored separately from the personal information 200, which basically cannot be made public, the risk of personal information leakage can be reduced.

In the second embodiment described above, an example in which the personal information database 104 that stores the personal information 200 is built in the anonymization device 100 is shown. may be outside the However, in that case, the network between the personal information database 104 and the anonymization device 100 is provided with measures to prevent leakage of personal information.
[Third Embodiment]
FIG. 8 is a block diagram showing a configuration example of the anonymous processing device 300 according to the third embodiment of the present invention. Specifically, the anonymous processing device 10 shown in FIG. 1 or the anonymous processing device 100 shown in FIG. is a block diagram of an anonymous processing device 300 implemented by a computer. The anonymous processing device 300 includes a storage device 302 and an arithmetic device 304 (computer) including a processor and the like. The storage device 302 is a computer-readable recording medium and stores a computer program 350 . The computer program 350 is, for example, a program for causing the arithmetic device 304 to execute the operations described in the first embodiment and the operations described in the second embodiment. For example, the computer program 350 acquires the anonymous processing rule information from the rule information database that stores the anonymous processing rule information, which is electronic data of the processing rule described in the guideline in accordance with the law, and acquires the acquired anonymous processing rule. This is a process of processing personal information based on information to create anonymously processed information.

It should be noted that examples of arithmetic unit 304 include, for example, one or more CPUs that read and execute programs, and memory that stores instructions that the CPUs execute. Also, the computer-readable recording medium is, for example, a non-temporary storage device. Examples of non-temporary storage devices include portable media such as optical disks, magnetic disks, ROMs (Read Only Memory), non-volatile semiconductor memories, and hard disks built into computer systems. A computer-readable recording medium may also be a temporary storage device. Examples of temporary storage devices include signal lines for transmitting programs via networks such as the Internet and communication lines such as telephone lines, and volatile memories within computer systems.

According to the third embodiment described above, like the first and second embodiments, the distribution and utilization of anonymously processed information are promoted according to the third embodiment.
[Fourth embodiment]
FIG. 9 is a block diagram showing a configuration example of an anonymous processing system 400 according to the fourth embodiment of the invention. The anonymous processing system 400 includes an anonymous processing device 402 and an information processing device 404 . The anonymization device 402 is communicably connected to the information processing device 404 via a network 406 such as the Internet.

The information processing device 404 is a device of a user who desires anonymous processing of personal information. The anonymous processing device 402 is, for example, any one of the first to third embodiments. The anonymization device 402 performs anonymization processing on personal information based on a request from the information processing device 404 . Anonymous processing is as described above.

According to the fourth embodiment described above, for example, it is possible to provide the anonymous processing device 402 on the cloud. That is, according to this embodiment, it is possible to provide anonymization service over the network.

Although the present invention has been described using each embodiment, the technical scope of the present invention is not limited to the description of each embodiment. It is obvious to those skilled in the art that various modifications or improvements can be made to each of the above embodiments. Therefore, it is needless to say that the forms with such changes or improvements are also included in the technical scope of the present invention. Numerical values, names of components, and the like used in each of the embodiments described above are examples and can be changed as appropriate.

10 Anonymous processing device 14 Anonymous processing unit 100 Anonymous processing device 102 Anonymous processing unit 104 Personal information database 106 Rule information database 108 Public personal information database 200 Personal information 202 First attribute information 204 Individual personal information 210 Anonymous processing rule information 212 Second attribute information 214 Individual processing rule information 220 Public personal information 300 Anonymous processing device 302 Storage device 304 Arithmetic device 350 Computer program 400 Anonymous processing system 402 Anonymous processing device 404 Information processing device 406 Network

Claims (8)

Acquire the anonymization rule information from the rule information database that stores the anonymization rule information that is electronic data of the processing rules described in the guidelines in accordance with the law, and the individual based on the acquired anonymization rule information Equipped with anonymization processing means for processing information to create anonymously processed information,
The personal information includes first attribute information and individual personal information about the first attribute information, and the anonymous processing rule information includes second attribute information and individual processing rule information about the second attribute information. and
The anonymous processing means determines whether or not the second attribute information identical to the first attribute information exists in the anonymous processing rule information,
When it is determined that the same second attribute information does not exist, the anonymous processing means does not anonymously process the individual personal information of the first attribute information that does not have the same second attribute information. Anonymous processing device. 2. The anonymization processing apparatus according to claim 1, wherein said guideline is a guideline regarding a law concerning the protection of personal information. When it is determined that the same second attribute information exists, the anonymous processing means uses the same first attribute information as the second attribute information based on the individual processing rule information of the same second attribute information. 3. The anonymous processing device according to claim 2 , wherein said individual personal information of attribute information is processed anonymously. 4. The anonymous processing means stores the anonymous personal information obtained by anonymizing the individual personal information in a public personal information database as public personal information that can be disclosed to a third party. The anonymous processing device according to any one of 1-3 . 5. The anonymous processing device according to any one of claims 1 to 4 , wherein said rule information database is incorporated. the anonymous processing device according to any one of claims 1 to 5 ;
an information processing device of a user who desires anonymous processing of the personal information;
with
The anonymization device is communicably connected to the information processing device via a network,
An anonymization system, wherein the anonymization device performs anonymization processing on the personal information based on a request from the information processing device. Acquire the anonymization rule information from the rule information database that stores the anonymization rule information that is electronic data of the rules for processing described in the legal guideline, and personalize based on the acquired anonymization rule information An anonymous processing method for processing information to create anonymously processed information ,
The personal information is composed of first attribute information and individual personal information about the first attribute information,
The anonymous processing rule information is composed of second attribute information and individual processing rule information for the second attribute information,
In the method for creating the anonymously processed information, determining whether or not the second attribute information identical to the first attribute information exists in the anonymously processed rule information;
When it is determined that the same second attribute information does not exist, the individual personal information of the first attribute information that does not have the same second attribute information is not anonymized.
An anonymous processing method characterized by: on the computer of the anonymization device,
Acquire the anonymization rule information from the rule information database that stores the anonymization rule information that is electronic data of the processing rules described in the guidelines in accordance with the law, and the individual based on the acquired anonymization rule information A program for executing a process of processing information to create anonymously processed information ,
The personal information is composed of first attribute information and individual personal information about the first attribute information,
The anonymous processing rule information is composed of second attribute information and individual processing rule information for the second attribute information,
determining whether or not the second attribute information identical to the first attribute information exists in the anonymously processed rule information in the process of creating the anonymously processed information;
When it is determined that the same second attribute information does not exist, the individual personal information of the first attribute information that does not have the same second attribute information is not processed anonymously.
A program characterized by

Images