オプティマ・ソリューションズ List of Products and Services

This time's "Easy-to-Understand Security Glossary" is "Clear Desk/Clear Screen." As a fundamental aspect of the information security measures established by companies, there are "Clear Desk" and "Clear Screen." A Clear Desk means "not leaving documents or storage media on the desk when stepping away." Literally, it is about cultivating the habit of ensuring that personal information or confidential documents, such as papers or USB drives containing sensitive information, are not left on one's desk when leaving for home or going out. *For more detailed information, you can view the PDF. Please feel free to contact us for more details.

This time, the "Easy-to-Understand Security Terminology" is "Supervision of Outsourcing Partners." Incidents of personal information leaks continue to occur. It seems that not only are there cases where the operations of companies holding personal information are problematic, but there are also many incidents of leaks from outsourced companies. Currently, many companies are increasing their opportunities to conduct business not only with their own company but also with group companies and partner companies. In the past business practices, when there was a problem with an outsourcing partner, it was mostly the case that the responsibility fell on the outsourcing partner. *For detailed content of the article, please refer to the PDF. For more information, feel free to contact us.

Personal information is often referred to as such, but what is the official definition? How far does it extend? In this article, we will specifically introduce what "personal information" means in the context of the P Mark and discuss the extent of what constitutes personal information. The Personal Information Protection Law limits it to "living individuals," but JIS Q 15001: 2006 (Personal Information Protection Management System - Requirements) includes a definition that also encompasses "information about deceased individuals." *For more detailed content of the article, you can view it in the PDF. Please feel free to contact us for more information.

This time, we will discuss "safety management measures" under the Personal Information Protection Act. The Ministry of Economy, Trade and Industry has published guidelines regarding the "Law on the Protection of Personal Information" aimed at the economic and industrial sectors. In the latest revision, the strengthening of safety management measures has become a key point in response to a large-scale leak of personal information from a major correspondence education company. Let’s take a look at what these "safety management measures" are. *For detailed content of the article, please refer to the PDF. For more information, feel free to contact us.*

This time's "Easy-to-Understand Security Glossary" is about "Rights Related to Personal Information." Regarding these "Rights Related to Personal Information," there is a provision in "JIS Q 15001" titled "3.4.4.1 Rights Related to Personal Information." In simple terms, it states that "when the owner of personal information requests the disclosure, correction, addition, deletion, suspension of use, or provision of their personal information, the business handling that personal information must respond without delay." *For detailed content of the article, you can view it in the PDF. Please feel free to contact us for more information.*

This time, the "Easy-to-Understand Security Terminology" is about the definition of "personal information." All information related to an individual is considered "personal information." Therefore, not only "video recorded by security cameras" and "email addresses," but also publicly available information such as "official gazettes," "telephone directories," and "staff directories" falls under personal information. In other words, there is much more information that qualifies as "personal information" than one might imagine. *For detailed content of the article, you can view it in the PDF. Please feel free to contact us for more information.

This time's "Easy-to-Understand Security Glossary" is "Personal Information Handling Business Operators." Personal information handling business operators are a concept defined by the Personal Information Protection Law, and in practice, it includes almost all companies, organizations, and individuals. Personal information handling business operators have various obligations stipulated by the Personal Information Protection Law, such as "must safely manage personal data and supervise employees and contractors" and "must not provide personal data to third parties without obtaining the individual's consent." If they violate these obligations, they will face penalties. *For detailed content of the article, you can view it in the PDF. For more information, please feel free to contact us.

This time, the "Easy-to-Understand Security Glossary" is about "Technical Security Measures." The guidelines regarding the protection of personal information established by the Personal Information Protection Commission clearly state that companies handling personal information must take security measures to prevent the leakage, loss, or damage of personal data, and these measures are referred to as "safety management measures." There are four types of "safety management measures for personal information protection": "organizational safety management measures," "human safety management measures," "physical safety management measures," and "technical safety management measures." This time, we will explain the last one, "technical safety management measures." *For detailed content of the article, you can view it in the PDF. For more information, please feel free to contact us.

This time, the "Easy-to-Understand Security Terminology" is "Human Security Management Measures." In explaining "Security Management Measures," the Ministry of Economy, Trade and Industry guidelines state that it is required to implement four types of security management measures: "Organizational Security Management Measures," "Human Security Management Measures," "Physical Security Management Measures," and "Technical Security Management Measures." This time, we will focus on the second one, Human Security Management Measures. Regarding "Human Security Management Measures," the Ministry of Economy, Trade and Industry guidelines define it as "the conclusion of non-disclosure agreements regarding business secrets and designated personal data with employees, as well as conducting education and training, etc." *For detailed content of the article, you can view it in the PDF. Please feel free to contact us for more information.

This time's "Easy-to-Understand Security Glossary" is about the "Privacy Mark System." The Privacy Mark System is a certification system for businesses that handle personal information appropriately, in accordance with the Japanese Industrial Standard "JIS Q 15001:2017 Personal Information Protection Management System - Requirements." In other words, only those companies and organizations that have established and are operating a personal information protection management system, as confirmed by a third party, are allowed to use the Privacy Mark. *For more detailed information, you can view the PDF. Please feel free to contact us for more details.

This time's "Easy-to-Understand Security Glossary" is about "Consent of the Individual in Handling Personal Information." Article 16 of the Act on the Protection of Personal Information states, "Personal information handling businesses must not handle personal information beyond the scope necessary to achieve the purpose of use specified in the preceding article without obtaining prior consent from the individual." Additionally, Article 23 states, "Personal information handling businesses must not provide personal data to third parties without obtaining prior consent from the individual, except in the following cases." From this, it can be understood that "consent of the individual" is essential when handling personal information. *For detailed content of the article, please refer to the PDF. For more information, feel free to contact us.

This time's "Easy-to-Understand Security Terminology" is "Provision of Personal Information." First, as a review, personal information includes not only name, gender, date of birth, and address, but also attributes such as an individual's body, property, occupation, and title, as well as information that is publicly available through evaluation information and publications, as well as information conveyed through images/audio. When a personal information handling business operator provides personal information collected to a third party, it is necessary to obtain the consent of the individual. When obtaining the information or when intending to start providing it, it is important to clearly state content that will help the individual's judgment, such as "This personal information will be provided to ●● for the purpose of ●●," and obtain consent. *For detailed content of the article, you can view it in the PDF. For more information, please feel free to contact us.

This time, the "Easy-to-Understand Security Terminology" is "Organizational Security Management Measures." The "Guidelines for the Economic and Industrial Fields Concerning the Personal Information Protection Law" require the implementation of four security measures: "Organizational Security Management Measures," "Human Security Management Measures," "Physical Security Management Measures," and "Technical Security Measures." From this time onward, I would like to look at each of these security management measures. This time, I would like to explain one of them, "Organizational Security Management Measures." *For detailed content of the article, you can view it in the PDF. For more information, please feel free to contact us.*

This time, the "Easy-to-Understand Security Glossary" is about "Physical Security Management Measures." As a review, the "Security Management Measures for Personal Information Protection" consist of four types: "Organizational Security Management Measures," "Human Security Management Measures," "Physical Security Management Measures," and "Technical Security Management Measures." This time, let's explain "Physical Security Management Measures." The "Guidelines for the Protection of Personal Information in the Economic Sector" published by the Ministry of Economy, Trade and Industry defines "Physical Security Management Measures" as "measures for managing access to and from facilities (rooms), preventing the theft of personal data, etc." *For more detailed information, you can view the PDF. Please feel free to contact us for more details.

ISMS certification is a system in which the Japan Information Economy Society Promotion Association (abbreviated as JIPDEC) certifies businesses that have internally established an information security framework based on the information security standard "ISO 27001" and appropriately handle information security, allowing them to use the ISMS mark. The official name is "ISMS Conformity Assessment System." It is often referred to as "ISO 27001" using the standard name. "ISMS certification" and "ISO 27001" refer to the same system. For businesses obtaining ISMS certification, undergoing third-party checks regarding the handling of information security and the information security framework increases credibility from an external perspective, providing the advantage of being able to convey a sense of security to customers and business partners. *For detailed content of the article, please refer to the PDF. For more information, feel free to contact us.

This time's "Easy-to-Understand Security Glossary" is "Chief Privacy Officer (CPO)." Recently, there have been increasing cases of hearing positions such as CEO, COO, and CFO. CEO stands for Chief Executive Officer, which is the highest executive officer. Since this person holds all responsibility for the management of the company, it is usually safe to think of them as the chairman or president. COO stands for Chief Operating Officer, which is the highest operating officer, and CFO stands for Chief Financial Officer, which is the highest financial officer. While such positions have been established in foreign companies for some time, there is an increasing trend of Japanese companies adopting CxO titles. *For more detailed information, you can view the PDF. Please feel free to contact us for more details.

This time's "Easy-to-Understand Security Glossary" is from the Japan Institute for Promotion of Digital Economy and Community (JIPDEC). When studying the Privacy Mark, you will come across terms such as "Japan Institute for Promotion of Digital Economy and Community" and "JIPDEC." This time, I would like to explain about the Japan Institute for Promotion of Digital Economy and Community (JIPDEC). The Japan Institute for Promotion of Digital Economy and Community is one of the general incorporated foundations. In English, it is referred to as "Japan Institute for Promotion of Digital Economy and Community" (JIPDEC). *For detailed content of the article, you can view it in the PDF. Please feel free to contact us for more information.

This time, the "Easy-to-Understand Security Glossary" is about the "My Number Card." Since January 2016, it has become necessary to enter your My Number (individual number) when carrying out tax and social security procedures. This individual number is listed on the "Notification Card," which is sent by simple registered mail. There may still be some people who have not yet received their Notification Card, but those individuals should contact their local government immediately. In the future, the My Number will be required in various situations, so once the Notification Card arrives, be sure to keep it safe. *You can view the detailed content of the article in the PDF. For more information, please feel free to contact us.

This time's "Easy-to-Understand Security Glossary" is "My Number." Since October 2015, a 12-digit unique number has been assigned to each individual. This is commonly known as "My Number." Formally, it is referred to as "Personal Number." This My Number is used for administrative procedures related to social security, taxation, and disaster response. Therefore, it is a system that also pertains to all companies that employ staff. *For more detailed information, you can view the PDF. Please feel free to contact us for more details.

This time's "Easy-to-Understand Security Glossary" is about "The Purpose of Using Personal Information." In the Personal Information Protection Act, "personal information" refers to information related to a living individual that can identify a specific person through details such as name, date of birth, address, and facial photographs. Many pieces of information alone cannot identify an individual, but the likelihood of identifying a specific person increases when combined with other information. For this reason, the Personal Information Protection Act requires the broad protection of information that can identify individuals. *You can view the detailed content of the article in the PDF. For more information, please feel free to contact us.*

This time's "Easy-to-Understand Security Glossary" is about the "Personal Information Protection Management System (abbreviated as PMS)." The Personal Information Protection Management System (PMS) refers to a series of mechanisms that companies and organizations use to protect personal information. It involves formulating a "Personal Information Protection Policy" on how to safeguard personal information, and through the PDCA cycle, it establishes a system for continuously improving the management of personal information in accordance with that policy. *For detailed content of the article, you can view it in the PDF. Please feel free to contact us for more information.

This time, the "Easy-to-Understand Security Terminology" is "Sensitive Personal Information." Sensitive personal information refers to personal information defined by the Personal Information Protection Act, which requires special consideration in its handling to prevent unfair discrimination, prejudice, or other disadvantages from arising. In the event of a leak or misuse, it can cause significant disadvantages to the individual. Therefore, restrictions are placed on its acquisition and use. Additionally, even when acquiring such information, it is necessary to obtain the individual's consent thoroughly and implement strict safety management measures, requiring more consideration than ordinary personal information. *For detailed content of the article, you can view it in PDF format. Please feel free to contact us for more information.*

This time's "Easy-to-Understand Security Glossary" is "Personal Information Protection Management System (abbreviated as: PMS)." Regarding the Personal Information Protection Management System, the standard to which the Privacy Mark conforms defines it as follows: The Personal Information Protection Management System is a management system that includes policies, structures, plans, implementation, audits, and reviews for the protection of personal information used by businesses in their operations (from JIS Q 15001). *For detailed content of the article, please refer to the PDF. For more information, feel free to contact us.