Personal data distribution management system and method thereof

Abstract

SOLUTION: A personal data distribution management system (1) has supplier data management apparatuses (11), (12), ... connected on a network (50), a data distribution management apparatus (30), and a relay processing apparatus (40). The supplier data management apparatus (11) has a database (1103) for storing, as original data associated with the individual true name information, the individual personal data measured by a measurement device (21) and attribute information relating to the individual and the measurement. The data distribution management apparatus takes in the original data excluding the personal data to generate a data catalog. The relay processing apparatus, based on a request for data use accepted from an external device, outputs data excluding the individual true name information from the database such as the supplier data management apparatus and so on to a data user terminal (100).EFFECT: To allow data distribution management which reduces risk of information leakage of personal data and individual true name information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a personal data distribution management technique for managing the distribution of personal data collected from a plurality of individuals. [Background technology]

[0002] The use of big data holds the key to achieving data-driven economic growth and social change. As a type of big data, personal data in particular is attracting attention. It is expected that the use of personal data will benefit many people, for example by advancing medical care and improving health. It is also expected that services aimed at individuals will be able to use the personal data of the individuals they serve to create higher-quality services that are more tailored to the individual, and that the use of personal data will enable more effective marketing.

[0003] On June 9, 2017, the Cabinet decided to promote three specific measures to promote data distribution and utilization across business sectors in Japan in the "Future Investment Strategy 2017." The measures are (1) industrial data collaboration and utilization, (2) utilization of personal data, and (3) promotion of digital transformation in the private sector. In Japan, mechanisms such as personal data stores (PDS), information banks, and data trading markets have been proposed to ensure the proper utilization and appropriate protection of personal data, as well as to handle it in a balanced manner. In 2019, cases of information banks and data trading markets have gradually begun to appear. PDS and information banks are mechanisms to encourage the individual consent and conversion of personal data into big data, and the data trading market is positioned as an important mechanism for matching to promote distribution and utilization.

[0004] Personal data is acquired by companies every time an individual uses a company's service, so it is often managed and stored in information systems managed by the company. However, since it is originally personal, and it is generally accepted in society that individuals should accumulate and manage their own data and be aware of the existence of the data, the circulation of personal data is being considered in the direction of realizing it from the individual's perspective (data portability). PDS was conceived as a system that allows individuals to collect and manage the personal data they provide to companies and easily set the conditions of use for each data. According to the Personal Information Protection Act and guidelines, when a company uses personal data, prior consent from the individual is required, but PDS is a mechanism to systematically realize the individual's consent. PDS itself is a system to systematically realize the individual's consent, and does not include a mechanism for data circulation. For companies, it is costly to obtain consent from each individual regarding the utilization of personal data and collect it. Information banks are a mechanism in which individuals set the conditions of utilization of their own personal data in advance, and then entrust some or all of the data to a business operator that operates the information bank. By linking with PDS, it is also possible for information banks to handle rights processing on behalf of individuals using PDS, etc. When it comes to providing information to third parties, information banks can handle everything from negotiating the price to linking different data together.

[0005] In the European Union, new rules on the processing and transfer of personal data, called the EU General Data Protection Regulation (GDPR), were established in April 2016. The idea behind the GDPR, which is becoming a global trend, requires re-consent when providing data to a third party, but since the purpose of data use and all users are entrusted to the information bank, it can be said that this is only a comprehensive consent. If we look at the world, re-consent when providing data to a third party is indispensable. In addition, the management by information banks of "health and medical data" and "financial data" (credit number, bank account number), which are positioned as one of the sensitive information in the revised Personal Information Protection Act, is not covered by the "Guidelines for the Certification of Information Trust Functions ver.1.0", and is still under consideration, as public comments were solicited in June 2019. The "data trading market" is a data buying and selling mechanism that matches the supply and demand of individuals who directly manage personal data in their own PDS, or information banks that accept data from individuals and manage it on their behalf, and companies (and platforms that are a collection of multiple companies) that have a need to collect personal data for the purpose of effectively utilizing their own industrial data. Functions of this market are expected to include price formation and presentation for data buying and selling, elaboration of trading conditions, standardization of trading targets, credit guarantee for transactions, etc. With regard to the distribution of personal data, it will be useful to create a data trading market mechanism that includes a re-consent process in a format that complies with the revised Personal Information Protection Act and GDPR with a global perspective.

[0006] Recently, various systems for realizing the distribution of personal data of individuals have been proposed. For example, Patent Document 1 describes a personal data providing system including a business that acquires personal data of individuals, a purchaser, and an intermediary that acts between the business and the purchaser to mediate applications from the purchaser and the provision of the personal data that is the subject of the application, and anonymity can be ensured for the intermediary and the purchaser by assigning a temporary ID to the individual. Patent Document 2 describes an intermediary device that is interposed between multiple information bank devices that store personal data and a data utilization device and supports utilization data requests from the data utilization device. Patent Document 3 describes a personal data management system that includes a management server that includes a user information storage unit and a requesting server that requests user information.

[0007] A personal data management system is described that includes a management server having a user information storage unit and a requesting server that requests user information. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Patent Publication No. 2018-128884 [Patent Document 2] Patent No. 6592213 [Patent Document 3] Patent No. 6566278 Summary of the Invention [Problem to be solved by the invention]

[0009] The data management systems, data provision systems, and intermediary devices described in Patent Documents 1 to 3 include a source data storage unit that stores personal data, but do not include a distribution management device that creates and stores a catalog to promote the distribution of personal data. Moreover, when adopting a system configuration in which a data distribution management device and multiple source data storage units are individually arranged, it is not easy to design the system as a whole to ensure the information security of personal data, comply with the GDPR, and satisfy the protection of personal information.

[0010] The present invention has been made in view of the above, and provides a personal data distribution management system and method for performing data distribution management that can reduce the risk of information leakage of personal data.

[0011] The present invention also provides a personal data distribution management system and method that aims to protect personal information such as real names and enables data distribution management in compliance with GDPR. [Means for solving the problem]

[0012] The personal data distribution management system according to the present invention comprises at least one source data management device, a data distribution management device, and a relay processing device, all of which are connected on a network. The source data management device comprises a database that stores personal data of individuals measured by a measuring device, and attribute information related to the individuals and the measurement as original data associated with real name information of the individuals. The data distribution management device comprises a usage request receiving means that receives a data usage request from a data user terminal. The relay processing device selects personal data of individuals corresponding to the data usage request from the database of each source data management device based on the data usage request received by the usage request receiving means, and outputs the selected personal data to the data user terminal excluding the corresponding real name information of the individuals.

[0013] The personal data distribution management system according to the present invention comprises at least one source data management device and a data distribution management device, which are connected on a network. The source data management device comprises a database that stores personal data of individuals measured by a measuring device, and attribute information related to the individuals and the measurement as original data associated with real name information of the individuals. The data distribution management device comprises a catalog management means that imports, unifies, and edits the original data, excluding the personal data, stored in the database of each source data management device to generate a data catalog.

[0014] Furthermore, the personal data distribution management method of the present invention comprises at least one source data management device, a data distribution management device, and a relay processing device, all of which are connected on a network. A usage request receiving means of the data distribution management device generates and stores personal data of an individual measured by a measuring device, and attribute information related to the individual and the measurement, as original data associated with real name information of the individual. The data distribution management device receives a data usage request from a data user terminal. Based on the data usage request received by the data distribution management device, the relay processing device selects personal data of the individual corresponding to the data usage request from the database of each source data management device, and outputs the selected data to the data user terminal, excluding the corresponding real name information of the individual.

[0015] The personal data distribution management method according to the present invention comprises at least one source data management device and a data distribution management device, which are connected on a network. The source data management device creates original data in which personal data of an individual measured by a measuring device and attribute information related to the individual and the measurement are associated with real name information of the individual, and stores the original data in a database. The catalog management means of the data distribution management device imports, unifies, and edits the original data, excluding the personal data, stored in the database of each source data management device to generate a data catalog.

[0016] According to these inventions, the data distribution management device imports original data excluding personal data to generate a data catalog. Also, the relay processing device outputs data excluding personal real name information from the database of each source data management device to the data user terminal based on a data usage request received from outside. This enables data distribution management that reduces the risk of personal data and personal real name information leaking from the database of each source data management device to the outside. Effect of the Invention

[0017] According to the present invention, data distribution management can be achieved with reduced risk of leakage of personal data and individuals' real name information. [Brief description of the drawings]

[0018] [Figure 1] 1 is a configuration diagram showing an embodiment of a personal data distribution management system according to the present invention; [Diagram 2] FIG. 2 is a configuration diagram showing an embodiment of a source data management device. [Diagram 3] FIG. 1 is a configuration diagram showing an embodiment of a data distribution management device. [Figure 4] FIG. 2 is a configuration diagram showing an embodiment of a user terminal. [Diagram 5] This is a memory map diagram showing an example of original data items. (A) is an item for the data provider and an item for email address, and (B) includes an item for an individual's real name and items such as individual attribute information. [Figure 6] FIG. 1 is an explanatory diagram showing an example of a name matching process, where (A) is a name matching table and (B) is a secondary kana table. [Figure 7] FIG. 1 is an explanatory diagram showing an example of a catalog management process, where (A) is a comprehensive data catalog and (B) is an edited catalog. [Figure 8] 11 is a table showing an example of selection items for a data use request. [Figure 9]FIG. 1 is a diagram explaining the final kanamycinization process; (A) is a data catalog, (B) is a diagram showing an example of reassignment, and (C) shows the data to be provided. [Figure 10] 13 is a flowchart illustrating an example of a name matching process performed by the data distribution management device. [Figure 11] 13 is a flowchart showing an example of a re-consent process performed by the data distribution management device. [Figure 12] 13 is a flowchart showing an example of a re-consent procedure process I performed by the data source device. [Figure 13] 13 is a flowchart showing an example of a re-consent procedure process II performed by the data source device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] Fig. 1 is a configuration diagram showing one embodiment of a personal data distribution management system according to the present invention. In Fig. 1, the personal data distribution management system 1 comprises a data provider 10, a data distribution management device 30, and a relay processing device 40 functioning as a platform, each of which is capable of data communication via a network 50 such as the Internet. The personal data distribution management system 1 is connectable to a user terminal 100 via the network 50.

[0020] The data provider 10 includes at least one or more source data management devices 11, 12, 13, ... as a source data management device that is a unit for collecting and storing a group of data sets. The source data management devices 11, 12, 13, ... are assumed to be corporations, companies, university corporations, organizations, and individuals, and in this embodiment, each is a hospital unit, and may also include a medical department unit. Note that, as personal data of individuals or in diagnoses in this embodiment, data types such as heart rate, blood pressure, and other various vital data, and further purchase history information in a hospital, may be included. In addition, in this embodiment, each entity of the data provider 10 and the user terminal 100 is assumed to be a member who has joined the organization of this system, but this is not necessarily required. Members are given an ID and a password, and can receive services such as viewing data and requesting use based on these.

[0021] Here, an overview of the data distribution management process executed by the personal data distribution management system 1 will be described. The source data management devices 11, 12, 13, ... constituting the data providing side 10 each collect personal data from a plurality of individuals (e.g., patients, medical examinees). Various types of personal data are assumed. Each type of collected personal data is stored in association with real name information for each source data management device 11, 12, 13, ... of the data providing side 10.

[0022] Meanwhile, the data distribution management device 30 functions as a data trading market, creating a promotional data catalogue to promote data distribution (buying and selling of personal data of individuals) and providing it so that it can be viewed on the network 50. In this state, when the data distribution management device 30 receives a data usage request from a third party via the network 50, it searches for personal data that corresponds to the content of the usage request, and provides the data to the user under specified conditions (benefits) after going through a re-consent procedure process for the relevant parties and individuals. Benefits may include money, points, various services, and other compensation.

[0023] In this case, the first and second pseudonyms are applied to prevent individuals from being identified, and when the personal data is provided, it is further reassigned (pseudonymization for provision) to make it anonymous so that it cannot be restored, and is provided to the third party together with the actual data. In addition, when re-consent is to be obtained from individuals who provided personal data as a specified condition for the use of data by a third party, if re-consent is required including from those involved in data collection, an efficient re-consent procedure is executed in a specified order of priority. This is described in detail below.

[0024] 2 is a configuration diagram showing an embodiment of the source data management device 11. The source data management devices 11, 12, 13, ... have the same configuration, so the source data management device 11 will be described below as a representative. The source data management device 11 has a control unit 110 consisting of a processor (CPU). The control unit 110 is connected to a display unit 1101 that displays images, an operation unit 1102 that inputs information and gives instructions from the outside, and a source data DB 1103 that stores predetermined data.

[0025] In this embodiment, the measuring device 21 measures various vital data from an individual as personal data. The measuring device 21 includes various sensors, devices, and equipment such as a heart rate monitor, a blood pressure monitor, or an MRI that measures (imaging) inside a living body. The personal terminal 22 includes a personal computer, a smartphone, and various other mobile information and communication terminals, and transmits and receives information using a social network system (SNS), a short message service (SMS), or email.

[0026] The source data DB 1103 stores a control program for controlling the source data management process performed by the control unit 110, and also stores original data including personal data, which is real data of a plurality of individuals measured by the measuring device 21. FIG. 5 is a memory map showing an example of items of original data. FIG. 5(A) shows an item of a data source, that is, in this embodiment, one of the data set units, for example, hospital "A". Next, in this embodiment, there is an item of email address of hospital A. Furthermore, as shown in FIG. 5(B), following the item of the real name of the individual, there are items of the sex, age, email address, address, primary pseudonym, information account, and real data (personal data) of the individual as personal attribute information. Note that the primary pseudonym refers to identification information that is automatically assigned according to an appropriate rule, typically in correspondence with the real name of the individual, when the original data is created in hospital "A". The information account is an account for managing individuals on the system, and includes location information. This information account refers to a storage location of benefits that are updated each time the personal data of an individual is provided.

[0027] In addition, the original data is provided with other information items as necessary. In this embodiment, there are items of attribute information of the measurement participants, such as the vested interests, the collector, and their email addresses. Note that information account items may also be prepared for the vested interests and the collector. For example, the vested interests may be the providers of the measuring instruments and the measuring locations, and the collectors may be the people who engaged in the measuring work. In addition, other attribute information may include the data type, the measuring instruments (model names, etc.), and various other measuring conditions (for example, the date and time of measurement, the measuring location). In addition, the benefits are to be paid by the data users in principle, but there may be a case where the data distribution management device 30 partially pays the costs or prepays them. The contents of the benefits may be set in advance, or may be determined through negotiations, etc., each time a data use application is made.

[0028] The control unit 110 functions as a data receiving unit 111, a data management unit 112, and a re-consent processing unit 113 as a result of the processor executing a control program.

[0029] The data receiving unit 111 performs a process of registering various data in the original data table for each individual shown in Fig. 5 via the operation unit 1102, or automatically depending on the item. For example, the personal data may be linked with the individual's primary pseudonym and the measurement results of the measuring device 21 may be automatically input. In this case, consent is obtained from each individual, and, if necessary, from the concessionaire and collector, for the utilization (primary utilization) of the personal data by the data providing side 10 or hospital "A".

[0030] The data management unit 112 performs the following data management based on the original data exemplified in Fig. 5. The data management unit 112 creates source data (primary pseudonym, personal data) consisting of a pair of a primary pseudonym and personal data, which is real data, excluding real name information, as data to be uploaded (or linked) to the relay processing device 40. Note that this source data (primary pseudonym, personal data) may be held by the source data management device 11, in addition to being held by the relay processing device 40.

[0031] Moreover, the data management unit 112 creates a name matching table (primary pseudonym, real name) consisting of a pair of a primary pseudonym and a real name, excluding personal data, as data to be submitted to the data distribution management device 30. Moreover, the data management unit 112 creates a data catalog (provider, attribute information including data type, measuring device and other measurement conditions, and number of data) consisting of a pair of provider, data type, attribute information, and number of data, excluding personal data, by linking it with the primary pseudonym, as data to be submitted to the data distribution management device 30. The data management unit 112 creates data when the provider data management device 11 is started up or at other appropriate timing, and sends each created data to the data distribution management device 30. The name matching table is stored in the name matching data DB 341 of the data distribution management device 30. The data catalog is stored in the data catalog DB 342 of the data distribution management device 30.

[0032] The re-consent processing unit 113 executes the process for re-consent that is handled by the source data management device 11. The re-consent process is a procedure process for obtaining a consent form for data use (secondary use) from the individual of the personal data corresponding to the request content, and further from the source, the right holder and the collector of the attribute information, as necessary, when a data use request is made from the user terminal 100, which is a third party. The re-consent process is performed by instructions from the data distribution management device 30, as described later, and is typically performed electronically and via the network 50, but in some cases, other communication means may be applied.

[0033] In this embodiment, the re-consent procedure is performed according to a preset priority order. That is, the priority order is provider, right holder and collector, and finally individual. When an electronic re-consent application form is sent, the re-consent processing unit 113 operates the operation unit 1102 to enter a mark in a check box indicating consent or non-consent provided for each required unit in the re-consent application form, and issues a reply instruction.

[0034] If the source data management device 11 does not agree, the re-agreement processing unit 113 ends the re-agreement processing, whereas if it agrees, the re-agreement application form for the concessionaire and the collector, which was sent at the same time, is sent to the relevant concessionaire and the collector by e-mail in this embodiment, and waits for a response (reply). The re-agreement processing unit 113 ends the work for the part of the reply from the concessionaire and the collector of not agreeing, and for the part of the reply from the concessionaire and the collector, sends a personal re-agreement application form by e-mail to the relevant individual, and waits for a response (reply). By setting such a priority, the re-agreement procedure can be efficiently carried out. Note that various forms of benefits are given to the concessionaire, the collector, and the individual for the re-agreement, and for example, the money is transferred to the information account shown in FIG. 5 as described above. Note that other forms of re-agreement and the processing method for re-agreement will be described later.

[0035] 3 is a configuration diagram showing one embodiment of a data distribution management device 30. The data distribution management device 30 includes a control unit 31 configured from a processor (CPU). Connected to the control unit 31 are a display unit 32 that displays images, an operation unit 33 that inputs information and gives instructions from the outside, a name matching data DB 341 that stores name matching data, and a data catalog DB 342 that stores a data catalog. Note that the control program for data distribution management may be written in a program storage area in these memories.

[0036] The control unit 31 functions as a name matching processing unit 311, a catalog management unit 312, a usage request receiving unit 313, and a provision pseudonymization processing unit 314 by the processor executing a control program.

[0037] As shown in Fig. 6, the name matching processor 311 creates a secondary pseudonym from the name matching table (primary pseudonym, real name) stored in the name matching data DB 341, and stores it in the name matching data DB 341. More specifically, the name matching processor 311 unifies (integrates) the name matching tables (primary pseudonym, real name) from the source data management devices 11, 12, 13, ... (see Fig. 6(A)), performs a name matching process of matching the real name with the primary pseudonym, creates an integrated secondary pseudonym from the primary pseudonym, and stores the created secondary pseudonym table (see Fig. 6(B)) in the name matching data DB 341. When transmitting this name matching table (primary pseudonym, real name) to the data distribution management device 30, the name matching table (primary pseudonym, real name) is transmitted from the source data management devices 11, 12, 13, ... via a network other than the network 50, or by using another communication method, thereby suppressing the risk of leakage of real name data during communication. In the example of Figure 6, the primary pseudonym ID-a1 of an individual who treated at Hospital "A" and the primary pseudonym ID-b5 of an individual who treated at Hospital B are the same person whose real name matches, and in Figure 6(B) they have been replaced with a common secondary pseudonym ID1. Note that secondary pseudonyms may be, for example, consecutive personal numbers. Also, the secondary pseudonym table in Figure 6(B) may be a table of (secondary pseudonym, real name).

[0038] As shown in FIG. 7, the catalog management unit 312 unifies and integrates the data catalogs from each of the data source management devices 11, 12, 13, ... stored in the data catalog DB 342 to create a comprehensive data catalog. In FIG. 7, the data catalog (attribute information including the provider, data type, etc., and the number of data) linked to the primary pseudonym is associated with the secondary pseudonym with reference to FIG. 6 (B) and edited based on the data type item (see FIG. 7 (B)). Then, a part of the comprehensive data catalog is provided on the network 50 and becomes a viewing target. Note that the data catalog can be sorted based on some or all of the data items in the viewing range, which provides convenience for the user in selecting items. Also, instead of a sales form in which the data catalog is provided on the network 50, it is also possible to adopt a form in which the data catalog is used for sales by humans or is used by posting it on other media.

[0039] The use request receiving unit 313 receives a use request from the user terminal 100 and executes processing according to the request contents. The request contents are specified based on data items, for example, as shown in FIG. 8. In the example of FIG. 8, other attribute information including data type, data source, measuring device, etc. is assumed. In addition, as an example of the request for other attribute information, a form including gender and age group among the attribute information of an individual may be used. The use request receiving unit 313 selects a target person for which re-consent is requested from the request contents. For example, if the request contents include the data source, re-consent processing may be executed only for the source data management device. If no designation is made, all are the target persons. The use request receiving unit 313 transmits the information of the request contents to the target source data management device, in this example via the relay processing device 40, and instructs the re-consent processing. In addition, the selection of the target concessionaires, collectors, and individuals may be executed by the re-consent processing unit 113 described above, or may be processed by the use request receiving unit 313 and transmitted in association with an instruction for re-consent processing.

[0040] The provision pseudonymization processor 314 creates data to be provided to a user who has requested use by editing the original data linked to the secondary pseudonym, excluding the real name item, uploaded to the relay processing device 40 described below. More specifically, the provision pseudonymization processor 314 executes a process of deleting persons who have not given consent to the re-consent application from the primary pseudonym and secondary pseudonym table in Fig. 6(B), a process of reassigning the secondary pseudonym remaining after the deletion to a report pseudonym, and a process of extracting the secondary pseudonym associated with the report pseudonym from the original data uploaded to the relay processing device 40 to create data to be provided.

[0041] In the reassignment process to the report kana, as shown in Fig. 9(A), (B), and (C), the secondary kana associated with the data catalogue that remain after deletion are subjected to a predetermined sorting process, and then replaced with individual identification information, for example, from the top (see the table in Fig. 9(B)). The individual identification information is assumed to be a character code, for example, a consecutive number, that is assigned according to a predetermined rule. In Fig. 9(B), the person assigned the secondary kana ID2 (having "attribute information: a, c, ...") is a person who disagrees (see Fig. 9(A), answer result: disagree), and after reassignment, the person is deleted as shown in the table for provision in Fig. 9(C). The data for provision shown in Fig. 9(C) is edited by the relay processing device 40 in response to the reassignment table in Fig. 9(B). The edited data for provision is sent from the relay processing device 40 to the user terminal 100.

[0042] FIG. 4 is a block diagram showing an embodiment of the user terminal 100. The user terminal 100 includes a control unit 101 configured with a processor (CPU). The control unit 101 is connected to a display unit 1001 for displaying images, an operation unit 1002 for inputting information and giving instructions from the outside, and a storage unit 1003 for temporarily storing data to be provided. The storage unit 1003 also stores a control program (installed application program) for personal data utilization processing. The user terminal 100 does not need to be a dedicated machine for this system, and can be applied to a general-purpose personal computer device by installing the application program as long as it is capable of communicating via the network 50. It may also be a mobile terminal.

[0043] The control unit 101 functions as a browsing processing unit 102 and a use request processing unit 103 as a result of a control program being executed by the processor.

[0044] The browsing processing unit 102 transmits a request to browse the data catalog to the relay processing device 40 or the data distribution management device 30, and receives the data catalog in a manner that allows browsing under a predetermined condition (eg, being a member).

[0045] The use request processing unit 103 transmits an electronic use request (use application) including selected items related to the personal data desired to be used to the data distribution management device 30 via the relay processing device 40. Note that the viewing process for the provided data returned by e-mail or the like from the present system 1 in response to the use request is the same as the handling of general e-mail, and therefore a description thereof will be omitted.

[0046] Next, the procedures for the name matching process, re-consent process, and re-consent procedure process will be explained.

[0047] Fig. 10 is a flow chart showing an example of the name matching process performed by the control unit 31 of the data distribution management device 30. First, the control unit 31 confirms a predetermined timing for creating a catalog by measuring time using a built-in timer or the like, and receives source data (primary pseudonym, real name) and data catalog (primary pseudonym, data type, attribute information, number of data) from each data source source data management device 11, 12, 13, ... (step S1). Next, the control unit 31 unifies the source data (primary pseudonym, real name) from all data sources, and assigns the same secondary pseudonym to each primary pseudonym having the same real name according to a predetermined rule (step S3). Then, the control unit 31 creates a secondary pseudonym table (secondary pseudonym, primary pseudonym) as shown in Fig. 6 (B) based on the assigned secondary pseudonym, and saves it (step S5).

[0048] 11 is a flow chart showing an example of re-consent processing performed by the control unit 31 of the data distribution management device 30. First, the control unit 31 judges whether or not there is a use request (step S11), and if there is no use request, the flow is terminated, and if there is a use request, the control unit 31 extracts the relevant data provider, data type, and attribute information from the use request form and issues a procedure instruction to the data provider (step S13). At this point, data providers that are not the target are excluded.

[0049] Next, the control unit 31 judges whether or not there is a response to the request for use from the relevant data provider (step S15). Then, the control unit 31 deletes the data provider who did not consent to use by referring to the secondary pseudonym table, and reassigns the remaining secondary pseudonyms to pseudonyms for provision (step S17). By reassigning to pseudonyms for provision, the individuals in the data to be provided are anonymized. In addition, by reassigning to pseudonyms for provision, there is no guarantee that the individuals assigned the same pseudonym for provision for each request for use are the same individuals, so that individuals cannot be identified even if the data is used multiple times. Note that if the data provider itself responds with a non-consent, all subsequent right holders, collectors, and individuals are treated as having non-consent.

[0050] 12 is a flow chart showing an example of re-agreement procedure processing I performed by the control unit 110 of the source data management device 11. When the control unit 110 receives an instruction for re-agreement procedure processing from the data distribution management device 30 via the relay processing device 40, it inputs consent or non-agreement to the re-agreement application form for its own data provider via the operation unit 1102. If non-agreement is received, the form is returned as is and the flow does not proceed.

[0051] On the other hand, if consent is given, the control unit 110 judges whether or not the data type selected at the time of the use request includes an interest holder or collector in the attribute information of the measurement participant (step #1). If there is no corresponding person, the control unit 110 exits this flow, but if there is a corresponding person, it sends a re-consent document by email to the corresponding interest holder or collector (step #3).

[0052] Next, the control unit 110 judges whether or not responses have been received from all relevant vested interests and collectors (step #5). The control unit 110 waits for responses from all relevant vested interests and collectors, and then transmits re-consent documents by e-mail to the remaining relevant individuals, excluding those who responded with no consent (step #7). The control unit 110 judges whether or not responses have been received from all relevant individuals (step #9). The control unit 110 then returns the response results to the data distribution management device 30 (step #11).

[0053] Next, another embodiment of re-consent to which the present invention can be applied will be described. In the above embodiment, re-consent is treated as re-consent each time, and whether or not to consent is determined in response to a usage request from a user. However, the present invention is not limited to this, and a comprehensive re-consent format in which consent is given in advance may be adopted.

[0054] Note that comprehensive re-consent may include partial comprehensive re-consent and partial lump-sum re-consent. Comprehensive re-consent means granting (setting) re-consent in advance for all data items (including items such as attribute information) of the original data shown in FIG. 5. Partial comprehensive re-consent means granting re-consent in advance for one or more specific data items of the original data. Partial lump-sum re-consent means granting re-consent in advance for multiple specific data items of the original data as a whole.

[0055] The items for which the comprehensive re-agreement can be set correspond to the target data items of the original data requested by the user. Referring to FIG. 5(B), in addition to "data type" and "actual data", various items such as "gender", "age", "measuring device", and further items in "other measurement conditions" may be included. Also, "data provider" may be included. Specifically, for example, a "re-agreement" item is set in association with each of the target data items. The "re-agreement" item is set to be, for example, alternately switched between "comprehensive" and "each time". The re-agreement processing unit 113 of the provider data management device 11 refers to the setting contents of each of these comprehensive re-agreement items when requesting re-agreement. Details will be described in FIG. 13. In addition, another setting form may be one in which items for comprehensive re-consent, partial comprehensive re-consent, and partial lump-sum re-consent are prepared separately, with comprehensive re-consent being set in a binary format, partial comprehensive re-consent being set by the logical OR of the desired items input, and partial lump-sum re-consent being set by the logical AND of the desired items input.

[0056] The data management unit 112 of the source data management device 11 accepts requests for "comprehensive" or "each time" (including cancellation of "comprehensive") for comprehensive re-consent from individuals, vested interests, and collectors, and selects "comprehensive" or "each time" for the corresponding "re-consent" item. Each comprehensive re-consent item may be set at the time of acquiring the actual data, or may be changeable at any time thereafter. The data management unit 112 of the source data management device 11 may assign an ID or the like to an individual, vested interest, or collector in advance, or may give the person authority to accept rewriting of the setting contents from the person's email address, thereby making it possible to rewrite the comprehensive re-consent items for that person.

[0057] Fig. 13 is a flowchart showing an example of re-agreement procedure processing II performed by the control unit 110 of the provider data management device 11. Fig. 13 shows a re-agreement procedure in which processing corresponding to the settings of the item of comprehensive re-agreement is added to the flowchart of Fig. 12, specifically, steps #23 to #37 are added or modified, and other processing is the same.

[0058] In step #23, rights holders and collectors who have agreed to comprehensive re-consent, partial comprehensive re-consent, or partial lump-sum re-consent for the data type requested for use are searched for. Then, the searched person or people concerned skips steps #25 and #27 and proceeds to step #29, where the searched people concerned are processed as having agreed. Meanwhile, rights holders and collectors who have re-consented on an individual basis in step #25 are sent a written re-consent and a response is awaited (step #27). Then, those who have re-consented comprehensively and those who have re-consented on an individual basis are combined and the process proceeds to step #31.

[0059] Next, in step #31, excluding those who did not consent, the relevant individuals are searched for those who have agreed to comprehensive re-consent, partial comprehensive re-consent, or partial lump-sum re-consent for the data type requested for use. Then, the searched individual or individuals skip steps #33 and #35 and proceed to step #37, where the searched individual is processed as having consented. Meanwhile, a written re-consent document is sent to individuals who re-consented on an individual basis in step #33, and a response is awaited (step #35). Then, the individuals who have given comprehensive re-consent and those who have given re-consent on an individual basis are combined and proceed to step #39. In this way, by giving comprehensive re-consent in advance, the work of sending and returning consent forms to the individual can be omitted, making the procedure smoother.

[0060] The source data is not limited to (pseudonym and personal data) and may include items corresponding to the usage request, part of the individual's attribute information, such as gender and age.

[0061] In this system 1, real name information and real data are held only in each of the source data management devices 11, 12, 13, ..., the data distribution management device 30 corresponding to the trading market does not hold the real data, and the relay processing device 40 does not hold the real name information. By holding the original data in a distributed manner in this way, security risks are significantly reduced compared to the case where information is leaked when held in one place. In addition, since neither the data distribution management device 30 nor the relay processing device 40 holds the real name information and real data at the same time, the personal data of individuals cannot be identified from these devices. Furthermore, if each device is managed by a different organization, the legal damage for each is limited.

[0062] As described above, the personal data distribution management system of the present invention comprises at least one source data management device, a data distribution management device, and a relay processing device, all of which are connected on a network. The source data management device comprises a database that stores personal data of an individual measured by a measuring device, and attribute information related to the individual and the measurement as original data associated with real name information of the individual. The data distribution management device comprises a usage request receiving means that receives a data usage request from a data user terminal. The relay processing device selects personal data of an individual corresponding to the data usage request from the database of each source data management device based on the data usage request received by the usage request receiving means, and outputs the selected personal data to the data user terminal excluding the corresponding real name information of the individual.

[0063] The personal data distribution management system according to the present invention comprises at least one source data management device and a data distribution management device, which are connected on a network. The source data management device comprises a database that stores personal data of individuals measured by a measuring device, and attribute information related to the individuals and the measurement as original data associated with real name information of the individuals. The data distribution management device comprises a catalog management means that imports, unifies, and edits the original data, excluding the personal data, stored in the database of each source data management device to generate a data catalog.

[0064] Furthermore, the personal data distribution management method of the present invention comprises at least one source data management device, a data distribution management device, and a relay processing device, all of which are connected on a network. A usage request receiving means of the data distribution management device generates and stores personal data of an individual measured by a measuring device, and attribute information related to the individual and the measurement, as original data associated with real name information of the individual. The data distribution management device receives a data usage request from a data user terminal. Based on the data usage request received by the data distribution management device, the relay processing device selects personal data of the individual corresponding to the data usage request from the database of each source data management device, and outputs the selected data to the data user terminal, excluding the corresponding real name information of the individual.

[0065] The personal data distribution management method according to the present invention comprises at least one source data management device and a data distribution management device, which are connected on a network. The source data management device creates original data in which personal data of an individual measured by a measuring device and attribute information related to the individual and the measurement are associated with real name information of the individual, and stores the original data in a database. The catalog management means of the data distribution management device imports, unifies, and edits the original data, excluding the personal data, stored in the database of each source data management device to generate a data catalog.

[0066] According to these inventions, the data distribution management device imports original data excluding personal data to generate a data catalog. Also, the relay processing device outputs data excluding personal real name information from the database of each source data management device to the data user terminal based on a data usage request received from outside. This enables data distribution management that reduces the risk of personal data and personal real name information leaking from the database of each source data management device to the outside.

[0067] In the present invention, it is preferable that the catalog management means makes the generated data catalog available for browsing on the network. With this configuration, the catalog is efficiently published.

[0068] In addition, the present invention preferably includes a re-consent processing means for identifying an individual who has the requested personal data according to an instruction from the data circulation management device in response to the acceptance of the data use request, transmitting inquiry information on whether or not to allow the data provision to the information communication terminal of the individual, and receiving a response on whether or not to allow the data provision, and the data circulation management device includes a data output control means for controlling the output of personal data of an individual who has responded that they do not consent to the data provision. According to this configuration, the provision of personal data is controlled based on the permission or refusal of the data provision. Furthermore, since real name information is removed when the personal data is provided to the user, the real name information and the personal data are not linked on the user side.

[0069] In the present invention, it is preferable that the re-consent processing means performs a first inquiry process instructing an information communication terminal of a person involved in the measurement to inquire about permission for data provision, and a second inquiry process instructing an information communication terminal of an individual of personal data measured by a measuring device involved by a participant who responded to consent to data provision in the first inquiry process to inquire about permission for data provision. According to this configuration, an inquiry is made to the person involved in the measurement in the first inquiry process, and a second inquiry process is made to the individual of personal data measured by the participant who responded to consent to data provision in the first inquiry process. Considering that the number of individuals is greater than the number of people involved in the measurement, first setting a priority order to obtain the results of the participants in the first inquiry process enables more efficient re-consent processing than making inquiries to everyone uniformly or in the order from individual to participant.

[0070] In the present invention, it is preferable that the source data management device has a plurality of source data management devices on the network, whereby the source data can be distributed and allocated more effectively.

[0071] In addition, the present invention preferably includes a data source management device that assigns a primary pseudonym in association with the real name of each individual, and the data circulation management device includes a name matching processing means that executes a name matching process of unifying the real names of each individual stored in each data source management device and assigning a common secondary pseudonym to the common real name. According to this configuration, when the original data of each data source management device is unified, a unified pseudonym, i.e., a secondary pseudonym, is also set.

[0072] In the present invention, it is preferable that the name matching processing means acquires the real names and primary kana from each of the source data management devices, performs a name matching process by matching the real names with the primary kana, and generates the unified secondary kana from the primary kana. According to this configuration, a unified secondary kana is generated from the primary kana by the name matching process by matching the real names with the primary kana.

[0073] In addition, in the present invention, it is preferable that the data output control means performs a process of deleting from the secondary kana table those who disagree with the re-consent application, and a process of reassigning the secondary kana remaining after the deletion to a reporting kana. With this configuration, even for the same data item, the reporting kana changes depending on the state of disagreement at the time of the use request, and the same reporting kana does not necessarily represent the same person, thereby maintaining anonymity.

[0074] Furthermore, in the present invention, it is preferable that the database includes a global re-agreement item that can be selected to set whether to globally re-agree or to re-agree on a case-by-case basis for a predetermined data item of the original data, the providing source data management device includes a data management unit that receives settings for the global re-agreement item and changes the setting content, and when the setting content of the global re-agreement item corresponding to the data item for which a use request has been made is "approval," the re-agreement processing unit determines that data provision has been permitted and omits the transmission of inquiry information regarding whether or not the data provision has been permitted. With this configuration, the task of obtaining an agreement can be omitted for those who have made a comprehensive agreement, making it efficient and quick.

[0075] In the present invention, it is preferable that the data distribution management device makes the generated data catalog available for browsing on the network, thereby enabling the catalog to be published efficiently. [Explanation of symbols]

[0076] 1 Personal Data Distribution Management System 11, 12, 13 Data management device 110 Control section 113 Re-consent Processing Unit 1103 Data provided by DB (database) 21 Measuring instruments 22 Personal Devices 30 Data distribution management device 31 Control Unit 311 Name matching processing unit 312 Catalog Management Unit (Catalog Management Means) 313 Usage request reception unit (usage request reception means) 314 Provisional pseudonymization processing unit (data output control means) 341 Name matching data DB 342 Data Catalog DB 40 Relay processing device 50 Network 100 User terminal (data user terminal)

Claims

1. The system comprises at least one source data management device, a data distribution management device, and a relay processing device, which are connected to a network, The at least one source data management device a database that stores, as original data, personal data of an individual measured by a measuring device, the individual's name, and a primary pseudonym associated with the individual's name; a data management unit that manages data transmission to the data distribution management device and the relay processing device; the data distribution management device includes a first storage unit that receives and stores a first data table created by the data management unit, the first data table including pairs of personal names and pseudonyms assigned in correspondence with the personal names, excluding the items of personal data; the relay processing device includes a second storage unit that stores, by one of updating and linking, a second data table created by the data management unit, the second data table including pairs of the personal data of the individual and the pseudonym, excluding the item of the individual's name; The data distribution management device is equipped with a usage request receiving unit that receives data usage requests from a data user terminal via the network, and when the usage request receiving unit receives the data usage request, it uses the second data table to select personal data of an individual that corresponds to the data usage request, and extracts a pseudonym corresponding to the selected personal data of the individual from the first data table to generate data to be provided, and outputs the data to the data user terminal.

2. The personal data of the individual measured by the measuring device, the individual's name, and a primary pseudonym associated with the individual's name are stored in a database as original data by a source data management device; a data distribution management device receives a first data table having a pair of a personal name and a primary kana assigned in correspondence with the personal name, excluding the personal data items, which is created in a data management unit of the provider data management device, and stores the first data table in a first storage unit; a second data table having a set of the personal data of the individual and the pseudonym, excluding the item of the individual's name, created by the data management unit, is stored in a second storage unit by one of updating and linking; When a data usage request from a data user terminal is received by a usage request receiving unit of the data distribution management device via the network, the data distribution management device selects personal data of an individual corresponding to the data usage request using the second data table, extracts a pseudonym corresponding to the selected personal data of the individual from the first data table, generates data to be provided, and outputs the data to the data user terminal. A personal data distribution management method, wherein the at least one source data management device, the data distribution management device, and the relay processing device are individually connected to a network.

3. The system includes a plurality of source data management devices, a data distribution management device, and a relay processing device, which are connected to a network, Each of the plurality of source data management devices a database that stores, as original data, personal data of an individual measured by a measuring device, the individual's name, and a primary pseudonym associated with the individual's name; a data management unit that manages data transmission to the data distribution management device and the relay processing device; the data circulation management device includes a first storage unit that receives and stores the plurality of first data tables, each of which has a pair of a personal name and a primary kana assigned in correspondence with the personal name, excluding the personal data items, created for each of the source data management devices by each of the data management units; the relay processing device includes a second storage unit that stores, by one of updating and linking, the second data tables that have pairs of the personal data of the individuals and the primary pseudonyms, excluding the item of the personal name, that are created for each of the source data management devices by each of the data management units; the data distribution management device includes a name matching processing unit that unifies the personal names in the first data tables, creates a third data table in which common personal names are assigned common secondary kana, and further stores the third data table in the first storage unit; The data distribution management device is provided with a usage request receiving unit that receives data usage requests from a data user terminal via the network, and when the usage request receiving unit receives the data usage request, it uses each of the second data tables to select personal data of an individual corresponding to the data usage request, and extracts secondary kana corresponding to the selected personal data of the individual from the third data table to generate data to be provided, and outputs the data to the data user terminal.

4. The personal data distribution management system of claim 3, wherein the name matching processing unit obtains the personal name and primary kana from each of the source data management devices, performs a name matching process by matching the personal name with the primary kana, and generates a unified secondary kana from the primary kana.

Images