JP7784933B2 - Personal information management system and personal information transfer control method - Google Patents

Description

The present invention relates to a personal information management system and a method for controlling the transfer of personal information, and is suitable for use in a personal information management system and a method for controlling the transfer of personal information between countries from the perspective of protecting personal information.

In recent years, countries around the world have been enacting laws regarding the protection of personal information, including the General Data Protection Regulation (GDPR) in Europe. Businesses that collect, store, access, update, or otherwise handle personal information are required to comply with these laws. Personal information is defined in many countries as information that can directly identify an individual, or information that can be combined with other information to identify an individual, and is considered to include information such as name and address, for example.

When it comes to handling personal information, strict regulations have been put in place, particularly regarding the transfer of personal information overseas (cross-border), and companies that operate globally must exercise caution. Furthermore, with the rapid spread of cloud computing in recent years, information is not necessarily stored domestically, and there are cases where information is stored in various locations overseas, so caution is required in countries that require information to be stored domestically. Therefore, when transferring personal information overseas, it may be necessary to control whether transfers are permitted or prohibited, as necessary, in order to comply with the regulations of each country mentioned above.

Patent Document 1, for example, is a well-known technology for controlling the international transfer of personal information. According to this technology, when transferring personal information from the EU (European Union) to outside the EU, a list of countries or companies to which the information can be transferred is maintained in advance. When personal information is to be transferred internationally, the list is referenced, and if the transfer is to a country or company on the list, the transfer is permitted. If the transfer is to a country or company outside the list, the information is deleted or modified as necessary before being transferred.

Japanese Patent Application Laid-Open No. 2020-112922

However, with conventional technology such as that disclosed in Patent Document 1, which controls the transfer of personal information by referencing a simple list of registered recipients, it is difficult to control transfers in accordance with previous transfer circumstances, such as permitting the initial transfer of personal information but prohibiting subsequent transfers. Furthermore, even if a destination is permitted, if the source country has domestic retention regulations, personal information may not be adequately protected at the subsequent transfer destination unless the source country's regulations are taken into consideration. However, with the conventional technology described above, it is not easy to control transfers in accordance with the source country's regulations, and there is a problem in that transfers are permitted if the destination is registered in the destination list.

The present invention was made in consideration of the above points, and aims to propose a personal information management system and method for controlling the transfer of personal information overseas that can control whether to allow or prohibit the transfer, taking into account past transfer status and the transfer regulations of each country.

In order to solve this problem, the present invention provides a personal information management system for managing transfer control of personal information handled at bases in various countries, in which a plurality of first computers that manage personal information handled at their respective bases and a second computer that centrally manages the personal information managed by the plurality of first computers are connected via a network, the first computers have first management information in which information related to personal information handled at their respective bases is registered, the second computers have second management information in which information related to each personal information managed by the plurality of first computers is registered, and data localization information indicating domestic data retention regulations established in each country, and the first computers store setting information for specified items related to personal information handled at their respective bases in the first management information. The personal information management system further includes: a first computer, a second computer, a third computer, a third computer, a data localization information, a storage status of the personal information stored by the first ...

Furthermore, in order to solve such problems, the present invention provides a method for controlling the transfer of personal information by a personal information management system that manages the transfer control of personal information handled at bases in various countries, wherein the personal information management system comprises a plurality of first computers that manage personal information handled at their respective bases and a second computer that centrally manages the personal information managed by the plurality of first computers, connected via a network, the first computers having first management information in which information relating to personal information handled at their respective bases is registered, the second computers having second management information in which information relating to each personal information managed by the plurality of first computers is registered, and data localization information indicating domestic data retention regulations established in each country, and the first computers set setting information for specified items relating to personal information handled at their respective bases in the first management information, and the set setting information is stored in the second management information. A method for controlling personal information transfer is provided, comprising: a first step of notifying a second computer; a second step in which the second computer updates the second management information based on the setting information notified from the first computer in the first step; a third step in which, after the second step, the second computer uses the data localization information and the second management information to determine the appropriateness of the storage status of the personal information by the first computer based on the perspective of domestic retention regulations applicable to the base of the first computer and notifies the first computer of the determination result; and a fourth step in which the first computer controls permission or prohibition of transfer of the personal information to another first computer across borders based on the result of the determination made by the second computer in the third step regarding the appropriateness of the storage status of the personal information.

This invention makes it possible to control whether to permit or prohibit the international transfer of personal information, taking into account past transfer history and each country's transfer regulations.

1 is a block diagram showing an example of the configuration of a personal information management system 100 according to a first embodiment of the present invention. FIG. 10 is a diagram illustrating an example of the data configuration of base information 161. FIG. 10 is a diagram showing an example of the data configuration of personal information management information 162. FIG. 10 is a diagram showing an example of the data configuration of transfer management information 163. FIG. 10 is a diagram illustrating an example of the data configuration of data type definition information 164. FIG. 10 is a diagram illustrating an example of the data configuration of transfer type definition information 165. FIG. 10 is a diagram illustrating an example of the data configuration of cloud information 166. FIG. 10 is a diagram showing an example of the data structure of localization information 167 for each country. FIG. 10 is a diagram showing an example of the data configuration of each country's transfer regulation information 168. FIG. 10 is a diagram showing an example of the data configuration of country regulation level information 169. FIG. 10 is a diagram illustrating an example of the data configuration of each country's sufficiency information 170. FIG. 10 is a diagram showing an example of the data configuration of each country's sensitivity information 171. FIG. 10 is a diagram illustrating an example of the data configuration of relocation ground group information 172. FIG. 10 is a diagram illustrating an example of the data configuration of transfer grounds information 173. FIG. 10 is a diagram showing an example of the data configuration of personal information management information 114. FIG. 10 is a diagram illustrating an example of the data configuration of relocation candidate information 117. 10 is a flowchart illustrating an example of a processing procedure for setting personal information and transfer candidate information. 10 is a flowchart showing an example of a processing procedure for determining whether personal information is regulated; 10 is a flowchart illustrating an example of a processing procedure for controlling the transfer of personal information. FIG. 10 is a sequence diagram illustrating an example of a processing procedure for personal information registration processing after a transfer completion notification is given. 10 is a flowchart illustrating an example of a processing procedure for re-transfer determination processing.

Embodiments of the present invention will be described in detail below with reference to the drawings.

The following description and drawings are illustrative of the present invention, and have been omitted or simplified as appropriate for clarity of explanation. Furthermore, not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention. The present invention is not limited to the embodiments, and all application examples that conform to the concept of the present invention are included within the technical scope of the present invention. Those skilled in the art will be able to make various additions and modifications to the present invention within the scope of the present invention. The present invention can also be implemented in a variety of other forms. Unless otherwise specified, each component may be plural or singular.

In the following explanation, various types of information may be described using terms such as "table," "list," "data," etc., but the various types of information may also be expressed in other data structures. To indicate independence from data structure, "XX table," "XX list," etc. may be referred to as "XX information" or "XX data." When describing the content of each piece of information, terms such as "identification information," "identifier," "name," "ID," and "number" are used, but these are interchangeable.

In addition, in the following explanation, when describing elements of the same type without distinguishing between them, reference signs or common numbers in reference signs will be used, and when describing elements of the same type with distinction between them, the reference signs of those elements will be used, or the ID assigned to those elements will be used instead of the reference signs.

In addition, while the following description may describe processing performed by executing a program, a program is executed by at least one processor (e.g., a CPU) to perform a predetermined process using storage resources (e.g., memory) and/or interface devices (e.g., communication ports) as appropriate, and therefore the processor may be the entity performing the processing. Similarly, the entity performing the processing by executing a program may be a controller, device, system, computer, node, storage system, storage device, server, management computer, client, or host having a processor. The entity performing the processing by executing a program (e.g., a processor) may include a hardware circuit that performs some or all of the processing. For example, the entity performing the processing by executing a program may include a hardware circuit that performs encryption and decryption, or compression and decompression. A processor operates as a functional unit that realizes specified functions by operating in accordance with a program. Devices and systems that include a processor are devices and systems that include these functional units.

A program may be installed on a device such as a computer from a program source. The program source may be, for example, a program distribution server or a computer-readable storage medium. When the program source is a program distribution server, the program distribution server includes a processor (e.g., a CPU) and storage resources, and the storage resources may further store a distribution program and a program to be distributed. The processor of the program distribution server may then execute the distribution program, causing the processor of the program distribution server to distribute the program to be distributed to other computers. Also, in the following description, two or more programs may be realized as one program, and one program may be realized as two or more programs.

(1) First Embodiment (1-1) System Configuration Fig. 1 is a block diagram showing an example of the configuration of a personal information management system 100 according to a first embodiment of the present invention. The personal information management system 100 is a computer system including one or more base servers 101, one or more client terminals 141, and one or more management servers 151. The base server 101, the client terminals 141, and the management server 151 are connected to a network via their respective interfaces (I/Fs 104, 144, 154) and are configured to be able to communicate with each other.

The base server 101 is a computer such as a server having memory 102, CPU 103, I/F 104, and storage area 119. There are no particular restrictions on the number or locations of base servers 101 installed, but it can be thought of, for example, that one or more base servers 101 are installed for each base (or each country) of a business or the like that handles personal information using the personal information management system 100. For information on bases and countries, please refer to the base information shown in Figure 2.

The CPU 103 is, for example, a processor, and controls the base server 101 overall. Specifically, for example, the CPU 103 receives operation requests from external devices (base servers 101 other than the CPU 103, client terminals 141, management servers 151, etc.) via the I/F 104, executes operations (data processing) requested by the external devices, sends data processing results to the external devices, and sends data processing requests to the external devices.

Memory 102 is, for example, a main storage device that stores programs and data. Memory 102 is connected to CPU 103 and I/F 104.

As shown in FIG. 1, memory 102 has a collaboration unit 105, an information management unit 106, a relocation control unit 107, base information 111, data type definition information 112, relocation type definition information 113, personal information management information 114, relocation basis group information 115, relocation basis information 116, relocation candidate information 117, and cloud information 118. Of these components, the collaboration unit 105, information management unit 106, and relocation control unit 107 are programs stored in memory 102, and specific functions are realized when the programs are executed by CPU 103. The other components shown in memory 102 are data other than programs.

The memory area 119 is, for example, an auxiliary storage device, and stores information (specifically, personal information, etc.) from databases and the like held by the base server 101. The memory area 119 may also be realized by the cloud or an externally connected storage device, etc.

The client terminal 141 is a computer having memory 142, a CPU 143, and an I/F 144. The client terminal 141 is a computer used by the base server 101 or a user to give instructions and perform operations, and its location is not particularly limited.

The CPU 143 is, for example, a processor that sends operation requests to external devices (such as the base server 101 and management server 151) and receives operation results from the external devices via the I/F 144. The memory 142 is, for example, a main storage device that stores programs and data. The memory 142 is connected to the CPU 143 and the I/F 144. The memory 142 also has a linking unit 145 that is implemented by a program.

The management server 151 is a computer such as a server having memory 152, CPU 153, I/F 154, and storage area 174. The management server 151 is a computer that has the function of managing the transfer of personal information held by each base server 101, and there are no particular restrictions on where or how many of the management server 151 may be installed.

The CPU 153 is, for example, a processor, and controls the overall management server 151. Specifically, for example, the CPU 153 receives operation requests from external devices (management servers 151 other than itself, client terminals 141, base servers 101, etc.) via the I/F 154, executes operations (data processing) requested by the external devices, sends data processing results to the external devices, and sends data processing requests to the external devices.

Memory 152 is, for example, a main storage device that stores programs and data. Memory 152 is connected to CPU 153 and I/F 154.

As shown in FIG. 1, memory 152 includes a linking unit 155, an information management unit 156, a restriction determination unit 157, base information 161, personal information management information 162, transfer management information 163, data type definition information 164, transfer type definition information 165, cloud information 166, country localization information 167, country transfer restriction information 168, country restriction level information 169, country sufficiency information 170, country sensitivity information 171, transfer basis group information 172, and transfer basis information 173. Of these components, the linking unit 155, information management unit 156, and restriction determination unit 157 are programs stored in memory 152, and predetermined functions are realized when the programs are executed by CPU 153. The other components shown in memory 152 are data other than programs.

Memory area 174 is, for example, an auxiliary storage device, and stores information (specifically, personal information, etc.) from databases and the like held by management server 151. Memory area 174 may also be implemented as a cloud or an externally connected storage device, etc.

(1-2) Software Configuration The following provides a detailed explanation of the software configuration of the personal information management system 100. Specifically, the information stored in the memory 152 of the management server 151, the information stored in the memory 102 of the base server 101, and the information stored in the memory 142 of the client terminal 141 will be explained in order.

(1-2-1) Data other than programs in the management server 151 First, information other than programs stored in the memory 152 of the management server 151 will be described with reference to FIGS.

Figure 2 shows an example of the data structure of base information 161. Base information 161 is information that indicates the base of a business or other entity that handles personal information.

The base information 161 shown in Figure 2 is composed of data items: base ID 201, base name 202, and location country 203. Base ID 201 indicates an ID that identifies each base. Base name 202 indicates the name of each base. Location country 203 indicates the country in which each base is located. Note that, for simplicity, the term "country" is used in the explanation of this invention, but this "country" is not limited to nations as states, and can be thought of as including regions (for example, the European Union (EU)) and the like.

Figure 3 shows an example of the data structure of personal information management information 162. Personal information management information 162 is information for managing personal information in the management server 151, and stores records on a personal information basis.

The personal information management information 162 shown in Figure 3 is composed of the following data items: management ID 301, acquisition country 302, date and time 303, base ID 304, data ID 305, data type 306, data location 307, address 308, cloud ID 309, domestic retention 310, and original ID 311.

Management ID 301 indicates an ID that identifies personal information managed by management server 151 (hereafter referred to as target data in the explanation of Figure 3). Acquisition country 302 indicates the acquisition country where the target data was acquired. Date and time 303 indicates the acquisition date and time of the target data. Base ID 304 indicates which base the target data belongs to by using the base ID (base ID 201 in Figure 2).

Data ID 305 indicates how the target data is stored at the location indicated by location ID 304, and more specifically, is indicated by the intra-location identification ID (data ID 1501 in Figure 15) assigned to the target data at that location. Data type 306 indicates the data type of the target data by a data type ID (data type ID 501 in Figure 5). The data type is defined by data type definition information 164 shown in Figure 5.

Data location 307 indicates an overview of the storage location of the target data (inside the base, cloud, etc.). Address 308 indicates the details of the storage location of the target data as a storage destination address. Cloud ID 309 indicates the identification ID of the cloud (cloud ID 701 in Figure 7) if the target data is stored in the cloud. For example, if the value of data location 307 is "home base", the target data is stored in storage area 119 of the base server 101 located within the home base. Furthermore, if the value of data location 307 is "backup", this means that the target data is initially stored in a temporary storage area, etc., but is then moved to the address indicated by address 308 through processing such as data copying. The address indicated by address 308 is the address of the storage area where the target data is currently stored, but if the data storage location is changed due to backup, it is updated to the backup destination address.

Domestic Retention 310 indicates whether domestic retention of the target data is required by national law, etc., and, if domestic retention is required, whether it can be accommodated under the current storage conditions of the target data. Specifically, for example, if the value of Domestic Retention 310 is "-", this means that domestic retention of the target data is not required. If the value of Domestic Retention is "10", this means that domestic retention of the target data is required at the relevant base and can be accommodated under the current data storage conditions. If the value of Domestic Retention is "11", this means that domestic retention of the target data is required at the relevant base, but cannot be accommodated under the current data storage conditions. If the value of Domestic Retention is "20", this means that domestic retention of the target data is required at a base other than the relevant base (the base that holds the original target data, such as the source of the target data) and can be accommodated under the current data storage conditions. If the value of Domestic Retention is "21", this means that domestic retention of the target data is required at a base other than the relevant base (the base that holds the original target data, such as the source of the target data), but cannot be accommodated under the current data storage conditions.

Original ID 311 indicates whether the target data was brought in through a transfer, and if the target data was brought to the current base through a transfer, it indicates the identification ID (management ID 301) of the target data's original data. Specifically, for example, if the value of original ID 311 is "-", this means that the target data was not brought in through a transfer. Furthermore, if the value of original ID 311 is "d5", this means that the target data was brought in through a transfer, and that the original data (the initial transfer source if a multi-stage transfer has occurred) is data managed by management server 151 with the identification ID (management ID 301) of "d5".

Figure 4 shows an example of the data structure of transfer management information 163. Transfer management information 163 is information that manages the history of personal information transfers and has a record for each transfer.

The transfer management information 163 shown in Figure 4 is composed of the following data items: transfer ID 401, transfer source 402, transfer source data ID 403, transfer destination 404, transfer destination data ID 405, data type 406, transfer reason 407, transfer type 408, date and time 409, number of transfers 410, and management ID 411.

Transfer ID 401 indicates an ID that identifies the transfer of the managed object. Transfer source 402 indicates the transfer source base using its base ID (base ID 201 in Figure 2). Transfer source data ID 403 indicates the intra-base identification ID (data ID 1501 in Figure 15) assigned by management server 151 to the transferred data when it was managed at the transfer source base before the transfer. Transfer destination 404 indicates the transfer destination base using its base ID (base ID 201 in Figure 2). Transfer destination data ID 405 indicates the intra-base identification ID (data ID 1501 in Figure 15) assigned by management server 151 to the transferred data when it was managed at the transfer destination base after the transfer. Data type 406 indicates the data type of the transferred data using a data type ID (data type ID 501 in Figure 5). The data type is defined by the data type definition information 164 shown in Figure 5.

The transfer basis 407 indicates the transfer basis of the transferred data using a basis ID (basis ID 1401 in FIG. 14). The transfer basis is specified in the transfer basis information 173 shown in FIG. 14. The transfer type 408 indicates the transfer type of the transferred data using a transfer type ID (transfer type ID 601 in FIG. 6). The transfer type is specified in the transfer type definition information 165 shown in FIG. 6. The date and time 409 indicates the date and time the transferred data was transferred. The number of transfers 410 indicates the number of times the transferred data has been transferred in the past. Specifically, for example, if the value of the number of transfers 410 is "0", this means that the target transferred data has not been transferred before and this is the first transfer. If the value of the number of transfers 410 is "1", this means that the target transferred data has been transferred once before and this transfer is a re-transfer of the transferred data.

Management ID 411 indicates the identification ID (management ID 301 in Figure 3) managed by management server 151 in relation to source data ID 403. Management ID 411 is set by management server 151 when it receives notification of the completion of the transfer from the source base, and is then used to match data between management server 151 and the destination base (base server 101).

Figure 5 is a diagram showing an example of the data structure of data type definition information 164. Data type definition information 164 is information that defines the classification of data held in storage areas 119, 174 of databases, etc., held by base server 101 or management server 151. Various information, including personal information, is stored in storage areas 119, 174, and each computer in personal information management system 100 (management server 151, base server 101, client terminal 141) can determine what classification of data is included in the information stored in the storage areas based on data type definition information 164, 112.

The data type definition information 164 shown in Figure 5 is composed of data items: data type ID 501 and content 502. Data type ID 501 indicates an ID (data type ID) that identifies the data classification. Content 502 indicates the content of the data classification. For example, in Figure 5, the data type ID for data including "name" is defined as "p1," and the data type ID for data including "address" is defined as "p2." In this case, if the target information includes name and address, the data type of that information is assigned multiple classifications (data type IDs), such as "p1" and "p2."

Figure 6 shows an example of the data structure of transfer type definition information 165. Transfer type definition information 165 is information that defines the data transfer method.

The transfer type definition information 165 shown in Figure 6 is composed of the data items transfer type ID 601 and content 602. Transfer type ID 601 indicates an ID (transfer type ID) that identifies the classification of data transfer methods. Content 602 indicates the content of the classification of data transfer methods. For example, in Figure 6, a transfer method with a transfer type ID of "t1" indicates a transfer method in which data is sent to the transfer destination without leaving it at the transfer source. Furthermore, a transfer method with a transfer type ID of "t2" indicates a transfer method in which data is sent to the transfer destination while remaining at the transfer source by copying, etc.

Figure 7 is a diagram showing an example of the data configuration of cloud information 166. Cloud information 166 is information that manages various information regarding clouds that can be used by the personal information management system 100 as data storage destinations.

The cloud information 166 shown in Figure 7 is composed of the data items cloud ID 701, cloud vendor 702, service name 703, contact point 704, and data locations 705 and 706.

Cloud ID 701 indicates the identification ID (cloud ID) of the cloud that stores the data. Cloud vendor 702 indicates the vendor of the cloud identified by cloud ID 701 (hereinafter referred to as the cloud). Service name 703 indicates the type of service provided by the vendor of the cloud. For example, if the value of service name 703 is "email", it means that the cloud provides an email service, and if the value of service name 703 is "storage", it means that the cloud provides a data storage service. Contact point 704 indicates the location (e.g., country name) of the contact point set up for the services provided by the cloud. Data location 705 indicates an overview of the data storage location for the services provided by the cloud (e.g., a wide area such as Asia or North America), and data location 706 indicates the details of the data storage location (e.g., country or city).

Figure 8 shows an example of the data structure of country-specific localization information 167. "Country-specific localization" refers to the regulations on data localization (obligation to maintain data domestically) established by each country. Country-specific localization information 167 is information that manages the details of these country-specific localization regulations.

The country localization information 167 shown in Figure 8 is composed of data items for country 801 and sensitivities 802 to 805. Country 801 indicates the country name. Sensitivities 802 to 805 are data items corresponding to sensitivities "s1," "s2," "s3," etc. specified in the country sensitivity information 171 in Figure 12 (described below), and indicate whether or not each country has data localization restrictions for data corresponding to each sensitivity. For example, in Figure 8, in a record where the value of country 801 is "medium," the values of sensitivity 803 and 804 are "yes," indicating that localization restrictions (obligation to retain data domestically) are imposed on data with sensitivity s2 and S3 in China.

Figure 9 shows an example of the data structure of country transfer restriction information 168. "Country transfer restrictions" refers to restrictions imposed by each country regarding the transfer of data. Country transfer restriction information 168 is information that manages the content of these country transfer restrictions.

The country transfer restriction information 168 shown in Figure 9 is composed of the data items of country 901 and sensitivities 902 to 905. Country 901 indicates the country name. Sensitivities 902 to 905 are data items corresponding to sensitivities "s1", "s2", "s3", ... specified in country sensitivity information 171 in Figure 12, which will be described later, and indicate which transfer basis group restrictions each country has for data that falls under each sensitivity. The transfer basis group is specified in transfer basis group information 172 in Figure 13, which will be described later.

Figure 10 shows an example data structure of country regulation level information 169. Country regulation level information 169 is information that manages the level of regulations regarding personal information protection in each country.

The country regulation level information 169 shown in Figure 10 is composed of data items: level 1001 and country 1002. Level 1001 indicates the required level of personal information protection, and in this example, the higher the level value, the higher the required level of personal information protection (i.e., the stricter the regulations). Country 1002 indicates the country that corresponds to each level of personal information protection.

The restriction level for each country (the value of level 1001) can be automatically calculated by the management server 151 based on the information in the country localization information 167, country transfer restriction information 168, and country sensitivity information 171. An example of a specific method for calculating the restriction level is shown below.

For the localization information 167 for each country shown in Figure 8, the management server 151 assigns a score to each column (each sensitivity). For example, sensitivity "s1" is assigned 1 point, sensitivity "s2" is assigned 2 points, sensitivity "s3" is assigned 3 points, etc. The management server 151 then refers to Figure 8 and counts the above points if there are restrictions on sensitivity, and calculates the total score for each row (each country). In this case, China receives 6 points and Japan receives 0 points.

Furthermore, for the sensitivity information 171 for each country shown in Figure 12, the management server 151 calculates points based on the variation in sensitivity. For example, if there is one type of variation, it is assigned 1 point, if there are two types, it is assigned 2 points, if there are three types, it is assigned 3 points, etc. The management server 151 then calculates the points for each country by referring to Figure 12. For example, the sensitivity for the United States is assigned 1 point because there is only one type, "s1," and the sensitivity for Europe is assigned 2 points because there are two types, "s1" and "s2."

Furthermore, for the national transfer restriction information 168 shown in Figure 9, the management server 151 assigns a score to each column (each sensitivity). For example, if a restriction exists in each column (i.e., a value from any group is registered), one point is added for each, and the total score is calculated. Note that, as an alternative method of score calculation, the more elements of the transfer basis that make up a group, the more varied the transferable basis is and the easier it is to transfer, and the lower the score (i.e., the weaker the restriction).

In this way, management server 151 can calculate a score for each country from each country's localization information 167, each country's transfer restriction information 168, and each country's sensitivity information 171. Management server 151 then aggregates the scores calculated from each piece of information to calculate an overall score for each country, and determines the restriction level for each country based on this overall score, with the higher the score, the higher the restriction level.

When calculating the control level for each country, in addition to the above considerations, the amount of the fine imposed in the event of a violation may also be taken into consideration. In this case, the management server 151 stores in memory 152 fine amount information indicating the amount of the fine imposed in the event of a violation for each country, and by referencing the fine amount information, performs processing such as adding points for calculating the control level to countries with higher fine amounts in the event of a violation.

Figure 11 shows an example of the data structure of country sufficiency information 170. Country sufficiency information 170 is information that indicates the sufficiency certification relationship between countries regarding the transfer of personal information. When personal information is transferred across borders, sufficiency is said to have been certified when the transfer is permitted without making any special arrangements for the personal information (i.e., without changing the way the personal information is handled).

The adequacy information 170 for each country shown in Figure 11 is composed of data items for country 1101 and sufficiency target country 1102. Country 1101 indicates a country, and sufficiency target country 1102 indicates a country that has granted adequacy certification to the country shown in country 1101. In other words, for the country shown in country 1101, the country shown in sufficiency target country 1102 is a country that is subject to sufficiency. For example, in Figure 11, in a record where the value of country 1101 is "Japan," the value of sufficiency target country 1102 is registered as "UK, Europe." This record indicates that data can be transferred internationally from Japan to the UK or EU based on adequacy certification.

Figure 12 shows an example of the data structure of country sensitivity information 171. "Country sensitivity" refers to the degree of caution required in data handling (data sensitivity) in each country for each data type defined in data type definition information 164. Country sensitivity information 171 is information that manages this country sensitivity.

The country sensitivity information 171 shown in Figure 12 is composed of data items: country 1201 and data types 1202 to 1205. Country 1201 indicates a country. Data types 1202 to 1205 are data items corresponding to the data types (data type ID 501) "p1", "p2", "p3", etc. defined in the data type definition information 164 in Figure 5, and indicate the sensitivity of the data for that data type. For example, in the case of Figure 12, for a record whose value in Figure 1201 is "Europe" indicating EU, looking at the values of data types 1202 to 1204, the data sensitivity of data type "p1" is "s1", the data sensitivity of data type "p2" is "s1", and the data sensitivity of data type "p3" is "s2". If "s2" is considered more sensitive than "s1," then data of data type "p3" requires more careful handling than data of data types "p1" and "p2."

Figure 13 is a diagram showing an example of the data structure of transfer basis group information 172. Transfer basis group information 172 is information that manages groups (transfer basis groups) formed from combinations of transfer basis defined in transfer basis information 173 in Figure 14, which will be described later. Transfer basis groups indicate the requirements that must be met when transferring between countries.

The transfer basis group information 172 shown in Figure 13 is composed of the data items group ID 1301 and content 1302. Group ID 1301 indicates an ID that identifies the transfer basis group. Content 1302 indicates the combination of transfer reasons that make up the transfer basis group using basis ID 1401 shown in Figure 14. For example, if the value of group ID 1301 in Figure 13 is "Gr2", the value of content 1302 is "g1 or g2". This indicates that if the data to be transferred belongs to the transfer basis group "Gr2", then at least either "g1" or "g2" must be satisfied as the transfer basis.

Figure 14 is a diagram showing an example of the data structure of transfer basis information 173. The transfer basis information 173 shown in Figure 14 is composed of data items: basis ID 1401 and content 1402. Basis ID 1401 indicates an ID that identifies the basis for transfer. Content 1402 indicates the content of the basis for transfer. For example, in Figure 14, if the value of basis ID 1401 is "g1", the value of content 1402 is "consent". This indicates that obtaining consent is one of the conditions for transfer.

(1-2-2) Programs in Management Server 151 Next, we will explain the programs stored in the memory 152 of the management server 151. As described above, the linking unit 155, the information management unit 156, and the restriction determination unit 157 are realized by the programs stored in the memory 152.

The collaboration unit 155 exchanges data with other computers (such as the base server 101 and client terminal 141) via the network. For ease of explanation, when the collaboration unit 155 exchanges data with another computer at the request of another functional unit within its own computer, the "other functional unit" may be referred to as the processing entity rather than the collaboration unit 155. This also applies to the collaboration unit 105 of the base server 101.

Based on the information related to personal information notified by the base server 101, the information management unit 156 registers information for identifying the personal information within the management server 151, and registers information for identifying personal information transferred from one base server 101 to another base server 101. This information is registered in data other than programs in memory 152, as detailed in (1-2-1).

In response to a request from the base server 101, the restriction determination unit 157 determines whether restrictions are necessary for the personal information data to be transferred. More specifically, the restriction determination unit 157 determines whether localization is applicable to the personal information data to be transferred, whether the data is being stored properly, and whether the data should be transferred again.

(1-2-3) Data other than programs in the base server 101 Next, information other than programs stored in the memory 102 of the base server 101 will be described.

The information stored in memory 102 by base server 101 includes multiple pieces of data similar to the information of the same name stored in memory 152 by management server 151 described above (at least data with a similar data structure), and detailed description of this information will be omitted. Specifically, base information 111 is similar to base information 161 illustrated in FIG. 2, data type definition information 112 is similar to data type definition information 164 illustrated in FIG. 5, transfer type definition information 113 is similar to transfer type definition information 165 illustrated in FIG. 6, transfer basis group information 115 is similar to transfer basis group information 172 illustrated in FIG. 13, transfer basis information 116 is similar to transfer basis information 173 illustrated in FIG. 14, and cloud information 118 is similar to cloud information 166 illustrated in FIG. 7.

For example, this information may be distributed to each base as information with the same names defined or held by the management server 151 (base information 161, data type definition information 164, transfer type definition information 165, cloud information 166, transfer basis group information 172, transfer basis information 173), and the base server 101 at each base may store it in memory 102 for use. Regarding transfer basis group information 115, rather than distributing the same content as transfer basis group information 172 from the management server 151 to each base, information limited to transfer basis groups related to personal information held individually by each base may be distributed from the management server 151 to the base server 101. Alternatively, for example, information independently collected by the base server 101 may be aggregated in the management server 151, and after consistency is achieved in the management server 151, the information may be distributed to the base server 101 at each base as appropriate.

Examples of information that the base server 101 independently stores in memory 102 include personal information management information 114 and relocation candidate information 117.

Figure 15 is a diagram showing an example of the data structure of personal information management information 114. Personal information management information 114 is similar to personal information management information 162 (see Figure 3) held by management server 151, but differs from personal information management information 162 in that it is information for managing personal information handled at the local base, and is information for aggregating and centrally managing personal information from all bases.

The personal information management information 114 shown in Figure 15 is composed of the following data items: data ID 1501, acquisition country 1502, date and time 1503, data type 1504, data location 1505, address 1506, cloud ID 1507, domestic holding 1508, management ID 1509, and transfer ID 1510. The acquisition country 1502, date and time 1503, data type 1504, data location 1505, address 1506, cloud ID 1507, and domestic holding 1508 are the same as the data items of the same name in the personal information management information 162 in Figure 3, and detailed explanations will be omitted.

Data ID 1501 indicates an ID that identifies personal information (hereinafter referred to as target data in the explanation of Figure 15) that is managed by the base server 101.

Management ID 1509 indicates the management ID of the target data by management server 151. Management ID 1509 is assigned by management server 151 and corresponds to management ID 301 held by personal information management information 162 in Figure 3. The management ID is assigned by management server 151, for example, when base server 101 notifies management server 151 of information regarding an overview of the target data (personal information), and is returned to base server 101 and set as management ID 1509.

Transfer ID 1510 indicates a transfer ID for identifying the transfer of the target data. For example, when the base server 101 notifies the management server 151 of the completion of the transfer of the target data (personal information), the transfer ID is assigned by the management server 151, returned to the base server 101, and set as the base ID 1510.

Figure 16 is a diagram showing an example of the data structure of transfer candidate information 117. Transfer candidate information 117 is information that manages transfer candidates for personal information held at one location to another location.

The transfer candidate information 117 shown in FIG. 16 is composed of the following data items: candidate ID 1601, target ID 1602, transfer destination 1603, data location 1604, address 1605, cloud ID 1606, transfer reason group 1607, and purpose 1608.

Candidate ID 1601 indicates the identification ID of the transfer candidate. Target ID 1602 indicates the identification ID of the personal information to be transferred using an internal ID (data ID 1501 in Figure 15). Transfer destination 1603 indicates the transfer destination location using an ID (location ID 201 in Figure 2). Data location 1604 indicates an overview of the storage location of the personal information at the transfer destination (within the location, cloud, etc.). Address 1605 indicates the details of the storage location of the personal information at the transfer destination using the storage address. Cloud ID 1606 indicates the identification ID of the cloud (cloud ID 701 in Figure 7) if the personal information to be transferred is stored in the cloud. Transfer basis group 1607 indicates the transfer basis group consisting of a combination of transfer reasons that must be satisfied in the transfer using its identification ID (group ID 1301 in Figure 13). Purpose 1608 indicates the purpose of handling the personal information regarding the transfer (e.g., storing information outside the own location, analysis, etc.).

(1-2-4) Programs in the Base Server 101 Next, we will explain the programs stored in the memory 102 of the base server 101. As described above, the collaboration unit 105, the information management unit 106, and the relocation control unit 107 are realized by the programs stored in the memory 102.

The collaboration unit 105 exchanges data with other computers (such as the management server 151 and client terminal 141) via the network.

The information management unit 106 registers information to grasp the personal information within the base server 101 based on the information regarding the personal information notified from the client terminal 141.

The transfer control unit 107 works in cooperation with the management server 151 and client terminal 141, etc., to control the transfer of personal information related to its own base (i.e., personal information managed by the base server 101) in accordance with the management server 151's decision to permit or prohibit the transfer.

(1-2-5) Programs in the Client Terminal 141 Next, a description will be given of the programs stored in the memory 142 of the client terminal 141. As described above, the linking unit 145 is realized by the programs stored in the memory 142.

The collaboration unit 145 collaborates with external computers such as the base server 101, and sends requests for setting, protecting, or extracting personal information in response to user operations. The collaboration unit 145 also receives response results from external computers.

(1-3) Processing The following describes the processing executed by the personal information management system 100 according to this embodiment based on the above-described hardware and software configurations. The processing described below is executed when a request for execution of setting processing related to personal information is made from the client terminal 141 to the base server 101.

(1-3-1) Setting Process of Personal Information and Transfer Candidate Information FIG. 17 is a flowchart showing an example of the processing procedure for setting personal information and transfer candidate information. The processing shown in FIG. 17 is processing executed by the base server 101 when, for example, a user operates the client terminal 141 to attempt to register certain personal information in the base server 101 at the base. In the processing shown in FIG. 17, when a request to register personal information is made, registration of transfer candidate information related to that transfer candidate is also requested. However, the request to register the transfer candidate information may be made at a different time from the request to register the personal information. In that case, of the processes described below, the process related to the registration of transfer candidate information may be executed separately. The processing shown in FIG. 17 can also be applied when changing (updating) the content of registered personal information or transfer candidate information.

As shown in FIG. 17, first, the linking unit 105 receives a request from the client terminal 141 to set (register, update, etc.) personal information and its transfer candidate information (step S101). In step S101, the linking unit 105 also receives the personal information and transfer candidate information to be set from the client terminal 141.

Next, based on the request in step S501, the information management unit 106 uses the received personal information and transfer candidate information to update the information stored in memory 102 (personal information management information 114, transfer candidate information 117), and transmits information related to the update to the management server 151 (step S102). The management server 151, which received the information transmitted in step S102, executes the process shown in FIG. 18, which will be described later.

The processing performed by the information management unit 106 in step S102 is now explained in detail.

For example, when a request is made to register personal information, in the personal information management information 114 of FIG. 15, the base server 101 (information management unit 106) assigns a new identification ID (data ID 1501) to the personal information requested to be registered based on information from the client terminal 141, and registers information regarding the personal information, such as the country from which the data was acquired (acquisition country 1502), the acquisition date and time (date and time 1503), the type of data (data type 1504), an overview of the storage location (data location 1505), and the detailed address of the storage destination (address 1506).

For example, when a request is made to register relocation candidate information, in the relocation candidate information 117 of FIG. 16, the base server 101 (information management unit 106) assigns a new identification ID (candidate ID 1601) to the relocation candidate information requested to be registered based on information from the client terminal 141, and registers information regarding the relocation candidate information, such as the relocation target (target ID 1602), relocation destination (relocation destination 1603), an overview of the data storage location at the relocation destination (data location 1604), and detailed address of the storage destination (address 1605). The updated (registered) information and the base information of the base server 101 are then sent from the base server 101 to the management server 151, and the information on the management server 151 is updated by the process shown in FIG. 18, which will be described later.

Next, the information management unit 106 updates predetermined data items in the personal information management information 114 and the transfer candidate information 117 based on the response information from the management server 151 (step S103). The predetermined data items are, for example, domestic retention 1508 and management ID 1509 in the personal information management information 114, and transfer basis group 1607 in the transfer candidate information 117.

To explain in more detail, for the personal information management information 114 in Figure 15, the information management unit 106 sets the result of the determination by the management server 151 as to whether data localization support is required in the domestic storage 1508. The management server 151 determines whether data localization support is required based on the values of the acquisition country 1502 and data type 1504 received from the base server 101 in step S102, and notifies the base server 101 of the determination result (steps S205, S208, and S209 in Figure 18, which will be described later). In addition, the information management unit 106 sets the value of the management ID 301 assigned to the target personal information by the management server 151 through the processing in Figure 18 in the management ID 1509.

Furthermore, for the relocation candidate information 117 in FIG. 16, the information management unit 106 sets the relocation basis group determined by the management server 151 as the relocation basis group 1607. The relocation basis group is determined by the management server 151 based on the value of the acquired country 1502 received from the base server 101 in step S102, information about the relocation candidate destination, etc., and the result of this determination is notified to the base server 101 (steps S205, S208, and S209 in FIG. 18, which will be described later).

By executing the process shown in Figure 17 as described above, the base server 101 can work with the management server 151 to appropriately set the requested personal information and candidate transfer destination information in its own memory 102.

(1-3-2) Personal Information Restriction Determination Processing Fig. 18 is a flowchart showing an example of the processing procedure for personal information restriction determination processing. The processing shown in Fig. 18 is executed by the management server 151 when it receives notification of personal information or transfer candidate information from the base server 101 (step S102 in Fig. 17), and determines whether the personal information needs to be retained domestically and the appropriateness of the storage status of the personal information, etc.

As shown in FIG. 18, first, the linking unit 155 receives personal information and relocation candidate information from the base server 101 (step S201).

Next, the information management unit 156 updates the personal information management information 162 based on the information received in step S201 (step S202). Specifically, the information management unit 156 assigns an identification ID (management ID) to the personal information management information 162 shown in FIG. 3 for management of the personal information newly registered in the base server 101 by the management server 151, and sets this as management ID 301. Furthermore, the information management unit 156 sets data items 302 to 309 of the record for which the new management ID has been set, based on the personal information received in step S201. Note that the value of the identification ID (data ID 1501 in FIG. 15) used to identify the personal information in the base server 101 is set as data ID 305.

Next, the restriction determination unit 157 determines whether the personal information notified by the base server 101 needs to be held domestically based on the acquisition country 302, data type 306, data location 307, and original ID 311 (step S203). The value of domestic retention 310 is determined and set through multiple processes from step S203 onwards.

The processing of step S203 will be explained in more detail. First, the restriction determination unit 157 identifies the sensitivity to which the type of personal information (data type 306) corresponds in the acquisition country (acquisition country 302) by referring to the country-specific sensitivity information 171 in Figure 12. For example, if the acquisition country is "Japan" and the type is "p1," the sensitivity is identified as "s1" according to Figure 12. Next, the restriction determination unit 157 identifies whether localization support is required for the data of the identified sensitivity in the acquisition country by referring to the country-specific transfer restriction information 168 in Figure 8. For example, if the acquisition country is "Japan" and the sensitivity is "s1" as in the above example, the corresponding value is "-" according to Figure 8, and it is determined that localization support is not required. Note that if the corresponding value in Figure 8 is "Yes," it is determined that localization support is required.

As described above, if the restriction determination unit 157 determines that localization support (domestic retention) is not required (NO in step S203), "-" is set in domestic retention 310, and the process proceeds to step S209, which will be described later. On the other hand, if the restriction determination unit 157 determines that localization support (domestic retention) is required (YES in step S203), "Yes" is set in domestic retention 310, and the process proceeds to step S204.

In step S204, the restriction determination unit 157 determines whether the storage status of the personal information notified by the base server 101 is appropriate. If it is determined that the storage status of the personal information is appropriate (YES in step S204), the process proceeds to step S205. If it is determined that the storage status of the personal information is inappropriate (NO in step S204), the process proceeds to step S209.

The processing of step S204 will now be explained in detail. The restriction determination unit 157 first checks whether the original ID 311 is registered, and then performs the following processing depending on the check result.

If the value of original ID 311 is unregistered, the restriction determination unit 157 determines that the data (personal information) is newly registered data, not data brought over through a transfer. At this time, the restriction determination unit 157 identifies the country in which the data is located based on the information in base ID 304, data location 307, and cloud ID 309. If the country matches the country from which the data was acquired (acquisition country 302), the restriction determination unit 157 determines that localization support is required for its own base and that the current data storage status allows for this support (YES in step S204), and sets the value of domestic retention 310 to "10." Note that if the value of data location 307 is "cloud," the restriction determination unit 157 can identify the country in which the data is located by referencing the value of data location 706 in Figure 7 using cloud ID 309 as a key. On the other hand, if the country where the identified data is located does not match the country from which the data was acquired (acquisition country 302), the restriction determination unit 157 determines that localization support is necessary for its own base, but that this support is not possible given the current data storage situation (NO in step S204), and sets the value of domestic retention 310 to "11".

In other words, if the value of original ID 311 is not registered, the restriction determination unit 157 determines whether the current storage status of the personal information data held at the notified base (own base) in step S201 is appropriate by checking whether the current storage location of the data complies with the perspective of domestic retention, and if it determines that it is appropriate, sets the value of domestic retention 310 to "10", and if it determines that it is inappropriate, sets the value of domestic retention 310 to "11".

If the value of original ID 311 has already been registered, the restriction determination unit 157 determines that the data (personal information) has been brought in through a transfer. At this time, the restriction determination unit 157 checks whether the storage location of the data brought in through a transfer complies with the perspective of domestic retention, using the same method as when the value of original ID 311 is unregistered. Furthermore, the restriction determination unit 157 periodically inquires about the data storage status, such as the data storage location (data location 307), of the base that holds the data indicated by original ID 311 (i.e., the base that holds the original personal information that is the source of the transfer), and uses the results of the inquiry to determine whether data localization is required, using the same method as described when the value of original ID 311 is unregistered. This determination is made to confirm whether the data at the source of the transfer needs to be retained domestically.

Then, the restriction determination unit 157 determines whether the current data storage conditions are appropriate based on the results of checking whether the storage location of the data brought in by the transfer is in compliance with the perspective of domestic retention, and further determines the value to be set in domestic retention 310 based on the results of checking whether the data at the source of the transfer needs to be held domestically.

Specifically, the restriction determination unit 157 determines that the current data storage status is appropriate if the storage location of the data brought in by the transfer conforms to the viewpoint of domestic retention (YES in step S204). At this time, if the restriction determination unit 157 confirms that domestic retention is necessary for the data at the transfer source, it sets the value of domestic retention 310 to "20," and if it confirms that domestic retention is not necessary for the data at the transfer source, it sets the value of domestic retention 310 to "10." Furthermore, the restriction determination unit 157 determines that the current data storage status is inappropriate if the storage location of the data brought in by the transfer does not conform to the viewpoint of domestic retention (NO in step S204). At this time, if the restriction determination unit 157 confirms that domestic retention is necessary for the data at the transfer source, it sets the value of domestic retention 310 to "21," and if it confirms that domestic retention is not necessary for the data at the transfer source, it sets the value of domestic retention 310 to "11."

The original ID 311 is registered (set) when the personal information to be managed is data that has been brought over through a transfer, and its value is set to the identification ID (i.e., the data ID 301 of the source data) that the management server 151 assigned for management purposes to the source data held by the source base server 101.

Specifically, the management server 151 (information management unit 156 or restriction determination unit 157) determines whether the data being newly registered this time (identifiable from base ID 304 and data ID 305) matches the data identified from the transfer destination 404 and transfer destination data ID 405 in the transfer management information 163 in Figure 4. If matching data is registered in the transfer management information 163, the value of the management ID 411 corresponds to the identification ID in the base server 101, the original transfer source, of the data being registered this time, and therefore the management server 151 sets the value of this management ID 411 as the original ID 311.

The processing from step S204 onwards will be explained. To summarise the explanation so far, if it is determined that the personal information notified in step S201 needs to be retained domestically (YES in step S203) and that the current data storage status is appropriate (YES in step S204), the processing of step S205 is carried out. On the other hand, if it is determined that the personal information notified in step S201 does not need to be retained domestically (NO in step S203) or that the current data storage status is inappropriate (NO in step S204), the processing of step S209 is carried out.

In step S205, the management server 151 (information management unit 156 or restriction determination unit 157) sends the value of domestic retention 310 (domestic retention flag) and information on the basis for transfer to the base server 101 that sent the personal information in step S201.

The above-mentioned "information on the basis of transfer" is collected information on the basis of transfer when there is a possibility that the target personal information will be transferred in the future. Specifically, if the data ID (data ID 305, data ID 1501) of the personal information received from the base server 101 in step S201 matches the target ID 1602 of the transfer candidate information received from the base server 101, the above-mentioned management server 151 can determine that the personal information is likely to be transferred in the future. In this case, the management server 151 collects information on the basis of transfer and sends it to the base server 101. More specifically, the management server 151 identifies the sensitivity of the data based on the personal information management information 162 in FIG. 3 (particularly the acquisition country 302 and data type 306) and the country sensitivity information 171 in FIG. 12, identifies the transfer basis required for the identified sensitivity from the country transfer restriction information 168 in FIG. 9 and the transfer basis group information 172 in FIG. 13, and transmits information indicating the identification result (for example, the value of the basis group such as "Gr2") to the base server 101.

After processing step S205, the restriction determination unit 157 periodically inquires of the base holding the personal information data (such as the base from which the original data was transferred) about the data storage status, such as the data storage location (data location 307), and monitors the status (step S206). Then, upon receiving the inquiry results, the restriction determination unit 157 determines the appropriateness of the storage status using a procedure similar to that of step S204 described above (step S207). If the restriction determination unit 157 determines that the storage status is appropriate (YES in step S207), it returns to step S206 and continues monitoring. On the other hand, if the restriction determination unit 157 determines that the storage status is inappropriate (NO in step S207), it notifies the base server 101 that the storage status should be corrected and the transfer of the data is prohibited (step S208). At this time, the restriction determination unit 157 may update the value of domestic retention 310 (domestic retention flag) of the target data to a specific value appropriate to the status. Additionally, in step S208, a flag indicating the notification content may be sent, or a value corresponding to the notification content may be sent.

The processing in steps S206 and S207 continuously monitors whether data requiring data localization support is being held in appropriate storage conditions. This is because, even if the current storage conditions are determined to be appropriate (YES) in step S204, it is necessary to check that the storage conditions do not change before the data is transferred, and it is also necessary to check the storage conditions of the original data after the transfer.

Also, in step S209, similar to step S205, the management server 151 (information management unit 156 or restriction determination unit 157) transmits the value of domestic retention 310 and information on the basis for transfer to the base server 101 that transmitted the personal information in step S201.

By executing the process shown in Figure 18 as described above, the management server 151 enables the storage of personal information stored on each base server 101 in accordance with the data localization of each country.

(2) Second Embodiment A second embodiment of the present invention will be described using the personal information management system 100 described in the first embodiment. In this embodiment, when transferring personal information overseas, it is possible to determine whether to transfer the information while taking into consideration the transfer status to date and the transfer regulations of each country, and based on the result of this determination, it is possible to execute control such as permitting or prohibiting the transfer.

In the personal information management system 100 according to this embodiment, when the base server 101 receives a request to transfer personal information from the client terminal 141, it determines whether the requested transfer is a re-transfer, and if so, works with the management server 151 to control whether to permit or prohibit the transfer. The process for performing this control is described in detail below.

(2-1) Personal Information Transfer Control Processing FIG. 19 is a flowchart showing an example of the processing procedure for personal information transfer control processing. The processing shown in FIG. 19 is processing executed by the base server 101 at the current base when a user operates the client terminal 141 to transfer (move or copy) certain personal information from the current base to another base. Note that the processing in FIG. 19 can be executed when the processing shown in FIGS. 17 and 18 in the first embodiment has been completed. In addition, in the following description, to avoid confusion between the base servers 101, the base server 101 at the current base that is the transfer source may be referred to as "base server 101A," and the base server 101 at the base that is the transfer destination may be referred to as "base server 101B."

As shown in FIG. 19, first, the linking unit 105 of the base server 101A receives a personal information transfer request from the client terminal 141 (step S301). The transfer request received in step S301 specifies the personal information to be transferred and the transfer method. The transfer method is indicated, for example, by the value of the transfer type ID 601 described with reference to FIG. 6 in the first embodiment.

Next, the base server 101A (e.g., the information management unit 106) determines whether the personal information specified in the transfer request is compatible with data localization (step S302). Specifically, the base server 101A references the domestic retention 1508 of the personal information management information 114 stored in its own memory 102 (see FIG. 15), and determines that data localization is compatible if the value of domestic retention 1508 for the personal information specified in the transfer request is "-" or "20", or if the value of domestic retention 1508 for the personal information specified in the transfer request is "10" and the transfer type specified in the transfer request is a transfer method in which data remains domestically (from the transfer source), such as "t2". Furthermore, base server 101A determines that data localization is not possible if the value of domestic retention of personal information 1508 specified in the transfer request is "11" or "21", or if the value of domestic retention of personal information 1508 specified in the transfer request is "10" and the transfer type specified in the transfer request is "t2" or another transfer method in which data does not remain in the country (transfer source).

If it is determined in step S302 that data localization is not possible (domestic retention is not permitted) (NO in step S302), the base server 101A notifies the client terminal 141 of the transfer refusal and presents an alternative transfer method (step S309), and then completes the process. Presenting an alternative transfer method means, for example, presenting transfer types such as "t2" or "t3" as alternatives when it is determined that the transfer is to be rejected in a transfer request specifying the "t1" transfer type.

If it is determined in step S302 that data localization is possible (domestic storage OK) (YES in step S302), the base server 101A determines whether there are any problems with the transfer from perspectives other than data localization (step S303). Specifically, the base server 101A (e.g., the information management unit 106) determines whether the transfer basis specified in the current transfer request is appropriate. This determination of appropriateness is made based on the information in the transfer candidate information 117 in FIG. 16. For example, in FIG. 16, the transfer target (target ID 1602) with "02" must satisfy the transfer basis group "Gr2" in order to transfer. Here, according to the transfer basis group information 115 in FIG. 13, the transfer basis group "Gr2" is composed of the transfer basis "g1" or "g2." Therefore, if the transfer basis specified in the current transfer request is "g1" or "g2," the base server 101A can determine that the transfer basis is appropriate (there are no problems).

If it is determined in step S303 that there is a problem with the relocation (relocation NG) (NO in step S303), the base server 101A notifies the client terminal 141 of the denial of the relocation, stating that the relocation grounds are inappropriate, and further presents an alternative relocation ground to enable the relocation (step S309), and terminates the process.

If it is determined in step S303 that there are no problems with the transfer (transfer OK) (YES in step S303), the base server 101A determines whether the requested transfer corresponds to a re-transfer (step S304). The determination of whether it corresponds to a re-transfer can be made by referring to the personal information management information 114. Specifically, if transfer ID 1510 has already been registered in the record of data ID 1501 corresponding to the transfer target, it is determined to be a re-transfer of data brought in during a transfer; if it has not been registered, it is determined not to be a re-transfer.

If re-transfer is not required in step S304 (NO in step S304), the base server 101A (transfer control unit 107) executes the transfer of personal information in accordance with the transfer request (step S307).

If re-relocation is required in step S304 (YES in step S304), the base server 101A queries the management server 151 as to whether re-relocation is appropriate (step S305). Upon receiving the query in step S305, the management server 151 executes the re-relocation determination process described below in FIG. 21 and returns the result of the determination to the base server 101A.

The base server 101A checks whether the response from the management server 151 permits re-transfer (step S306). If a response from the management server 151 indicating re-transfer OK is received (YES in step S306), the base server 101A (transfer control unit 107) transfers the personal information in accordance with the transfer request (step S307). If a response from the management server 151 indicating re-transfer OK is not received (NO in step S306), the base server 101A notifies the client terminal 141 that the transfer is rejected and presents an alternative transfer method (step S309), and ends the process.

After the transfer of personal information in step S307 is complete, the base server 101A notifies the client terminal 141, management server 151, and the new base server 101B that the transfer has been completed (step S308), and then ends the process.

By executing the process shown in Figure 19 as described above, base server 101A, which receives a transfer request from client terminal 141, works in cooperation with management server 151 to determine whether the personal information to be transferred is transferable, and if it is determined that the personal information is transferable, it can transfer the personal information to base server 101B.

(2-2) Information Registration Processing After Transfer Completion Notification Fig. 20 is a sequence diagram showing an example of the processing procedure for personal information registration processing after transfer completion notification. The processing shown in Fig. 20 is processing executed by the management server 151 and the transfer destination base server 101B after the transfer completion notification is sent from the base server 101A in step S309 of Fig. 19. As will be explained in detail below, the management server 151 and the base server 101B that receive the personal information transfer completion notification update the information they manage.

As shown in FIG. 20, first, the base server 101A at the transfer source sends a transfer completion notification to the base server 101B at the transfer destination and the management server 151 (step S401). Step S401 corresponds to step S309 in FIG. 19.

In the transfer completion notification in step S401, base server 101A sends information about the transferred data (values of data items other than data ID 1501, domestic retention 1508, and transfer ID 1510 in the record of the corresponding data in personal information management information 114 in Figure 15) to base server 101B. This data is handed over to personal information management information 114 held by base server 101B, and the values of specified items are changed and updated as necessary, as described below.

In addition, in the transfer completion notification in step S401, the base server 101A sends to the management server 151 information necessary for the management server 151 to generate transfer management information 163 regarding the transferred data, such as the identification ID (data ID 1501) and management ID (management ID 312) of the transferred data from the personal information management information 114.

In the base server 101B, when the collaboration unit 105 receives the transfer completion notification, it waits until it receives notification of the transfer ID and management ID from the management server 151 (step S402).

Meanwhile, in the management server 151, when the linking unit 155 receives a transfer completion notification (step S403), the information management unit 156 updates the transfer management information 163 that it manages based on the received information (step S404). Specifically, the information management unit 156 assigns a new transfer ID (transfer ID 401) for this transfer in the transfer management information 163 of Figure 4, and registers new values for data items other than the transfer destination data ID 405 based on the information received from the base server 101A.

Here, the information management unit 156 determines and derives the number of transfers 410 based on the values of the transfer destination 404 and transfer destination data ID 405 in the transfer management information 163 to determine whether the data registered in this transfer (data identified from the transfer source 402 and transfer source data ID 403) has been transferred before. For example, if the already registered transfer destination 404 and transfer destination data ID 405 include data that matches the data registered in this transfer (transfer source 402, transfer source data ID 403), it can be determined that this data has been transferred before. In this case, the value of the number of transfers 410 registered for the matched data (transfer destination 404, transfer destination data ID 405) as described above, plus "1," is set as the number of transfers. As a result, for example, if the number of transfers 410 is set to "1," this indicates that one transfer had occurred before this transfer.

Furthermore, with regard to the management ID 411, the information management unit 156 sets the value of the management ID 312 of the personal information management information 114, which is managed in association with the data ID (data ID 1501) to be transferred and which was sent from the base server 101A when notifying the completion of the transfer, to the management ID 411.

As described above, once the update of the transfer management information 163 for the data transferred this time is complete, the information management unit 156 sends the updated values of the transfer ID 401 and management ID 411 to the transfer destination base server 101B (step S405).

Next, the information management unit 106 of base server 101B assigns a new identification ID (data ID 1501) for managing the newly transferred data at its own base, and sets values for data items other than domestic retention 1508 to transfer ID 1510 of personal information management information 114 based on the information received from the source base server 101A in step S402. Furthermore, the information management unit 106 sets the value of transfer ID 401 received from the management server in step S405 to transfer ID 1510. Note that the information management unit 106 may provisionally set the value of management ID 411 received from management server 151 in step S405 to management ID 1509. The value of management ID 1509 is officially set in step S410, which will be described later.

Then, if there is no change request from client terminal 141 for the information set as described above, base server 101B updates personal information management information 114 with the set information and transmits the updated information (e.g., data ID 1501, etc.) to management server 151 (step S407). If there is a change request from client terminal 141 for a specific data item, base server 101B sets the requested value for that data item, updates personal information management information 114, and then transmits the updated information to management server 151.

Next, in the management server 151, the information management unit 156 updates the transfer management information 163 and personal information management information 162 based on the information received from the base server 101B in step S407 (step S408).

Specifically, when updating the transfer management information 163, the information management unit 156 sets the value of the newly assigned ID (data ID 1501) to the transfer destination data ID 405 in the transfer management information 163 record where the value of the transfer ID 401 is set, based on the updated transfer ID 401 described above and the newly assigned ID (data ID 1501) by the base server 101B.

Furthermore, when updating the personal information management information 162, the information management unit 156 assigns a new identification ID (management ID 301) in the personal information management information 162 for the transferred data managed by the base server 101B of the transfer destination, and registers the new information based on the information received from the base server 101B in step S407. At this time, the data items from acquisition country 302 to cloud ID 309 can be set with the information received from the base server 101B in step S407, and the domestic retention 310 and original ID 311 can be set as appropriate using the same procedures as those described in steps S102 and S103 of Figure 17.

Then, the management server 151 notifies the base server 101B of at least the management ID 301 newly assigned to the personal information management information 162 and the value of the domestic retention 310 (domestic retention flag) from the information updated in step S408 (step S409), and ends processing on the management server 151 side.

Next, in base server 101B, based on the information sent from management server 151 in step S409, information management unit 106 updates the data items in personal information management information 114 that were not set or provisionally set in step S407 (step S410). Specifically, information management unit 106 sets the value of management ID 301 newly assigned by management server 151 as the official value in management ID 1509, and sets the value of domestic retention 310 (domestic retention flag) set by management server 151 to domestic retention 1508.

By executing the process shown in Figure 20 as described above, the transfer destination base server 101B and management server 151 can register new management information on their own computers for the personal information transferred from base server 101A to base server 101B, while understanding the transfer status (relationship between the transfer source and transfer destination, number of transfers, etc.) and whether the information is held domestically.

(2-3) Re-relocation Determination Processing Fig. 21 is a flowchart showing an example of the processing procedure for the re-relocation determination processing. The processing shown in Fig. 21 is executed by the management server 151 (mainly the restriction determination unit 157) when an inquiry about whether or not to re-relocate is received from the base server 101A in step S305 of Fig. 19 .

As shown in FIG. 21, first, the management server 151 receives an inquiry from the base server 101A of the transfer source as to whether or not to transfer again (step S501). The processing of step S501 corresponds to the processing of step S305 in FIG. 19.

Next, the restriction determination unit 157 of the management server 151 determines whether the data queried in step S501, i.e., the data to be re-transferred, requires domestic retention based on the value of domestic retention 310 in the personal information management information 162 (step S502). If it determines that domestic retention is not required (NO in step S502), the process proceeds to step S504, described below. If it determines that domestic retention is required (YES in step S502), the process proceeds to step S503.

In step S503, the restriction determination unit 157 determines whether the storage conditions of the data queried in step S501, i.e., the data to be re-transferred, are appropriate. If it determines that the storage conditions of the data are inappropriate (NO in step S503), the process proceeds to step S511, which will be described later. If it determines that the storage conditions of the data are appropriate, the process proceeds to step S504.

In step S503, the restriction determination unit 157 can determine the appropriateness of the storage conditions of the data using a method similar to that described in S204 of FIG. 18. Specifically, the restriction determination unit 157 identifies the original data based on the value of the original ID 311 associated with the data to be re-transferred (identifying a record in the personal information management information 162 in which the management ID 301 is set to the "value of the original ID 311"), and queries the base server 101 that holds the original data (the base ID 304 of the identified record) to determine whether it continues to hold the original data as before. If the base server 101 associated with the original data continues to hold the original data, the restriction determination unit 157 determines that the storage conditions of the data to be re-transferred are appropriate (YES in step S502). On the other hand, if the base server 101 associated with the original data does not continue to hold the original data, the restriction determination unit 157 determines that the storage conditions of the data to be re-transferred are inappropriate (NO in step S502).

If it is determined that the storage conditions of the data to be re-transferred are appropriate, the regulation determination unit 157 extracts information on the basis of the previous transfer and the current transfer, as well as information on the regulation levels of the original transfer country and the final transfer destination country, based on the inquiry information received in step S501 (step S504).

Specifically, the restriction determination unit 157 identifies which data from the previous transfer destination data (identified from the combination of the transfer destination 404 and transfer destination data ID 405 in the transfer management information 163 shown in FIG. 4) is being re-transferred this time, and extracts the previous transfer basis by referencing the value of the transfer basis 407 associated with the identified transfer destination data. For example, if the data being re-transferred this time has data ID "6001" at location "k6," the matching transfer destination data information (the combination of the transfer destination 404 and transfer destination data ID 405 matches) corresponds to the record with a transfer ID of "i1" set in the transfer management information 163 in FIG. 4. Therefore, this transfer destination data is identified as data brought from the transfer source location "k5" to the transfer destination location "k6" using transfer basis "g1" before this re-transfer. Furthermore, the restriction determination unit 157 identifies the initial source country based on the value of the acquisition country 302 managed by the management server 151 for the data currently being re-transferred, and identifies the final destination country from the destination information specified in the inquiry from the base server 101 regarding whether or not to re-transfer. Then, the restriction determination unit 157 identifies the respective restriction levels for the source country and destination country identified as described above based on the country restriction level information 169 shown in FIG. 10. For example, if the destination country is "UK," the restriction level is determined to be "4."

Next, the restriction determination unit 157 determines whether or not to re-transfer the inquired data based on the information identified in step S504 (step S505). Specifically, if the transfer basis for this re-transfer is "sufficiency" (according to the transfer basis information 173 in FIG. 14, the basis ID is "g3"), the restriction determination unit 157 references the sufficiency information 170 for each country shown in FIG. 11 and determines, based on the sufficiency target countries 1102, whether the current re-transfer destination country is included as a sufficiency target country for the initial transfer source country.

If the current relocation destination country is included in the sufficiency target countries, the restriction determination unit 157 determines that the relocation is appropriate (YES in step S505) and notifies the base server 101, which inquired about the relocation, that the relocation is OK (step S506).

On the other hand, if the current destination country for relocation is not included in the sufficiency target countries, and the final destination country's restriction level is lower than that of the initial source country, the restriction determination unit 157 determines that the relocation is inappropriate (NO in step S505), and notifies the base server 101, which inquired about the relocation's advisability, that the relocation is NG, the reason for this, and the corrective measures required for the relocation (step S507). Upon receiving the notification in step S507, the base server 101 may forward the notification content to the client terminal 141 and request that the necessary corrective measures be implemented. If the client terminal 141 instructs the base server 101 to implement the necessary corrective measures and the base server 101 implements them, the base server 101 notifies the management server 151 that the corrective measures have been completed.

After sending the notification in step S507, the restriction determination unit 157 checks whether the base server 101 has taken the necessary corrective measures (step S508). If the base server 101 has taken the necessary corrective measures (YES in step S508), the process proceeds to step S506, where the restriction determination unit 157 notifies the base server 101 that relocation is OK. If the base server 101 has not taken the necessary corrective measures (NO in step S508), the process proceeds to step S511, which will be described later.

Here, a supplementary explanation will be provided regarding notification of corrective measures. Specifically, the management server 151 identifies the base that holds the original data of the data to be re-transferred. The management server 151 then provides the base server 101 at that base with the identification ID of the data to be transferred (data ID 305 in personal information management information 162) and the purpose of the transfer (purpose 1608 in transfer candidate information 117 provided by the base server), and requests, as a notification of corrective measures, that the base server 101 reach an agreement, such as signing a contract, with the final transfer destination based on the provided information (step S507). Thereafter, if the management server 151 receives a response indicating that agreement is possible from the base server 101 that holds the original data, the management server 151 determines that "correction is necessary" (YES in step S508) and notifies the base server 101 that inquired about whether to proceed with the re-transfer that the re-transfer is OK (step S506).

In the above explanation, the decision to implement corrective measures was made based on an agreeable response result, but management server 151 may also decide to implement corrective measures using other methods. For example, management server 151 may create a template contract document that includes a description of the data to be transferred (information including the data's identification ID, etc.), the purpose of the transfer, and handling rules after the transfer, and send the created contract document from management server 151 to the base server 101 that holds the original data and the base server 101 at the final transfer destination. When electronic signatures from these base servers 101 are received, step S508 may be judged as YES and a notification that the re-transfer is OK may be sent.

Furthermore, if the transfer basis for this re-transfer is other than "sufficiency" (for example, if the basis ID is "g2" according to the transfer basis information 173 in FIG. 14), and the initial and final transfer basis are both the same binding corporate rules (provisions for handling personal information within the same corporate group), the regulation determination unit 157 compares the regulatory level of the final destination country with that of the initial source country, as described above. If the regulatory level of the final destination country is lower than that of the final destination country, the regulation determination unit 157 determines that the re-transfer is inappropriate (NO in step S505), and notifies the base server 101 that inquired about the re-transfer of the fact that the re-transfer is NG, the reason for this, and the corrective measures required for the re-transfer (step S507). If the correction is subsequently made (YES in step S508), the management server 151 notifies the base server 101 that inquired about the re-transfer that the re-transfer is OK (step S506).

After step S506, the management server 151 periodically monitors the storage status of the original data to be re-transferred and determines the appropriateness of the storage status (steps S509 and S510), similar to steps S206 to S208 in FIG. 18. If the storage status is inappropriate (NO in step S510), the management server 151 notifies the base server 101 that the data transfer is prohibited (step S511).

By executing the process of FIG. 21 as described above, the management server 151 can determine whether or not to proceed with a re-transfer, taking into consideration the transfer status of the re-transfer across multiple countries and the regulations of the source country, and notify the inquiring base server 101 of whether or not to proceed with the re-transfer. Specifically, for example, if the source country has strict regulations regarding the protection of personal information, but the destination country does not have such strict regulations, it becomes possible to control whether to allow or prohibit the transfer, taking into consideration the regulations of the original source country, so that personal information is adequately protected at the destination country.

(3) Other Embodiments The following describes a modification of the personal information management system 100 according to the first and second embodiments of the present invention. In this modification, when regulatory information such as localization regulations of each country is changed, the management server 151 requests the base server 101 of the affected base to change the personal information settings.

Specifically, for example, if new data localization regulations are added in a certain country, the management server 151 identifies data from which the data acquisition country corresponds based on the acquisition country 302 in the personal information management information 162 shown in Figure 3.

If the original ID 311 for the identified data is not registered in the corresponding record in the personal information management information 162, the management server 151 determines the appropriateness of the data storage status from the personal information management information 162 in a manner similar to step S204 in FIG. 18, and if there is a change in the domestic retention status as a result of the determination, sets the domestic retention flag of the new determination result to domestic retention 310, sends the new domestic retention flag to the base server 101 at the base where the identified data is stored, requesting an information update, and requesting that transfer control be carried out based on the updated domestic retention flag thereafter.

On the other hand, if the original ID 311 is registered in the corresponding record of the personal information management information 162 for the identified data, the management server 151 determines the appropriateness of the storage status of the original data in the same manner as described above for the record in the personal information management information 162 where the value of management ID 301 matches the value of original ID 311, i.e., the record of the original data. If there is a change in the domestic retention status as a result of the determination, the management server 151 sets the domestic retention flag of the new determination result to domestic retention 310, and sends a new domestic retention flag in the same manner as described above to the base server 101 at the base storing the data registered in original ID 311 with the same value as the aforementioned original ID 311, requesting an information update and requesting that transfer control be performed based on the updated domestic retention flag thereafter. Furthermore, the management server 151 sends a new domestic retention flag in the same manner as described above to the base server 101 storing the original data, and if the content of the domestic retention flag indicates that domestic retention is not possible, requests that the data storage status be corrected, such as by backing up the data to its own base. If there is a subsequent correction response from the base server 101 storing the original data, the management server 151 determines that the data storage status is appropriate, generates a domestic retention flag corresponding to the correction content, and sends the generated domestic retention flag to the base server 101 storing the original data and to computers related to that base server 101 (for example, the base server 101 storing data transferred from that base server 101), requesting an update of domestic retention 1508 in the personal information management information 114 stored by each base server 101.

By executing the processing of this modified example as described above, in the personal information management system 100, when regulatory information such as localization regulations for each country is changed, the management server 151 requests the base server 101 affected by the change in regulatory information to change the personal information settings, and can also update the settings of the information managed by the management server 151 itself.

According to each embodiment of the present invention described above, for example, in a computer system (personal information management system 100) comprising a client terminal (client terminal 141), a first computer (base server 101), and a second computer (management server 151), the first computer comprises base information (base information 111) defining the base of the first computer or other computers, data type definition information (data type definition information 112) defining the type of information held by the computer, transfer type definition information (transfer type definition information 113) defining the method of information transfer, personal information management information (personal information management information 114) for managing personal information held by the first computer, transfer basis group information (transfer basis group information 115) consisting of a combination of transfer basis, transfer basis information (transfer basis information 116) defining the transfer basis, transfer candidate information (transfer candidate information 117) defining data that may be transferred in the future, and cloud information (cloud information) defining the cloud used by the computer. The second computer has base information (base information 161) defining the base of its own computer or other computers, data type definition information (data type definition information 164) defining the type of information held by the computer, transfer type definition information (transfer type definition information 165) defining the method of transferring information, personal information management information (personal information management information 162) for managing personal information held by other computers, transfer basis group information (transfer basis group information 172) consisting of a combination of transfer basis, transfer basis information defining the transfer basis (transfer basis information 173), and cloud information defining the cloud used by the computer (cloud The information includes: data retention information 166), transfer management information (transfer management information 163) that manages computer data transfers; country localization information (country localization information 167) that manages each country's domestic retention regulations (data localization); country transfer regulation information (country transfer regulation information 168) that manages each country's transfer regulations; country regulation level information (country regulation level information 169) that defines each country's regulation level; country sufficiency information (country sufficiency information 170) that defines each country's sufficiency certification information; and country sensitivity information (country sensitivity information 171) that defines the sensitivity of each country's information.

In such a computer system, the first computer sets personal information and transfer candidates based on requests from client terminals and notifies the second computer of this information. The second computer then determines the appropriateness of the personal information storage status of the first computer based on the received information and regulatory information from each country and notifies the first computer of the determination result. The first computer sets the determination result from the second computer in the personal information management information of the first computer and controls whether to allow or prohibit the transfer of the data in accordance with the determination result. The second computer also regularly monitors the storage status of personal information on the first computer that must be retained domestically, and if the storage status becomes inappropriate, notifies the first computer of a prohibition on transfer, etc. Furthermore, when re-transferring personal information, the first computer inquires of the second computer about whether to re-transfer the data, and the second computer determines whether to re-transfer the data based on the relationship between the basis for the transfer and regulatory information from the country from which the personal information was obtained. If it determines that the re-transfer is inappropriate, it either notifies the first computer of a transfer prohibition, or notifies the computer that holds the original data to be transferred and the final destination computer of the agreement to the transfer, and determines whether to prohibit or permit the transfer based on the responses from these computers, and notifies the first computer of the decision. The first computer then controls whether to permit or prohibit the re-transfer of the data based on the decision made by the second computer.

By being equipped with the above-described configuration, the computer system (personal information management system 100) of the present invention is able to control the transfer of personal information overseas, taking into account the status of previous transfers and the regulations of the country of origin, and is able to exercise appropriate transfer control even in cases such as re-transfers across multiple countries.

100 Personal information management system 101 Base server 102, 142, 152 Memory 103, 143, 153 CPU
104, 144, 154 I/F
105, 145, 155 Collaboration unit 106, 156 Information management unit 107 Transfer control unit 111, 161 Base information 112, 164 Data type definition information 113, 165 Transfer type definition information 114, 162 Personal information management information 115, 172 Transfer basis group information 116, 173 Transfer basis information 117 Transfer candidate information 118, 166 Cloud information 119, 174 Storage area 141 Client terminal 151 Management server 157 Restriction determination unit 163 Transfer management information 167 Country localization information 168 Country transfer restriction information 169 Country restriction level information 170 Country sufficiency information 171 Country sensitivity information

Claims (9)

A personal information management system that manages the transfer control of personal information handled at bases in each country,
a plurality of first computers that manage personal information handled at their own locations and a second computer that centrally manages the personal information managed by the plurality of first computers are connected via a network;
the first computer has first management information in which information relating to personal information handled at the first computer's own base is registered;
the second computer has second management information in which information relating to each personal information managed by the plurality of first computers is registered, and data localization information indicating domestic data retention regulations established in each country;
the first computer sets setting information for predetermined items related to personal information handled at its own base in the first management information, and notifies the second computer of the set setting information;
the second computer updates the second management information based on the setting information notified from the first computer;
the second computer uses the data localization information and the second management information to determine the appropriateness of the storage status of the personal information by the first computer based on the perspective of domestic retention regulations applicable to the base of the first computer, and notifies the first computer of the result of the determination;
A personal information management system characterized in that the first computer controls permission or prohibition of transfer of the personal information to another first computer across borders based on the result of judgment by the second computer on the appropriateness of the storage status of the personal information. the personal information setting information notified by the first computer to the second computer includes at least information indicating the country in which the personal information was obtained, the type of the personal information, and the location where the personal information is stored;
The personal information management system described in claim 1, characterized in that the second computer uses the data localization information to determine whether domestic retention of data at the base of the first computer is necessary, and if domestic retention is necessary, further uses the second management information to determine whether the first computer is storing the personal information in a form that complies with domestic retention regulations, thereby determining the appropriateness of the storage status of the personal information by the first computer. The second computer
If it is determined that the domestic retention of the data at the base of the first computer is unnecessary, or that the domestic retention of the data at the base of the first computer is necessary but the first computer stores the personal information in a form that complies with domestic retention regulations, it determines that the storage status of the personal information by the first computer is appropriate;
The personal information management system of claim 2, characterized in that if it is determined that the data needs to be retained domestically at the base of the first computer but the first computer is not storing the personal information in a form that complies with domestic retention regulations, it determines that the storage conditions of the personal information by the first computer are inappropriate. When the first computer receives a request to transfer the personal information it manages to the other first computer,
The personal information management system described in claim 3, characterized in that, based on the results of the second computer's judgment on the appropriateness of the storage status of the personal information and whether the requested transfer is a transfer type that leaves the data at the transfer source, it is determined that domestic retention of the personal information is unnecessary at the local location, or that domestic retention of the personal information is necessary at the local location and domestic retention is possible, the transfer of the personal information is permitted. When a request is made to transfer personal information to the other first computer, the first computer determines whether the designated transfer of personal information constitutes a re-transfer, and if so, inquires of the second computer about whether or not to proceed with the re-transfer;
Upon receiving the inquiry, the second computer, in determining whether or not to re-transfer, if the personal information to be transferred needs to be retained domestically and is able to do so, will check the storage status of the personal information of the previous transfer source with the specific first computer that manages the personal information of the previous transfer source, and if the storage status is appropriate, will determine that the re-transfer is appropriate and notify the first computer of the result of this determination;
4. The personal information management system according to claim 3, wherein the first computer allows the transfer of personal information to the other first computer when it receives a judgment result from the second computer that the re-transfer is appropriate. The second computer
Calculate the regulatory level of each country regarding the transfer of personal information based on the existence of domestic retention regulations, the number of types of personal information, and the existence of transfer regulations in each country;
In determining whether or not to re-transfer, the appropriateness of the re-transfer shall be further determined based on the basis of the transfer, the country in which the personal information was obtained, the regulations in the country in which the personal information was obtained, and the relative levels of regulations between the country in which the personal information is obtained and the country in which the re-transfer is located;
A personal information management system as described in claim 5, characterized in that even if it is determined that the re-transfer is inappropriate, it requests the specific first computer that manages the personal information of the previous transfer source and the first computer to which the personal information is to be re-transferred to reach an agreement regarding the handling of the personal information, and if it receives a response that such agreement can be reached, it determines that the re-transfer is appropriate. The personal information management system of claim 2, characterized in that the second computer periodically judges the appropriateness of the storage status of the personal information by the first computer, and if it judges it to be inappropriate, notifies the first computer of a prohibition on transfer of the personal information. The personal information management system of claim 6, characterized in that the second computer periodically determines the appropriateness of the storage status of the personal information by the first computer and the appropriateness of the storage status of the personal information of the previous transfer source by the specific first computer. A personal information transfer control method using a personal information management system that manages transfer control of personal information handled at bases in various countries,
The personal information management system comprises a plurality of first computers that manage personal information handled at its own location, and a second computer that centrally manages the personal information managed by the plurality of first computers, which are connected via a network;
the first computer has first management information in which information relating to personal information handled at the first computer's own base is registered;
the second computer has second management information in which information relating to each personal information managed by the plurality of first computers is registered, and data localization information indicating domestic data retention regulations established in each country;
a first step in which the first computer sets setting information of predetermined items related to personal information handled at its own base in the first management information and notifies the second computer of the set setting information;
a second step in which the second computer updates the second management information based on the setting information notified from the first computer in the first step;
a third step, after the second step, in which the second computer uses the data localization information and the second management information to determine the appropriateness of the storage status of the personal information by the first computer based on the viewpoint of domestic retention regulations that apply to the base of the first computer, and notifies the first computer of the determination result;
a fourth step in which the first computer controls permission or prohibition of transfer of the personal information to another first computer across borders based on the result of the determination by the second computer in the third step as to the appropriateness of the storage status of the personal information;
A personal information transfer control method comprising: