JP7589059B2 - DATA DISTRIBUTION SYSTEM, DATA DISTRIBUTION METHOD, AND DATA PROVIDING METHOD - Google Patents

Description

The present invention generally relates to the distribution of personal data from a data providing device to a data using device.

In recent years, data distribution services have been provided that utilize platforms that act as intermediaries between those who provide data (data providers) and those who want the data (data users). Information banks are considered to be one form of data distribution service, and the data that is distributed is personal data, including personal information.

One-stop services are one type of service that utilizes data distribution. For example, in a one-stop moving service, the one-stop service provider has the user register their personal data, then provides the personal data to multiple recipient businesses (electricity companies, gas companies, telecommunications companies, etc.) and carries out the procedures electronically, aiming to reduce the effort required for the user. In this one-stop service, the one-stop service provider is the data provider, the multiple recipient businesses are data users, and it is the registered personal data that is sent and received.

A technology has been disclosed that can reduce the procedure for obtaining consent from users when providing personal data (see Patent Document 1). Patent Document 1 discloses that when the amount of information in personal data provided in the past is different, it is possible to determine whether or not consent needs to be obtained from the user depending on the amount of change in the different information.

JP 2020-24511 A

In data distribution, including one-stop services, data providers transmit the same or similar personal data to multiple data users. With regard to the distribution of personal data, it is advisable for users to confirm and agree to the privacy policy, which specifies to which data user the personal data will be provided and for what purpose the personal data will be used by the data user.

Checking a privacy policy is a time-consuming task. Since a one-stop service provides personal data to multiple data users, checking the privacy policies of multiple data users would take a lot of time, undermining the simplification of procedures that the one-stop service aims to achieve. On the other hand, providing personal data without checking the privacy policy could undermine the user's peace of mind and safety. For this reason, there is a need to simplify the confirmation and consent process for the provision of personal data while ensuring the user's peace of mind and safety.

Patent Document 1 discloses that when the number of data items to be provided increases, the consent procedure is simplified based on whether there has been past consent and the amount of change. However, when providing personal data through a one-stop service, the data items used by the data recipient (data user) of the personal data often do not change much. Therefore, the technology described in Patent Document 1 cannot simplify consent when providing similar personal data to a variety of data recipients.

The present invention has been made in consideration of the above points, and aims to propose a data distribution system etc. that can simplify consent for a data providing device to provide personal data to a data using device.

In order to solve this problem, the present invention provides a data distribution system that mediates personal data from one or more data providing devices to one or more data utilizing devices, in which the data providing device receives personal data input by a user from a user terminal, performs processing to omit some or all of the confirmation information using rule information that specifies rules for omitting some or all of the confirmation information that the user confirms to determine whether or not the user agrees to provide the personal data to the data utilizing device, and the processed confirmation information is displayed on the user terminal. If consent is obtained to provide the personal data to the data utilizing device, the personal data is transmitted to the data utilizing device.

In the above configuration, some or all of the confirmation information that the user confirms to determine whether or not he or she agrees to provide the personal data to the data utilization device is omitted, so that, for example, the user can easily determine whether or not he or she agrees to the distribution of personal data from the data providing device to the data utilization device.

The present invention makes it possible to realize a highly convenient data distribution system. Problems, configurations, and advantages other than those described above will become clear from the description of the embodiments below.

1 is an example of a configuration of a data distribution system according to a first embodiment. FIG. 11 is a diagram showing an example of a sequence according to the first embodiment. FIG. 11 is a diagram showing an example of a sequence according to the first embodiment. FIG. 2 is a diagram illustrating an example of a data management catalog according to the first embodiment. FIG. 11 is a diagram illustrating an example of a confirmation information generating process according to the first embodiment. FIG. 4 illustrates an example of a management table according to the first embodiment; FIG. 11 is a diagram showing an example of a confirmation screen according to the first embodiment. FIG. 11 is a diagram illustrating an example of a data management catalog according to the second embodiment. FIG. 13 is a diagram showing an example of a registration screen according to the third embodiment.

(I) First Embodiment Hereinafter, one embodiment of the present invention will be described in detail. However, the present invention is not limited to the embodiment.

This embodiment relates to a technology that supports the mediation (distribution) of data between a data provider and a data user. In the data distribution system according to this embodiment, the data providing device controls the confirmation information, including information on the data usage conditions, presented to the user for consent to data provision so that it is reduced in amount, and after the user has viewed and consented to the confirmation information, transmits personal data (provides data) to the data using device. Here, personal data refers to data required for each procedure of the one-stop service. Personal data includes, for example, personal information such as name, address, telephone number, email address, and customer number for each service.

The above configuration makes it possible to reduce the amount of work required to confirm the data usage conditions, etc., when a user agrees to the provision of data.

The designations "first," "second," "third," and the like in this specification are used to identify components and do not necessarily limit the number or order. Furthermore, numbers for identifying components are used in different contexts, and a number used in one context does not necessarily indicate the same configuration in another context. Furthermore, this does not prevent a component identified by a certain number from also serving the function of a component identified by another number.

Next, an embodiment of the present invention will be described with reference to the drawings. The following description and drawings are examples for explaining the present invention, and some parts have been omitted or simplified as appropriate for clarity of explanation. The present invention can also be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

In the following description, identical elements in the drawings are given the same numbers and descriptions are omitted as appropriate. When describing elements of the same type without distinction, the common portion (excluding the branch number) of the reference number including the branch number is used, and when describing elements of the same type with distinction, the reference number including the branch number may be used. For example, when describing data providing devices without distinction, they may be written as "data providing device 110", and when describing individual data providing devices with distinction, they may be written as "data providing device 110-1", "data providing device 110-2", etc.

(Data distribution system configuration)
1 shows an example of the configuration of a data distribution system 100 in the first embodiment. The data distribution system 100 includes a data providing device 110, a data utilization device 120, a data distribution support device 130, a user terminal 140 owned by a user, and a management terminal 150. The data providing device 110, the data utilization device 120, and the data distribution support device 130 are connected to each other via a network 101. The data providing device 110 and the user terminal 140 are connected via a network 102. The data distribution support device 130 and the management terminal 150 are connected via a network 103.

The data providing device 110 includes an interface 111 with the user terminal 140, a processing unit 112, an interface 113 with the data distribution support device 130, a conversion unit 114, an interface 115 with the data utilization device 120, and a management unit 116.

The interface 111 provides the user terminal 140 with information indicating the data destination of the personal data, confirmation information for data provision, and the like. The processing unit 112 generates and outputs confirmation information to be passed to the interface 111 based on the policy acquired from the management unit 116 and the data management catalog of each data destination acquired from the data distribution support device 130. Here, the policy is information indicating one or more rules for omitting confirmation information, and is a collection of rules on what information to check when confirming confirmation information, and under what data usage conditions data can be provided to the data user. The policy will be described later with reference to FIG. 6. The data management catalog is information that includes the data format required by the data user, the purpose of use of the personal data, and the like. The data management catalog will be described later with reference to FIG. 4.

The interface 113 communicates with the data distribution support device 130 via the network 101, sends a message to the data distribution support device 130 to obtain a data management catalog, and outputs the data management catalog returned from the data distribution support device 130 to the processing unit 112 and the conversion unit 114. The conversion unit 114 converts the personal data received via the interface 111 based on the data management catalog so that it complies with the data specifications of the data utilization device 120 (data user side), and outputs the personal data converted for the data user to the interface 115. The interface 115 transmits the personal data converted by the conversion unit 114 to the data utilization device 120.

The data distribution support device 130 includes a providing unit 131, a memory unit 132, and a registration unit 133.

When the providing unit 131 receives a message from the data providing device 110 to obtain a data management catalog via the network 101, it obtains the data management catalog from the storage unit 132 and transmits the obtained data management catalog to the data providing device 110. The storage unit 132 stores the registration contents and correction contents (described later) received from the registration unit 133 in a storage device as a data management catalog. In addition, when a data management catalog is requested from the providing unit 131, the storage unit 132 reads the data management catalog from the storage device and transmits it. The registration unit 133 receives a message requesting registration of the data management catalog from the data utilization device 120, and transmits the registration contents to the storage unit 132 after examining the data items and values (registration contents) of the data management catalog included in the message. In addition, the registration unit 133 receives a message requesting correction of the data management catalog from the data utilization device 120, and transmits the correction contents to the storage unit 132 after examining the data items and values (correction contents) of the data management catalog included in the message.

According to the above configuration, the data providing device 110 can obtain a data management catalog from the data distribution support device 130, and control and output confirmation information for data provision based on the obtained data management catalog and a policy registered by the user or a policy prepared in advance.

In the above explanation, the data management catalog is managed centrally in the data distribution support device 130, but it may be managed in a decentralized manner. Also, while the data providing device 110 and the data utilization device 120 have been described separately, a certain person, organization, etc. may act as both a data provider and a data user, in which case a certain data providing device 110 and a certain data utilization device 120 will be the same. Also, in this example, the data conversion process is performed by the data providing device 110, but the data conversion process may be performed by another computer, such as the data utilization device 120, the data distribution support device 130, or a computer not shown.

In addition, the data providing device 110 may be a notebook computer, a server device, or the like, and may include, for example, a CPU (Central Processing Unit), RAM (Random Access Memory), ROM (Read Only Memory), HDD (Hard Disk Drive), a communication device, and the like, all of which are not shown.

The functions of the data providing device 110 (interface 111, processing unit 112, interface 113, conversion unit 114, interface 115, etc.) may be realized, for example, by the CPU reading a program stored in ROM into RAM and executing it (software), or may be realized by hardware such as a dedicated circuit, or may be realized by a combination of software and hardware.

Note that one function of the data providing device 110 may be divided into multiple functions, or multiple functions may be combined into one function. Also, some of the functions of the data providing device 110 may be provided as a separate function, or may be included in another function. Also, some of the functions of the data providing device 110 may be realized by another computer that can communicate with the data providing device 110.

The data utilization device 120 is a notebook computer, a tablet terminal, etc., and is configured to include, for example, a CPU, RAM, ROM, HDD, communication device, etc. (not shown).

The data distribution support device 130 is a notebook computer, a server device, etc., and is configured to include, for example, a CPU, RAM, ROM, HDD, communication device, etc. (not shown).

The functions of the data distribution support device 130 (providing unit 131, memory unit 132, registration unit 133, etc.) may be realized, for example, by the CPU reading a program stored in ROM into RAM and executing it (software), or may be realized by hardware such as a dedicated circuit, or may be realized by a combination of software and hardware.

Note that one function of the data distribution support device 130 may be divided into multiple functions, or multiple functions may be combined into one function. Also, some of the functions of the data distribution support device 130 may be provided as separate functions, or may be included in other functions. Also, some of the functions of the data distribution support device 130 may be realized by another computer that can communicate with the data distribution support device 130.

The user terminal 140 is a notebook computer, a tablet terminal, a smartphone, etc., and is configured to include, for example, a CPU, RAM, ROM, HDD, communication device, etc., which are not shown in the figure. The management terminal 150 is a notebook computer, a tablet terminal, a smartphone, etc., and is configured to include, for example, a CPU, RAM, ROM, HDD, communication device, etc., which are not shown in the figure.

(Sequence for registering and modifying data management catalog)
Next, a sequence for registering and modifying the data management catalog will be described with reference to FIG.

First, we will explain the sequence for registering a data management catalog.

First, the data user's organization decides what to register in the data management catalog, and the data utilization device 120 sends a message (registration content) to the data distribution support device 130 to register the data management catalog (S201). When the data distribution support device 130 receives this message, it sends the registration content to the management terminal 150 so that the administrator of the data distribution system 100 can review the registration content via the management terminal 150 (S202). The administrator reviews the registration content based on whether the registration content is appropriate, whether the purpose of use is expressed in an easily understandable way, whether the content differs from the original privacy policy, etc. (S203).

When the administrator selects whether or not to register, the management terminal 150 transmits the result of whether or not to register to the data distribution support device 130 (S204). If the result of whether or not to register is yes, the data distribution support device 130 stores (registers) the registration contents as a data management catalog and makes the data management catalog public (available) (S205). The scope of publication of the data management catalog may be within the scope of a consortium consisting of multiple data provider organizations, data user organizations, etc., or may be widely published on the Internet. When registration is complete, the data distribution support device 130 transmits the result of whether or not to register to the data utilization device 120 (S206).

Next, we will explain the sequence for modifying a registered data management catalog.

When the data user decides on the revision content of the data management catalog, the data utilization device 120 sends a message (revised content) for revising the data management catalog to the data distribution support device 130 (S211). When the data distribution support device 130 receives this message, it sends the revision content to the management terminal 150 (S212). The administrator reviews the revision content (S213).

When the administrator selects whether or not the modification is possible, the management terminal 150 transmits the result of whether or not the modification is possible to the data distribution support device 130 (S214). If the result of whether or not the modification is possible indicates that the modification is possible, the data distribution support device 130 updates the data management catalog with the modification content and makes the modified data management catalog publicly available (S215). The data distribution support device 130 transmits the result of whether or not the modification is possible to the data utilization device 120 (S216).

Through the above processing, the data distribution support device 130 can have the administrator review the registration details and correction details entered by the data user before publishing them as a data management catalog.

(Sequence of data provision)
The procedure for a data provider to provide personal data to a plurality of data users via a data distribution service will be described with reference to the sequence shown in Fig. 3. Fig. 3 is a diagram showing an example of the sequence.

First, the user accesses the data providing device 110 via the user terminal 140 and registers personal data (S301). Next, the user selects a confirmation policy for data provision via the user terminal 140 (S302).

Next, the data providing device 110 transmits a list of candidate procedure destinations in the one-stop service provided by the data provider to the user terminal 140 (S303). The user terminal 140 displays the list of candidate procedure destinations. The user selects a candidate procedure destination via the user terminal 140, and the user terminal 140 transmits information on the candidate procedure destination (procedure destination) selected by the user to the data providing device 110 (S304). Here, the procedure destination is the data destination of the personal data, i.e., the data user (data utilization device 120).

The data providing device 110 sends a message (request) to the data distribution support device 130 to acquire a data management catalog corresponding to the procedure destination sent from the user terminal 140 (S305). For example, the data providing device 110 specifies the ID of the data management catalog corresponding to the procedure destination (data destination) selected by the user (for example, the linked service ID 401 described below) and requests the data distribution support device 130 to send a data management catalog of the corresponding ID. The data distribution support device 130 acquires the requested data management catalog and transmits (replies) the acquired data management catalog to the data providing device 110 (S306). If there are multiple procedure destinations (data destinations), the processes of S305 and S306 are repeated the number of times corresponding to the procedure destinations.

Next, the data providing device 110 uses the acquired data management catalog to compare the data items of the personal data registered by the user with the data items required at the destination of the procedure, and checks whether there are any missing data items (checks whether there are any additional input items) (S307). If there are any missing data items, the data providing device 110 sends an input request for those data items (request for additional data) to the user terminal 140 (S308). The user inputs data for those data items, and the user terminal 140 transmits (responses) the input data (additional data) to the data providing device 110 (S309).

Next, when the data providing device 110 has acquired all the personal data including the data of the additional input items, it converts the personal data to match the format of the data recipient based on the format of each data item included in the data management catalog acquired from the data distribution support device 130 (S310). For example, if the address value provided by the user is "6-6, Marunouchi 1-chome, Chiyoda-ku, Tokyo," and the data user requires the address to be in a format in which the block number is written in half-width numbers, the data providing device 110 converts it to "1-6-6, Marunouchi, Chiyoda-ku, Tokyo."

Next, the data providing device 110 generates confirmation information for the data provision (S311). Here, the data providing device 110 generates, as the confirmation information, a privacy policy (handling of personal information) including which data user the user will provide what data to, for what purpose the provided data will be used by the data user, and whether the data will be provided to other organizations. For example, the data providing device 110 generates screen information including confirmation information for the user to confirm. Note that in this embodiment, the data providing device 110 does not simply generate and display this information, but controls the confirmation information so that it is the minimum necessary information based on the data items of multiple data destinations, the purpose of using personal data, and the policy for data provision. The processing of S311 will be described later with reference to FIG. 5.

Next, the data providing device 110 transmits screen information to the user terminal 140 and requests confirmation of the confirmation information (confirmation of the contents of the data provision) (S312). The user confirms the confirmation information on the confirmation screen displayed on the user terminal 140, and if the user agrees to the data provision, presses a check button, and then presses a button to execute the data provision to the data user. The user terminal 140 then transmits information indicating the data destination (data utilization device 120) for which consent to the data provision has been given to the data providing device 110 (S313). The confirmation screen will be described later with reference to FIG. 7.

Next, the data providing device 110 transmits the personal data converted into the format of the data recipient to each of the data recipients (data utilization devices 120) who have agreed to the data provision (S314).

Next, when the data utilization device 120 receives the personal data, it performs a process of accepting the personal data (S315). The data utilization device 120 may also transmit a message confirming acceptance to the data provision device 110.

The above process allows the data provider to request the user to confirm the contents of the data provided with the minimum amount of information necessary. The above process also allows the user to reduce the burden of confirming the data usage conditions, etc., even when providing data to a large number of data users as a one-stop service.

(Data Management Catalog)
Next, the data structure of the data management catalog stored in the data distribution support device 130 will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of a data management catalog (data management catalog 400).

The data management catalog 400 manages what services and purposes the personal data received by data users (the partners of personal data in the one-stop service) will be used for, and what data items will be received. The data management catalog 400 may be a database. The data distribution support device 130 stores the data management catalog 400 for each partner service (partner service). The data structure of the data management catalog 400 will be explained below using "XX energy provider" as an example.

The data management catalog 400 includes information on the linked service ID 401, linked organization name 402, linked service name 403, data item 404, data item specifications 405, purpose of use 406, disclosure to third parties 407, conditions for disclosure to third parties 408, presence or absence of shared users 409, shared users 410, purpose of use at shared users 411, and privacy policy URL 412. Note that while the data management catalog 400 is described as consisting of these items, it may also consist of items other than these. For example, the data management catalog 400 may include an item for a contact point.

The linked service ID 401 is used to identify the linked service. The linked service ID 401 is assigned an ID that is unique in the data distribution system 100. This ID is automatically assigned by the data distribution support device 130 when the data management catalog 400 is registered. The linked service ID 401 may be anything as long as duplication in the data management catalog 400 can be avoided. For example, the linked service ID 401 may be incremented by one each time a service is added, or a hash value may be used.

The name of the organization that provides the linked service is set (written) in the linked organization name 402. The name of the linked service is set in the linked service name 403.

In data item 404, the value of the data item (data item name) of the personal data provided to the linked service is set. For example, data item names such as name, address, and telephone number are set. Data item 404 may be set using a common vocabulary ID defined by IMI (Infrastructure for Multilayer Interoperability), Schema.org, etc. (selected from multiple IDs) to prevent variations in notation depending on the organization that inputs (registers) the data management catalog 400 and to improve machine readability.

The data item specifications 405 set what format is permitted for each data item 404. To allow a third party to accurately understand the format and to improve machine readability, a code value or the like may be specified and set (selected from a plurality of code values).

Purpose of use 406 specifies the purpose for which the organization providing the linked service will use the received personal data. The relevant content in the privacy policy created by the organization may be entered as is for purpose of use 406, or the purpose of use of personal data may be limited to one-stop services. In addition, the content of purposes frequently used for each industry of the linked service may be specified as a code for purpose of use 406, and one or more code values may be set (selected and set from multiple code values).

In the third party disclosure status 407, whether or not personal data may be disclosed from the organization that provides the linked service to a third party is set. For example, either "Yes" or "No" is selected and set in the third party disclosure status 407. The third party disclosure conditions 408 are set when the third party disclosure status 407 is "Yes". The third party disclosure conditions 408 are set under what conditions the data will be disclosed to a third party. The third party disclosure conditions 408 may be set in free text, but in order to improve machine readability, the contents of conditions that are frequently used in the industry or all industries may be specified as codes, and one or more code values may be set (selected and set from multiple code values).

In the field of whether there is a shared user 409, it is set whether the organization providing the linked service may share personal data with other organizations. For example, the field of whether there is a shared user 409 is set by selecting either "Yes" or "No." If the field of whether there is a shared user 409 is "Yes," the field of whether there is a shared user 410 and the purpose of use at the shared user 411 are set. In the field of shared user 410, the organization providing the linked service is listed as a shared organization and set (selected and set from multiple organizations that share). In the field of purpose of use at the shared user 411, the purpose of use at the shared user is set.

The privacy policy URL 412 is set to the URL of an information site that lists the full terms of use of personal data made public by the organization that provides the partner service.

The data management catalog 400 described above makes it possible to manage information regarding what data items are used in the data user's linked services and for what purposes they are used and managed. In addition, because the data usage conditions for personal data are also managed separately by item, it is easy to omit information from this information. Furthermore, by writing the data management catalog 400 in a way that improves machine readability, it becomes possible to omit information more easily.

(Process for generating confirmation information for data provision)
The process of generating confirmation information for data provision (confirmation information generation process) in the data providing device 110 of the data provider will be described with reference to FIG.

Figure 5 is a diagram showing an example of the confirmation information generation process. The confirmation information generation process is started after additional input items are received from the user, the data items to be provided to the data users are determined, and then the conversion of the personal data to be provided to each data user is completed (S501).

When the process starts, the data providing device 110 acquires the policy selected by the user from the management unit 116 (S502). Note that the management unit 116 stores zero or more rules, as described below, and the data providing device 110 acquires these rules.

Next, the data providing device 110 acquires a data management catalog corresponding to the procedure destination (data providing destination) selected by the user (for example, reads out the data management catalog acquired in S305 and S306) (S503). Note that the data providing device 110 may acquire the data management catalog when performing this process, or may acquire the data management catalog in advance before performing this process.

Next, the data providing device 110 integrates the data of the acquired data management catalog and generates data for a confirmation screen (S504). The data for the confirmation screen includes the data recipient, items on the confirmation screen for that data recipient (purpose of use, conditions for disclosure to third parties, etc.) and their values, and whether or not to display those values. As long as it has these, the data for the confirmation screen may be in JSON format or any other format.

Next, the data providing device 110 determines whether there is a rule to be applied in the policy acquired in S502 (S505). If there is a rule to be applied, the data providing device 110 proceeds to S506, and if there is no rule to be applied, the data providing device 110 proceeds to S507.

In S506, if there is a rule to be applied, the data providing device 110 determines the data items to be omitted from the confirmation screen data based on the rule. For example, the data providing device 110 determines the data items that satisfy the conditions of the rule, and sets the omission method (simple display, non-display, etc.) for the determined data items. When this process is completed, the data providing device 110 proceeds to S505.

In S507, if there is no rule to be applied, the data providing device 110 generates screen information based on the data for the confirmation screen, including confirmation information in which information has been omitted based on the policy. When the above processing is completed, the confirmation information generation processing ends (S508).

The above process allows the confirmation screen to be displayed by controlling the confirmation information and generating screen information according to the policy for each user.

(Management table for managing policies by data providing device 110)
The management table used by the data providing device 110 to manage policies will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of a management table (management table 600).

Management table 600 is provided for each user. Management table 600 is a table that holds rules for how to control confirmation information (application conditions and omission methods when the application conditions are met). Management table 600 has items (columns) for rule number 601, condition 602, omission range 603, and omission method 604.

The rule number 601 sets the order in which the rules are applied. Here, the rules are applied starting from the lowest number.

Condition 602 is set to the condition for applying the rule. For example, if the rule is to be applied under all conditions, it is set to "ALL." Also, for example, if the rule is to be applied under specific conditions, the data item name of the data for the confirmation screen, its value, and its relational expression are set.

In the omission range 603, it is set which elements are to be displayed in a simplified manner or hidden when the condition 602 is met. For example, if all specific data items on the confirmation screen are to be omitted, the data item name of the data for the confirmation screen (for rule number 601 "1", the purpose of use) is set.

The omission method 604 indicates how the element defined in the omission range 603 is displayed when the condition 602 is met. For example, when it is "hidden", the element defined in the omission range 603 is not displayed, and the element is displayed when the user operates it, for example by pressing the button for detailed display. Also, when it is "simplified display", the element defined in the omission range 603 is displayed with a limited number of characters or the like (for example, the first 100 characters are displayed). Note that in the case of "simplified display", as with "hidden", the entire element may be displayed when the user operates it, for example by pressing the button for detailed display.

According to the above configuration, the user can set (e.g., select) rules to realize omissions that suit the user. For example, as shown in rule number 601 "3", if the user thinks that a telephone number may be misused if it is leaked, the user can set a user-specific rule that hides the data usage conditions if the telephone number is not included in the data items of the data provided.

The rules may be set uniformly regardless of the user. For example, as shown in the rule with rule number 601 "2", if there are many cases where problems occur with providing data to third parties and data to joint users, a uniform rule may be set to hide the data usage conditions when data is not provided to third parties or to joint users.

(How to register a policy)
Here, we will explain how the user registers the above-mentioned policy. One implementation method is to have the user directly register the management table 600. However, this increases the amount of work required to generate the policy itself. Therefore, another implementation method is to prepare multiple policy patterns and have the user select one of them. When generating a pattern, it is also possible to present a comparison of each pattern and have the user select the one.

(Confirmation screen)
The confirmation screen displayed by the user terminal 140 will be described with reference to Fig. 7. Fig. 7 is a diagram showing an example of the confirmation screen (confirmation screen 700).

The confirmation screen 700 is primarily a screen where the user makes a final decision on whether or not to provide data to each data user. The confirmation screen 700 is configured to display to each data user what personal data will be used, under what conditions or for what purpose, and to allow the user to check whether or not they consent.

For data users A and D, the entire data usage conditions of the data recipient are hidden on the confirmation screen 700. For example, for data user A, the confirmation screen 700 displays the data items of personal data, and displays a message indicating that the display of the data usage conditions and consent confirmation will be omitted, along with a reason. Also, the confirmation screen 700 includes a button 701 for displaying the data usage conditions so that the data usage conditions can be displayed if necessary.

For data users B and C, the entire display of the data usage conditions is not hidden, but some data items (here, the purpose of use) are displayed in a simplified manner.

By providing data to data users who have checked the button 702 indicating consent to the data provision and to data users for whom the display of the data usage conditions and consent confirmation have been omitted, the user can provide data only after obtaining consent. In addition, instead of the above configuration, a configuration may be adopted in which the button 703 for executing the data provision is enabled when all of the buttons 702 indicating consent to the data provision are checked.

In this way, by displaying a confirmation screen and requesting consent, the user can check and consent to any conditions that they have not previously agreed to, minimizing the amount of information that must be confirmed. Therefore, even when providing personal data to a large number of data users as required by a one-stop service, the amount of work required for consent and confirmation can be reduced.

(Example of confirmation screen control)
Here, some examples of controlling the confirmation screen in this embodiment will be described. Note that the display of the confirmation screen must comply with various laws and regulations such as the Personal Information Protection Law, guidelines for qualifications such as the Privacy Mark, and the like, and control is performed to comply with them.

In the first case, the purpose of use at the data recipient could be displayed simply by default, with more emphasis on checking the provision of data to third parties and/or data provision to joint users. This is because problems with personal data are likely to be caused not by the direct use of the data at the data recipient, but by the provision of data to third parties and data provision to joint users.

In the second case, if the personal data being provided is a data item that poses a relatively low risk based on factors such as the impact of a leak, consent may be granted without confirming the details. For example, if the data provided is an address and name, consent may be granted, but if other data items, such as a phone number, are included, the terms of use of the data may be displayed.

In the third case, consent is given or confirmation is always given based on the value of a data item for specific terms of use. For example, when data is provided to a third party or to a joint user, the data usage conditions can be displayed, and when neither is given, consent is given.

(II) Second embodiment In the first embodiment, the confirmation information is controlled using the data items of the personal data and the values of the data items of the data usage conditions described in the privacy policy of the personal data. In the second embodiment, in addition to these pieces of information, the confirmation information is controlled using attribute information of the data user. The following mainly describes the differences from the first embodiment.

The data management catalog of this embodiment will be described with reference to FIG. 8. FIG. 8 is a diagram showing an example of a data management catalog of this embodiment (data management catalog 800). In addition to the items of the data management catalog 400 described in the first embodiment, the data management catalog 800 includes the qualifications held by the linked organization 801 and the industry of the linked organization 802.

The confirmation information generation process of the data providing device 110 in this embodiment is similar to that in the first embodiment, but the confirmation information is generated using a data management catalog with expanded items.

The management table in this embodiment has the same configuration as the first embodiment, but the conditions include items for the qualifications held by the partner organization and the industry of the partner organization.

Since there are similarities in the way data is utilized depending on the industry of the partner organization, if a policy pattern has been established for each industry, rules may be applied based on that. In this case, for example, since the purpose of use is somewhat predetermined depending on the industry, a rule may be set to hide the purpose of use when the industry is a specific industry.

In addition, if policy patterns have been established for each qualification held by the partner organization, rules may be applied based on those. In this case, for example, an organization with a privacy mark is one that can properly manage personal information, so a rule may be set to hide the data usage conditions when the qualification held is a privacy mark.

The attribute information of the data user may also include the name of the linked organization. In this case, for example, if a user is already using the services of a specific linked organization, there is no need for the user to check the purpose of use and the data usage conditions, so a rule may be set to hide the purpose of use and the data usage conditions when the name of the linked organization is the name of a specific linked organization.

In this embodiment, when selecting a policy, an appropriate policy pattern may be selected based on the qualifications and industry of the data user.

According to this embodiment, the user can select from a wider variety of policies. This allows the user to determine whether or not to provide data with information close to the minimum required. In addition, if policy patterns are prepared for each industry and qualification held by the data recipient, the user only needs to select that pattern when selecting a policy, which can further reduce the user's workload.

(III) Third embodiment In the data distribution system 100 described in the first embodiment, the data user had to decide and input the contents of the data management catalog from the beginning, and register them. However, it takes a lot of work for the data user to input the contents of the data management catalog. In addition, although it is possible to generate and provide guidelines regarding the values of items in the data management catalog, if the contents of the data management catalog are left to the data user's free description, variations in notation and the like will occur, and it will be difficult for the data provider to control the confirmation information using the data management catalog.

This embodiment is characterized in that the data management catalog registration unit 133 of the data distribution support device 130 of the first embodiment is provided with a support function for registering the data management catalog.

The data management catalog registration support function provided by the registration unit 133 has a web interface that makes it easy for data users to input items and their values for each data management catalog. The data user inputs information in accordance with the web interface and presses the registration button to perform the registration operation. Figure 9 is a diagram showing an example of the web interface (registration screen 900) provided by the data management catalog registration support function.

The registration screen 900 provides an explanation of the items in the data management catalog, and allows input according to the explanation. The registration screen 900 allows the data management catalog to be registered with less work burden. Furthermore, the registration screen 900 allows the user to select values from multiple options, which helps prevent variations in the notation of values.

In addition to the above, a more advanced data management catalog registration support function may be provided. Since the full text of the privacy policy is listed in the public URL of the privacy policy, if the text can be analyzed, the text information may be used for analysis to infer all or part of the items in the data management catalog, and the values may be input as defaults.

According to this embodiment, it is possible to reduce the burden of the data management catalog registration work and prevent variations in the notation of values so as to improve the machine readability of the data management catalog. Therefore, it becomes easier for the data providing device 110 to control the confirmation information using the data management catalog.

The above embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those having all of the configurations described. In addition, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

Furthermore, in the above embodiment, the processing is performed by a single data distribution support device 130, but the processing may be distributed among a plurality of data distribution support devices 130. Furthermore, each function of the data distribution support device 130 may be executed by a separate computer.

In addition, the control lines and information lines shown are those considered necessary for the explanation, and do not necessarily show all control lines and information lines on the product. In reality, it can be assumed that almost all components are interconnected.

(IV) Supplementary Notes The above-described embodiment includes, for example, the following contents.

In the above embodiment, the present invention has been described as being applied to a data distribution system, but the present invention is not limited to this and can be widely applied to various other systems, devices, methods, and programs.

In addition, in the above-described embodiment, the configuration of each table is an example, and one table may be divided into two or more tables, or all or part of two or more tables may be one table.

In addition, the screens shown and described in the above embodiment are merely examples, and any design may be used as long as the information received is the same.

In addition, the screens shown and described in the above embodiment are merely examples, and any design may be used as long as the information presented is the same.

In addition, in the above description, information such as programs, tables, and files that realize each function can be stored in a storage device such as a memory, a hard disk, or an SSD (Solid State Drive), or in a recording medium such as an IC card, an SD card, or a DVD.

The above-described embodiment has the following characteristic configurations:

(1)
In a data distribution system (e.g., data distribution system 100) that mediates personal data from one or more data providing devices (e.g., data providing device 110) to one or more data utilization devices (e.g., data utilization device 120), the data providing device receives personal data input by a user from a user terminal (e.g., user terminal 140), and performs a process of omitting some or all of the confirmation information (e.g., purpose of use, whether or not to disclose to a third party, conditions for disclosure to a third party, presence or absence of a joint user, joint user, purpose of use at the joint user, contact point for inquiries, etc.) that the user confirms to determine whether or not he or she agrees to provide the personal data to the data utilization device, using rule information (e.g., management table 600) that specifies a rule for omitting (e.g., simply display, not display, etc.) some or all of the confirmation information, and when the confirmation information for which the process has been performed is displayed on the user terminal and consent is obtained to provide the personal data to the data utilization device, the data providing device transmits the personal data to the data utilization device (e.g., see FIG. 3).

The rule information may be provided for each user, or may be provided uniformly regardless of the user. In the data distribution system, the data providing device may be one or more. When there are multiple data providing devices, information (e.g., catalog information) for specifying the service for which the personal data is to be used, the purpose for which the personal data is to be used, the data items to be received, etc. may be managed (shared) so that it can be used by the multiple data providing devices, or may be provided for each data providing device. In addition, the process for specifying the data items of the personal data to be used by the data utilization device may be performed by the data providing device, or the data providing device may obtain the results of the process performed on a computer different from the data providing device.

In the above configuration, some or all of the confirmation information that the user confirms to determine whether or not he or she agrees to provide the personal data to the data utilization device is omitted, so that, for example, the user can easily determine whether or not he or she agrees to the distribution of personal data from the data providing device to the data utilization device.

(2)
The data distribution system includes a data distribution support device (e.g., data distribution support device 130) that manages catalog information including confirmation information that the user confirms to determine whether or not he or she agrees to provide the personal data to the data utilization device, and the data providing device acquires the catalog information from the data distribution support device.

In the above configuration, the catalog information is managed by the data distribution support device, so that, for example, the catalog information can be shared among multiple data providing devices, and data users no longer need to register catalog information for each data providing device, reducing the effort required for registration.

(3)
The catalog information includes, as the confirmation information, information on the purpose of use, whether or not to disclose to a third party, the conditions for disclosure to the third party, whether or not there is a joint user, the joint user, and the purpose of use at the joint user (see, for example, Figure 4), and the data providing device uses the rule information to perform a process of simply displaying or hiding each of the information on the purpose of use, whether or not to disclose to a third party, the conditions for disclosure to the third party, whether or not there is a joint user, the joint user, and the purpose of use at the joint user (see, for example, Figure 5).

In the above configuration, for example, confirmation information can be generated that displays the purpose of use in a simplified manner while hiding information about whether or not the information has been disclosed to a third party, the conditions for disclosure to the third party, whether or not there is a joint user, the joint user, and the purpose of use at the joint user, thereby allowing for more detailed control over the amount of information in the confirmation information.

(4)
The catalog information includes information on the data items of the personal data (e.g., see FIG. 4), and the data providing device generates screen information including the information on the data items of the personal data and confirmation information for the processing, and transmits the generated screen information to the user terminal (e.g., see FIG. 5).

In the above configuration, a screen (e.g., confirmation screen 700) containing information on the data items of the personal data used in the data utilization device is displayed, so that the user can, for example, check the confirmation information according to the importance of the data items.

(5)
At least one of the information regarding the purpose of use, whether or not to disclose to a third party, the conditions for disclosure to the third party, whether or not there is a joint user, the joint user, and the purpose of use at the joint user is information selected from multiple pieces of information prepared in advance (e.g., see Figure 8).

In the above configuration, at least one of the information on the purpose of use, whether or not to disclose to the third party, the conditions for disclosure to the third party, the presence or absence of a shared user, the shared user, and the purpose of use at the shared user is selectable information. With the above configuration, for example, it is possible to prevent inconsistencies in notation caused by a data user who registers catalog information, and to improve machine readability. Furthermore, with the above configuration, for example, a data user can easily register catalog information.

(6)
The data providing device acquires, as the rule information, a policy inputted into the user terminal, which includes one rule higher than the above rule that omits confirmation information that the user confirms to determine whether or not he or she agrees to providing the personal data to the data utilizing device (e.g., see S302).

In the above configuration, confirmation information is omitted according to the policy entered by the user, so that, for example, the amount of confirmation information can be controlled according to the user's interests.

(7)
The policy is information selected from a plurality of pieces of information (for example, policy patterns) prepared in advance.

In the above configuration, the policy is selectable information, so for example, the user can easily input the policy.

(8)
The catalog information includes attribute information of data users who provide specified services using the data utilization device (e.g., the qualifications held by the affiliated organization 801, the industry of the affiliated organization 802, the name of the affiliated organization 402, etc.), and if the attribute information satisfies specified conditions, the data utilization device performs a process of omitting some or all of the confirmation information.

In the above configuration, confirmation information can be omitted based on the attribute information of the data user, so, for example, the amount of confirmation information can be controlled in more detail.

(9)
The data utilization device transmits content information (e.g., registration content, correction content) for generating catalog information entered for registration or updating by a data user who provides a specified service using the data utilization device to the data distribution support device, and the data distribution support device transmits the content information to a management terminal (e.g., management terminal 150) used by an administrator of the data distribution system, and the management terminal accepts the results of the administrator's review. If the administrator's review is passed, the data distribution system makes the content information available to the data providing device as catalog information (e.g., see Figure 2).

In the above configuration, the content information used to generate the catalog information is reviewed by an administrator, which makes it possible to avoid, for example, a situation in which erroneous information is registered in the catalog information.

(10)
The data distribution support device provides the data utilization device with a user interface (e.g., a Web interface, registration screen 900) for inputting information conforming to the specifications of the catalog information, and the data utilization device transmits content information for generating the catalog information input by the data user via the user interface to the data distribution support device.

In the above configuration, content information for generating catalog information is input via a user interface, so that, for example, the data distribution support device can register catalog information common to data users. Furthermore, according to the above configuration, for example, data users can easily register and update catalog information.

It should be understood that an item in a list in the format "at least one of A, B, and C" can mean (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C). Similarly, an item in a list in the format "at least one of A, B, or C" can mean (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C).

100: Data distribution system, 110: Data providing device, 120: Data utilization device.

Claims (9)

A data distribution system that mediates personal data from one or more data providing devices to one or more data using devices,
a data distribution support device that manages catalog information including confirmation information that is confirmed by a user to determine whether or not the user agrees to provide the personal data to the data utilization device;
The data providing device includes:
receiving personal data input by the user from a user terminal;
performing a process of omitting a part or all of the confirmation information confirmed by the user to determine whether or not the user agrees to provide the personal data to the data utilization device, using rule information that specifies a rule for omitting a part or all of the confirmation information;
on the user terminal, confirmation information indicating that the processing has been performed is displayed, and if consent to providing the personal data to the data utilization device is obtained, the personal data is transmitted to the data utilization device;
acquiring the catalog information from the data distribution support device;
the data utilization device transmits to the data distribution support device content information for generating catalog information input for registration or update by a data user who uses the data utilization device to provide a predetermined service;
the data distribution support device transmits the content information to a management terminal used by an administrator of the data distribution system;
The management terminal accepts the result of the examination by the administrator,
the data distribution system makes the content information available to the data providing device as catalog information if the examination by the administrator is passed;
Data distribution system. The catalog information includes, as the confirmation information, information on the purpose of use, whether or not the information has been disclosed to a third party, the conditions for disclosure to the third party, whether or not there is a joint user, the joint user, and the purpose of use at the joint user,
The data providing device performs a process of simply displaying or not displaying information regarding the purpose of use, whether or not the information is disclosed to the third party, the conditions for disclosure to the third party, whether or not there is a shared user, the shared user, and the purpose of use at the shared user, using the rule information.
The data distribution system according to claim 1 . The catalog information includes information on data items of the personal data,
The data providing device includes:
generating screen information including information on the data items of the personal data and confirmation information indicating that the processing has been performed;
Transmitting the generated screen information to the user terminal;
The data distribution system according to claim 2. At least one of the information on the purpose of use, the presence or absence of disclosure to a third party, the conditions for disclosure to a third party, the presence or absence of a joint user, the joint user, and the purpose of use at the joint user is information selected from a plurality of information prepared in advance.
The data distribution system according to claim 2. the data providing device acquires, as the rule information, a policy inputted at the user terminal, the policy including one rule higher than the rule that omits confirmation information that the user confirms to determine whether or not he or she agrees to provide the personal data to the data utilizing device.
The data distribution system according to claim 1 . The policy is information selected from a plurality of pieces of information prepared in advance.
The data distribution system according to claim 5 . the catalog information includes attribute information of a data user who uses the data utilization device to provide a predetermined service,
the data providing device performs a process of omitting a part or all of the confirmation information when the attribute information satisfies a predetermined condition.
The data distribution system according to claim 1 . the data distribution support device provides a user interface for inputting information conforming to a specification of catalog information to the data utilization device;
the data utilization device transmits content information for generating catalog information input by the data user via the user interface to the data distribution support device;
The data distribution system according to claim 1 . A data distribution system that mediates personal data from one or more data providing devices to one or more data using devices,
The data providing device:
receiving personal data input by a user from a user terminal;
performing a process of omitting a part or all of the confirmation information, which is confirmed by the user to determine whether or not the user agrees to provide the personal data to the data utilization device, using rule information that specifies a rule for omitting a part or all of the confirmation information;
on the user terminal, confirmation information indicating that the processing has been performed is displayed, and if consent to providing the personal data to the data utilization device is obtained, transmitting the personal data to the data utilization device;
acquiring catalog information from a data distribution support device that manages catalog information including confirmation information that is confirmed by the user to determine whether or not the user agrees to provide the personal data to the data utilization device;
the data utilization device transmits to the data distribution support device content information for generating catalog information input for registration or update by a data user who provides a predetermined service using the data utilization device;
the data distribution support device transmits the content information to a management terminal used by an administrator of the data distribution system;
The management terminal accepts a result of the examination by the manager;
and when the examination by the administrator is passed, the data distribution system makes the content information available to the data providing device as catalog information.

Images