Processor and method for revoking privacy policy

Abstract

To provide a processor or the like that makes it possible to revoke a privacy policy having once been agreed to.SOLUTION: A processor comprises: a memory unit that stores a consent log that allows application of a privacy policy regarding use of personal information based on a user's operation; a display unit that displays an application status of the privacy policy via a management screen; and a control unit that controls the application of the privacy policy depending on whether or not the consent log is stored. The control unit erases the consent log from the memory unit when a revocation instruction to deny the application of the privacy policy is received via the management screen in a state where the application of the privacy policy is allowed.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to a processing device and the like. [Background technology]

[0002] With the establishment of laws such as the Personal Information Protection Act, users of devices are now required to consent to privacy policies that stipulate how personal information is handled when they start using the device. Privacy policies are notified, published, etc. by businesses (device vendors) that handle personal information. By accepting consent to the privacy policy from users, businesses can use personal information acquired through devices.

[0003] For example, Patent Document 1 discloses an information processing device capable of displaying a notification screen on which a button for agreeing to the privacy policy is displayed together with notification contents regarding the privacy policy. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-101913 A Summary of the Invention [Problem to be solved by the invention]

[0005] The present disclosure aims to provide a processing device or the like that allows a privacy policy that has once been agreed to to be revoked. [Means for solving the problem]

[0006] In order to solve the above problem, the processing device of the present disclosure comprises a memory unit that stores a consent log that allows the application of a privacy policy regarding the use of personal information based on a user's operation, a display unit that displays the application status of the privacy policy via a management screen, and a control unit that controls the application of the privacy policy depending on whether or not the consent log is stored, and is characterized in that when the control unit receives a revocation instruction via the management screen to deny the application of the privacy policy when the application of the privacy policy is allowed, it erases the consent log from the memory unit.

[0007] In addition, the method of revoking a privacy policy according to the present disclosure is characterized in that, based on a user's operation, a consent log that allows the application of the privacy policy regarding the use of personal information is stored in a storage device, the application status of the privacy policy is displayed via a management screen, the application of the privacy policy is controlled depending on whether or not the consent log is stored, and when a revocation instruction to deny the application of the privacy policy is received via the management screen while the privacy policy is applied, the consent log is erased from the storage device.

[0008] In addition, the processing device according to the present disclosure includes a control unit that applies a privacy policy based on a user's consent to the privacy policy regarding the use of personal information, and a display unit that displays the user's consent status to the privacy policy via a management screen, and the control unit is characterized in that when a cancellation instruction to cancel the privacy policy is received via the management screen while the privacy policy is in a state in which the privacy policy has been applied, the control unit terminates the application of the privacy policy. Effect of the Invention

[0009] According to the present disclosure, it is possible to provide a processing device or the like that allows a privacy policy that has once been agreed to to be revoked. [Brief description of the drawings]

[0010] [Figure 1] 1 is an external perspective view of a multifunction peripheral according to a first embodiment; [Diagram 2] FIG. 2 is a functional configuration diagram of the multifunction peripheral according to the first embodiment. [Diagram 3] 4 is a flowchart illustrating a process flow according to the first embodiment. [Figure 4] FIG. 13 is a diagram illustrating a consent log management table. [Diagram 5] 4 is a flowchart illustrating a process flow according to the first embodiment. [Figure 6] FIG. 4 is a diagram illustrating an operation example according to the first embodiment. [Figure 7] FIG. 4 is a diagram illustrating an operation example according to the first embodiment. [Figure 8] FIG. 4 is a diagram illustrating an operation example according to the first embodiment. [Figure 9] FIG. 4 is a diagram illustrating an operation example according to the first embodiment. [Figure 10] FIG. 4 is a diagram illustrating an operation example according to the first embodiment. [Figure 11] FIG. 4 is a diagram illustrating an operation example according to the first embodiment. [Figure 12] 10 is a flowchart illustrating a process flow according to the second embodiment. [Figure 13] 13 is a flowchart illustrating a process flow according to the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings. In this disclosure, for example, a multifunction peripheral capable of executing jobs related to copying, faxing, image transmission, etc. in a single housing will be described as one form of an image processing device that implements a processing device according to the present disclosure. Note that the following embodiment is an example for explaining the present disclosure, and the technical scope of the description described in the claims is not limited to the following description.

[0012] 2. Description of the Related Art With the establishment of laws such as the Personal Information Protection Act, users of devices are now required to consent to privacy policies that set out guidelines for handling personal information when they start using the devices.

[0013] In particular, Europe is currently considering legislation that would make security measures mandatory for consumer IoT products, and businesses that manufacture and sell IoT products for Europe will need to comply with this legislation.

[0014] For example, the UK IoT Security Act, which has a compliance deadline of December 2023, is being developed based on the European standard (EN 306 645).

[0015] The European standard (EN 306 645) stipulates the following provisions regarding indicating consent status to a privacy policy / withdrawing consent: Provision 6.2 Where personal information is processed on the basis of the consumer's consent, this consent must be obtained in a valid manner. Provision 6.3 Consumers who have provided consent to the processing of their personal data must be able to withdraw that consent at any time.

[0016] As disclosed in Patent Document 1, up until now, consent to a privacy policy has been obtained by notifying the user of the privacy policy via a notification screen that displays the privacy policy content along with a button to agree to the privacy policy. However, if a user requests to revoke a privacy policy that they had once consented to, it has not been possible to revoke consent to that privacy policy.

[0017] In addition, although it may be possible to disable the application of personal information, since you still agree to the privacy policy, it is not possible to eliminate the possibility that some of your personal information may be used.

[0018] In the present disclosure, the following embodiments realize a processing device etc. that allows a privacy policy that has once been agreed to to be revoked and that can prevent unintended use of personal information upon revocation of the privacy policy.

[0019] [1 First embodiment] [1.1 Functional configuration] The functional configuration of a multifunction device 10 according to a first embodiment will be described with reference to Fig. 1 and Fig. 2. Fig. 1 is an external perspective view for explaining the overall configuration of the multifunction device 10. Fig. 2 is a functional configuration diagram of the multifunction device 10 equipped with a processing device 1 according to the present disclosure. In addition to the configuration of the processing device 1 shown in a dotted line frame in Fig. 2, the multifunction device 10 also includes an image processing unit 21 and an image input unit 23.

[0020] The control unit 11 controls the entire processing device 1 and the multifunction device 10. The control unit 11 is configured, for example, with one or more arithmetic units (CPUs (Central Processing Units) and the like). The control unit 11 realizes its functions by reading and executing various programs stored in the storage unit 19.

[0021] The display unit 13 is a display device that displays various information to a user, etc. The display unit 13 can be configured, for example, by an LCD, an organic EL (Electro-luminescence) display, or the like.

[0022] The operation input unit 15 accepts information input by a user or the like. The operation input unit 15 can be configured with various input devices such as operation keys such as hard keys and software keys, and buttons. The operation input unit 15 can be configured as a touch panel display that allows input via the display unit 13. In this case, the input method of the touch panel can be a general method such as a resistive film method, an infrared method, an electromagnetic induction method, or a capacitive method.

[0023] The communication unit 17 includes a wired / wireless interface or both for communicating with other devices (not shown) via a network NW such as a LAN (Local area network), a WAN (Wide area network), the Internet, a telephone line, a fax line, etc. The communication unit 17 may also include an interface related to (short-distance) wireless communication technology such as Bluetooth (registered trademark), NFC (Near field communication), Wi-Fi (registered trademark), ZigBee (registered trademark), Irda, wireless USB, etc.

[0024] The storage unit 19 stores various programs and various data necessary for the operation of the processing device 1 and the multifunction device 10. The storage unit 19 can be configured with one or more storage devices (memories), such as, for example, a RAM (Random access memory), an HDD (Hard disk drive), an SSD (Solid state drive), and a ROM (Read only memory).

[0025] In the first embodiment, the memory unit 19 stores a control program 191, a display processing program 192, an agreement log related program 193, a policy application program 194, a personal information processing program 195, and an authentication program 196, and reserves an agreement log memory area 197 and a personal information memory area 198.

[0026] The control program 191 is a program that is read by the control unit 11 in order to comprehensively control the processing device 1 and the entire multifunction device 10. The control unit 11 that has read the control program 191 can realize functions that the multifunction device 10 performs as jobs, such as copying, faxing, and image data transmission, by controlling the display unit 13, the operation input unit 15, the communication unit 17, the image processing unit 21, or the image input unit 23.

[0027] The display processing program 192 is a program that the control unit 11 reads out when displaying a home screen, a privacy policy consent screen, a privacy policy management screen, etc., which will be described later, on the display unit 13. The control unit 11 that reads out the display processing program 192 displays the home screen, the privacy policy consent screen, the privacy policy management screen, etc., on the display unit 13 by using image content (not shown) stored in the storage unit 19.

[0028] The consent log-related program 193 is a program that the control unit 11 reads out when generating a consent log that reflects the user's intention to accept the application of the privacy policy. In this disclosure, the user's intention, operation, behavior, etc. to accept the application of a privacy policy established by a business operator regarding the handling of personal information (identification information for identifying a user, information on a job performed by a user identified by the user identification information, etc.) is referred to as "consent" or "agree". The control unit 11 that reads out the consent log-related program 193 generates a privacy policy consent screen according to the application status of the privacy policy. The privacy policy consent screen can include, in addition to a main text display area that displays specific contents of the privacy policy such as the definition of personal information, the purpose of use of personal information, the possibility of providing personal information to a third party, and the possibility of joint use of personal information, a selection button (for example, an "Agree" button) that a user who has confirmed the contents of the privacy policy can select, a check box, etc. The control unit 11 determines that consent to accept the application of the privacy policy has been obtained by accepting a user's operation on the privacy policy consent screen, i.e., a selection instruction of a selection button by the user. The control unit 11, which has obtained consent from the user, generates a consent log and stores it in the consent log storage area 197 of the storage unit 19. Note that consent from the user may be obtained, for example, by the business entity managing the multifunction device 10 receiving a document by mail or e-mail indicating that the user has agreed to the privacy policy, in addition to the selection of a selection button or the like. In this case, the business entity may transmit the generated consent log to the multifunction device 10 and store it in the consent log storage area 197.

[0029] Furthermore, when the control unit 11 that has read out the consent log related program 193 receives a revocation instruction to reject the application of the privacy policy via a privacy policy management screen described below in a state in which the application of the privacy policy is permitted, the control unit 11 erases the consent log from the consent log storage area 197. In the present disclosure, the intention, operation, or action of the user to reverse (reject) the application of the privacy policy that has already been consented to is referred to as "revocation" or "withdrawing".

[0030] The policy application program 194 is a program that the control unit 11 reads out when controlling the application or non-application (cancellation) of a privacy policy to personal information. The control unit 11 that reads out the policy application program 194 controls the application or non-application (cancellation) of a privacy policy depending on whether or not a consent log is stored in the consent log storage area 197.

[0031] The personal information processing program 195 is a program that the control unit 11 reads out when controlling the processing of personal information to which the privacy policy is applied in association with the deletion of the consent log. In the first embodiment, the control unit 11 that reads out the personal information processing program 195 deletes the personal information to be deleted from the personal information storage area 198 of the storage unit 19.

[0032] The authentication program 196 is a program that the control unit 11 reads out when authenticating a user attempting to log in to the multifunction device 10. The control unit 11 that reads out the authentication program 196 functions as an authentication unit, and when the user authentication function is enabled, displays a login screen (not shown) on the display unit 13 and accepts input of a login user name and a login password. The control unit 11 can perform login authentication of a user by previously storing a login user name and a login password related to the user authentication in association with each other, and checking the login user name and the login password input via the login screen. At this time, the control unit 11 determines whether the login user is an administrator user having administrator authority for the multifunction device 10 or a general user who is only authorized to use the multifunction device 10, based on the user authentication result. Note that the login authentication can be performed by, in addition to knowledge authentication based on input of a login user name and a login password, for example, possession authentication using a token, a key, an IC (Integrated Circuit) card, a smartphone, or biometric authentication such as face authentication or fingerprint authentication.

[0033] The consent log storage area 197 is a storage area for storing the consent log generated by the control unit 11 that reads out the consent log related program 193.

[0034] The personal information storage area 198 is a storage area for storing personal information (such as identification information for identifying a user and information related to a job executed by a user identified by the user identification information).

[0035] [1.2 Processing flow] Next, the flow of processing according to the first embodiment will be described. Fig. 3 is a flowchart illustrating the flow of processing from device startup of the multifunction device 10 to obtaining consent to the privacy policy. The processing described in Fig. 3 is executed by the control unit 11 reading out the control program 191, the display processing program 192, the consent log related program 193, the authentication program 196, and the like.

[0036] The control unit 11 judges whether or not the device startup instruction input has been received (step S10). If it is judged that the device startup instruction input has been received, the control unit 11 starts the device startup process (step S10; Yes->step S12). If it is judged that the device startup instruction input has not been received, the control unit 11 waits until the device startup instruction input is received (step S10; No).

[0037] Next, the control unit 11 determines the application status of the privacy policy (step S14). In this case, the control unit 11 determines the application status of the privacy policy based on the storage status of the consent log in the consent log storage area 197. If it is determined that the privacy policy has been applied, the control unit 11 displays a home screen (described later) on the display unit 13 and ends the process (step S16; Yes → step S18).

[0038] On the other hand, when it is determined that the privacy policy has not been applied, the control unit 11 displays a privacy policy consent screen (step S16; No→step S20).

[0039] Next, the control unit 11 determines whether or not an instruction to consent has been received from the user via the privacy policy consent screen (step S22).

[0040] When the control unit 11 determines that the consent instruction from the user has been received, the control unit 11 stores the generated consent log in the consent log storage area 197 (step S22→step S24). When the control unit 11 determines that the consent instruction from the user has not been received, the control unit 11 continues to display the privacy policy consent screen (step S22; No→step S20).

[0041] After storing the consent log, the control unit 11 displays the privacy policy management screen on the display unit 13 (step S24->step S26). Then, the control unit 11 judges whether or not an instruction to end the display of the privacy policy management screen has been received (step S28). If it is judged that an instruction to end the display of the privacy policy management screen has been received, the control unit 11 displays the home screen on the display unit 13 and ends the process (step S28; Yes->step S18). On the other hand, if it is judged that an instruction to end the display of the privacy policy management screen has not been received, the control unit 11 continues to display the privacy policy management screen (step S28; No->step S26).

[0042] Here, the consent log management table for managing the consent log will be described with reference to Fig. 4. The consent log management table illustrated in Fig. 4(a) and Fig. 4(b) includes, as management items, a user name, a user ID, an authority, a consent log name, and a policy consent date and time. Note that the consent log may be managed in a form other than the table described below, for example, a database.

[0043] The user name indicates the user name of the user who uses the multifunction device 10. The user ID is an identifier for uniquely identifying the user. The authority indicates the authority granted to the user. The consent log name indicates the file name of the consent log. The policy consent date and time indicates the date and time when the user consented to the privacy policy.

[0044] FIG. 4(a) is a diagram for explaining an example of a data configuration of a consent log management table that manages a consent log that is generated when an administrator user with administrator authority consents to a privacy policy. In the present disclosure, when an administrator user (User01) with administrator authority consents to a privacy policy, all users (User02, User03, User04) who use the multifunction device 10, including the administrator user (User01), also consent to the privacy policy (collective consent). In this case, consent to the privacy policy also applies to general users and non-logged-in users who will be registered later. Note that the administrator user can also individually give consent to general users, including the administrator himself and non-logged-in users.

[0045] In Figure 4(a), the administrator user (User01) agreed to the privacy policy at 10:50 on 2023 / 02 / 06, which indicates that all users other than the administrator user (User01) agreed to the privacy policy on the same date and time.

[0046] In addition, there are no particular restrictions on the file format of the text file represented by the consent log name, as long as it is in a format that can record that the corresponding user has agreed to the privacy policy, and it may be a flag indicating whether or not the user has agreed.

[0047] On the other hand, FIG. 4(b) is a diagram for explaining an example of a data configuration example of a consent log management table that manages a consent log generated when a general user consents to a privacy policy. In the present disclosure, a general user who is only authorized to use the multifunction device 10 can consent only to his / her own privacy policy. FIG. 4(b) shows, for example, that a general user (User02) consents to his / her own privacy policy (agreement date and time: 2023 / 02 / 06 10:55), and general users (User03) and (User04) do not consent to their own privacy policies, and consent logs are not generated (not stored).

[0048] Next, the consent withdrawal process according to the first embodiment will be described with reference to the flowchart in Fig. 5. The process described in Fig. 5 is executed by the control unit 11 reading out the control program 191, the display processing program 192, the consent log related program 193, the policy application program 194, the personal information processing program 195, the authentication program 196, and the like.

[0049] The control unit 11 determines whether or not a request to revoke the privacy policy has been accepted via, for example, a home screen or the like (step S30). If it is determined that a request to revoke the privacy policy has been accepted, the control unit 11 displays a privacy policy management screen on the display unit 13 (step S30; Yes -> step S32). If it is determined that a request to revoke the privacy policy has not been accepted, the control unit 11 waits until a request to revoke the privacy policy is accepted (step S30; No).

[0050] Next, the control unit 11 judges whether or not an instruction to revoke the privacy policy has been received via the privacy policy management screen (step S34). If it is judged that an instruction to revoke the privacy policy has been received, the control unit 11 erases the corresponding consent log from the consent log storage area 197 (step S36). If it is judged that an instruction to revoke the privacy policy has not been received, the control unit 11 continues to display the privacy policy management screen (step S34; No -> step S32).

[0051] With the deletion of the consent log in step S36, the control unit 11 makes the privacy policy non-applicable (cancels it).

[0052] Next, the control unit 11 displays a personal information erasure function screen described later on the display unit 13 (step S38), and determines whether or not a check box has been checked on the personal information erasure function screen to confirm the contents of the data not to be erased, which is personal information that is not to be erased.

[0053] The control unit 11 determines whether or not the contents of the data not to be erased have been confirmed via a data not to be erased confirmation screen that is displayed when a check box for confirming the contents of the data not to be erased is checked (step S40).

[0054] If the control unit 11 determines that the user has not checked the checkbox confirming the contents of the data not to be erased and the contents of the data not to be erased have not been confirmed via the data not to be erased confirmation screen, it erases the data to be erased, which is the personal information to be erased, and terminates the process (step S40; No → step S46).

[0055] On the other hand, when the control unit 11 determines that the user has checked the checkbox for confirming the contents of the data not to be erased and confirmed the contents of the data not to be erased via the data not to be erased confirmation screen, the control unit 11 determines whether or not the user has selected to leave the data not to be erased (step S40; Yes → step S42). When the user has determined that the data not to be erased is to be left, the control unit 11 does not erase the data not to be erased, but erases the data to be erased, and ends the process (step S42; Yes → step S46). On the other hand, when the user has determined that the data not to be erased is not to be left, the control unit 11 erases the data specified as the data not to be erased (step S42; No → step S44). Then, the control unit 11 erases the data to be erased, and ends the process (step S46).

[0056] [1.3 Example of operation] Next, an operation example according to the first embodiment will be described. Fig. 6 is a diagram for explaining a display configuration example of a privacy policy consent screen displayed by the control unit 11 when a privacy policy is not applied. Note that the operation example described in Fig. 6 is an operation example corresponding to the process of step S20 in Fig. 3.

[0057] 6(a) is an example of a display configuration example of a privacy policy consent screen W10 displayed by the control unit 11 when the logged-in user is an administrator user having administrator authority. The privacy policy consent screen W10 includes a privacy policy text display area R10, a collective consent button B10, and a user-specific consent button B12.

[0058] The privacy policy text display area R10 is a display area that displays the specific contents of the privacy policy, such as the definition of personal information, the purpose of use of personal information, the possibility of providing personal information to third parties, and the possibility of joint use of personal information.

[0059] The collective consent button B10 is a button for accepting consent to the privacy policy from all users who use the multifunction device 10, including the administrator user. When the collective consent button B10 is selected by the administrator user, the control unit 11 generates a consent log for all users and stores it in the consent log storage area 197 (see FIG. 4(a)). The user-specific consent button B12 is a button for individually accepting consent related to the administrator himself and general users, including non-logged-in users. When the administrator user selects the user-specific consent button B12, the control unit 11 displays a selection screen (not shown) for accepting the selection of users who agree to the privacy policy, and accepts consent for each user. When the control unit 11 accepts consent, it generates a consent log for each user and stores it in the consent log storage area 197.

[0060] 6(b) is an example of a display configuration example of the privacy policy consent screen W12 displayed by the control unit 11 when the logged-in user is a general user who is only authorized to use the multifunction device 10. The privacy policy consent screen W12 includes a privacy policy text display area R10 and an Agree button B14.

[0061] The privacy policy text display area R10 is the same as the privacy policy text display area R10 related to the privacy policy consent screen W10, so a description thereof will be omitted here.

[0062] The Agree button B14 is a button for accepting consent to the privacy policy from a general user. When the Agree button B14 is selected by a general user, the control unit 11 generates a consent log for the general user and stores it in the consent log storage area 197 (see FIG. 4(b)).

[0063] 6, in the present disclosure, the display configuration of the privacy policy consent screen displayed on the display unit 13 can be switched depending on the authority of the user who logs in to the multifunction device 10. Therefore, the range of users who are to consent can be flexibly set depending on the authority of the user who intends to consent.

[0064] Fig. 7 is a diagram for explaining a display configuration example of a home screen W20 that can accept a request to withdraw a privacy policy. The home screen W20 illustrated in Fig. 7 is displayed on the display unit 13, for example, when the power is turned on, when the device is in standby mode, when the device is restored from a sleep state, or when an instruction to end the display of a specific setting screen is input on the display unit 13, and can be configured as a basic screen that accepts operation inputs by a user. Such a home screen W20 includes a device function selection button area R12, a system information display button B18, and a job status button B20.

[0065] The device function selection button area R12 includes selection buttons that represent settings related to device functions such as image input / output, communication, job-related, or maintenance, and various information using icons consisting of figures, letters, numbers, symbols, etc. Fig. 7 shows an example of the device function selection button area R12 that is configured with a copy button, a fax button, a scan button, an email button, a history information button, an external address book button, a scan and save button, and a privacy policy button. The privacy policy button B16 is a selection button that receives an instruction to display a privacy policy management screen described in the next figure as an example of an input means for a request to cancel a privacy policy.

[0066] The system information display button B18 is a button for accepting an instruction to display a system setting screen (not shown) related to accepting device settings of the multifunction device 10 and displaying the device configuration, device status, etc. The job status button B20 is a button for accepting an instruction to display a job list screen (not shown) that shows the progress of a job, etc.

[0067] Incidentally, FIG. 7 shows an example in which the privacy policy button B16 is displayed in the device function selection button area R12, but it is of course also possible for the privacy policy button B16 to be displayed in the same position as the system information display button B18 or the job status button B20, in place of these buttons.

[0068] Fig. 8 is a diagram illustrating a display configuration example of a privacy policy management screen W30 that the control unit 11 displays on the display unit 13 when the privacy policy button B16 on the home screen W20 illustrated in Fig. 7 is selected by the user. Note that the operation example described in Fig. 8 is an operation example corresponding to the process of step S32 in Fig. 5.

[0069] The privacy policy management screen W30 is a screen for managing the consent status for the privacy policy. The privacy policy management screen W30 includes a log information display area R14 and a withdrawal button B22. The log information display area R14 is a display area that displays information related to the consent date and time of consent to the privacy policy and the consenting user name as log information, among the management items managed in the consent log management table illustrated in FIG. 4. FIG. 8 is an example of displaying log information based on consent dated 2023 / 02 / 06 10:50 for the user name: User01 (administrator user) in FIG. 4(a) or FIG. 4(b). Note that the management items (log information) displayed in the log information display area R14 are not limited to the example in FIG. 8, and can be set and changed as appropriate.

[0070] The cancel button B22 is a button that accepts an instruction to cancel consent to the display in the log information display area R14. When the user selects the cancel button B22, the control unit 11 erases the consent log from the consent log storage area 197 and makes the privacy policy non-applicable (cancels it). Next, the control unit 11 transitions the screen to a personal information deletion function screen, which will be described in the next figure.

[0071] Fig. 9 is a diagram for explaining a display configuration example of a personal information erasing function screen that the control unit 11 displays on the display unit 13 when the user selects the cancel button B22 on the privacy policy management screen W30 illustrated in Fig. 8. Note that the operation example explained in Fig. 9 is an operation example corresponding to the processing of step S38 in Fig. 5.

[0072] 9(a) is an example of a display configuration example of a personal information erasure function screen W40 displayed by the control unit 11 when the logged-in user is an administrator user having administrator authority. The personal information erasure function screen W40 includes a check box T10 for confirming the contents of data not to be erased, an erase all button B24, an erase by user button B26, and a data to be erased / not to be erased display area R16.

[0073] The check box T10 for confirming the contents of data not to be erased is a check box that accepts the selection of whether to enable or disable the display of the data not to be erased confirmation screen W50, which will be described in the next figure. When the user checks the check box T10 for confirming the contents of data not to be erased and selects either the erase all button B24 or the erase by user button B26, the control unit 11 displays the data not to be erased confirmation screen W50 on the display unit 13.

[0074] The Erase All button B24 is a button for accepting an instruction to erase all data, except for the data to be erased exemplified in the data to be erased / not to be erased display area R16 and the data specified as data not to be erased, described later, regardless of the user. When the Erase All button B24 is selected, the control unit 11 collectively erases all data, except for the data to be erased of general users including the administrator and non-login users, and the data specified as data not to be erased via the data not to be erased confirmation screen W50. The Erase by User button B26 is a button for accepting an instruction to erase data, except for the data to be erased and the data not to be erased, for each user. When the Erase by User button B26 is selected, the control unit 11 displays a selection screen (not shown) for accepting the selection of the user related to data erasure, and accepts the instruction to erase for each user.

[0075] The display area R16 of data to be erased and data not to be erased is a display area that displays examples of personal information to be erased (data to be erased) and examples of personal information not to be erased (data not to be erased). In the present disclosure, examples of personal information to be erased when a privacy policy is revoked include data in a personal folder, an address book (excluding data disclosed to other users), transmission and reception history, operation history, scan data, copy data, and fax data. On the other hand, examples of personal information not to be erased when erasing personal information when a privacy policy is revoked include data in a shared folder as a shared storage area, an address book (disclosed to other users), and data specified by an administrator user. In the present disclosure, as personal information not to be erased, information that is common (shared) between the user who revoked consent (regardless of whether the user is an administrator user or a general user) and other users other than the user is left as personal information not to be erased, thereby preventing the convenience of other users from being impaired when personal information is erased.

[0076] 9(b) is an example of a display configuration example of a personal information erasing function screen W42 displayed by the control unit 11 when the logged-in user is a general user who has been granted only the authority to use the multifunction device 10. The personal information erasing function screen W42 includes a check box T10 for confirming the contents of data not to be erased, an erase button B28, and a data to be erased / not to be erased display area R16.

[0077] The check box T10 for checking the contents of data not to be erased and the area R16 for displaying data to be erased and data not to be erased are the same as the check box T10 for checking the contents of data to be erased and the area R16 for displaying data to be erased and data not to be erased on the personal information erasure function screen W40, and therefore will not be described here.

[0078] The erase button B28 is a button for accepting an instruction to erase data other than data designated as data to be erased related to general users and data not to be erased.

[0079] It should be noted that the data to be erased / not to be erased display area R16 does not necessarily need to be provided on the personal information erasure function screen W40 or the personal information erasure function screen W42, and it may be omitted if there are restrictions on the display area of ​​the screen.

[0080] Fig. 10 is a diagram illustrating an example of the display configuration of a non-erasable data confirmation screen W50 displayed by the control unit 11 when a check is placed in a check box T10 for confirming the contents of non-erasable data by a user and any one of the all-erasure button B24, the per-user erasure button B26, or the erasure button B28 is selected. Note that the example of operation described in Fig. 10 corresponds to the processing of step S40 in Fig. 5.

[0081] The non-erasing data confirmation screen W50 includes a "keep data" button B30 and a non-erasing data display area R18.

[0082] The non-erasable data display area R18 is a display area that displays personal information that is not to be erased. Here, personal information designated by the administrator user in the erasure prohibition setting is excluded from the personal information to be erased because access to the personal information itself is prohibited. Data in the shared folder is excluded from the personal information to be erased because it is personal information that is highly common (shared) between the user who retracts consent to the privacy policy and other users other than the user. It is preferable that the data in the shared folder is configured so that, for example, thumbnails of the files are displayed, the files can be opened and checked, and the data can be deleted individually. The address book (disclosed to other users) is excluded from the personal information to be erased because it is personal information that is highly common (shared) with other users. It is preferable that the address book is configured so that the published addresses are displayed in a list, the address book can be accessed individually from the destination link, and the addresses can be deleted individually, as shown in the example of FIG. 10.

[0083] The Keep Data button B30 is a button that accepts a user's selection when the personal information displayed in the non-erasable data display area R18 is to be kept as non-erasable data. When the Keep Data button B30 is selected by the user, the control unit 11 accepts the designation of the personal information displayed in the non-erasable data display area R18 as non-erasable data. Then, the control unit 11 starts erasing the non-erasable data and other non-erasable data.

[0084] 11 is a diagram illustrating an example of the display configuration of a setting screen W60 that accepts erasure prohibition settings by an administrator user. The setting screen W60 includes an execute button B30 and an erasure prohibition setting area R20.

[0085] The execute button B30 is a button for accepting a confirmation instruction for setting personal information (data not subject to erasure) that is prohibited from being erased when the privacy policy is revoked.

[0086] The erasure prohibition setting area R20 is an area for accepting the selection of data not to be erased. Fig. 11 shows an example of a configuration in which data in a shared folder and an address book (disclosed to other users) can be selected as data not to be erased that is prohibited from being erased when a privacy policy is revoked. The administrator user can set data not to be erased by checking the checkboxes for either or both of the data in the shared folder and the address book (disclosed to other users) as data not to be erased and selecting the execute button B30.

[0087] In this way, the administrator user can pre-set via the settings screen W60 the personal information that is prohibited from being erased when the privacy policy is revoked, thereby preventing personal information that the user does not want erased from being inadvertently erased when the privacy policy is revoked.

[0088] As described above, according to the first embodiment, even if a user has once agreed to a privacy policy, the user can withdraw the agreed privacy policy. Furthermore, when the privacy policy is withdrawn, personal information (data to be deleted) other than personal information set as personal information prohibited from being deleted (data not to be deleted) is deleted, so that the personal information is not used or provided to a third party, and a certain level of security can be ensured.

[0089] [2 Second embodiment] The second embodiment is a form in which, in the first embodiment, when the privacy policy is revoked, the data to be erased is encrypted to prevent personal information from being used or provided to a third party.

[0090] [2.1 Functional configuration] The functional configuration of the multifunction device according to the second embodiment can be made substantially equivalent to the functional configuration of the multifunction device 10 according to the first embodiment, except for the personal information processing program 195, and therefore the same symbols are used and the explanation is omitted here.

[0091] The control unit 11 that reads out the personal information processing program 195 according to the second embodiment encrypts the personal information to be erased that is stored in the personal information storage area 198 using an encryption method such as a common key encryption method, a public key encryption method, or a hybrid encryption method.

[0092] [2.2 Processing flow] The process from the startup of the multifunction device 10 to obtaining consent to the privacy policy in the second embodiment can be the same as the process described in Fig. 3 in the first embodiment, so a description thereof will be omitted here. The consent withdrawal process in the second embodiment will be described by replacing the flowchart in Fig. 5 in the first embodiment with the flowchart in Fig. 12. Note that the same processes as those in the flowchart in Fig. 5 are given the same step numbers and their description will be omitted.

[0093] The control unit 11 displays a personal information erasure screen on the display unit 13 (step S38), and determines whether or not a check box for confirming the contents of data not to be erased has been checked on the personal information erasure screen.

[0094] The control unit 11 determines whether or not the contents of the data not to be erased have been confirmed via a data not to be erased confirmation screen that is displayed when a check box for confirming the contents of the data not to be erased is checked (step S40).

[0095] If the control unit 11 determines that the user has not checked the checkbox confirming the contents of the data not to be erased and the contents of the data not to be erased have not been confirmed via the data not to be erased confirmation screen, it encrypts the data to be erased and terminates the process (step S40; No → step S52).

[0096] On the other hand, when the control unit 11 determines that the user has checked the checkbox for confirming the contents of the data not to be erased and confirmed the contents of the data not to be erased via the data not to be erased confirmation screen, the control unit 11 determines whether or not the user has selected to leave the data not to be erased (step S40; Yes → step S42). When the user has determined that the data not to be erased is to be left, the control unit 11 does not encrypt the data not to be erased, but encrypts the data to be erased and ends the process (step S42; Yes → step S52). On the other hand, when the user has determined that the data not to be erased is not to be left, the control unit 11 encrypts the data specified as the data not to be erased (step S42; No → step S50). Then, the control unit 11 encrypts the data to be erased and ends the process (step S52).

[0097] For example, if data designated as data to be erased or data not to be erased is encrypted using a common key cryptography method, the common key can be linked to the user's login authentication information, and if the user agrees to the privacy policy again, the data to be erased or data not to be erased that was encrypted using the linked common key can be decrypted.

[0098] As described above, according to the second embodiment, in addition to the effects of the first embodiment, if consent to the privacy policy is revoked and then consent is given again, it is possible to decrypt and use encrypted data designated as data to be erased or data not to be erased, thereby improving the convenience for users regarding the use of personal information.

[0099] [3 Third embodiment] The third embodiment is a form in which, in the first embodiment, when an instruction to revoke consent to a privacy policy is received, users other than the user who input the instruction to revoke are notified that the privacy policy has been revoked.

[0100] [3.1 Functional configuration] The functional configuration of the multifunction device according to the third embodiment can be substantially the same as the functional configuration of the multifunction device 10 according to the first embodiment, so the same reference numerals are used and the description thereof will be omitted here.

[0101] [3.2 Processing flow] The process from the startup of the multifunction device 10 to obtaining consent to the privacy policy in the third embodiment can be the same as the process described in Fig. 3 in the first embodiment, so a description thereof will be omitted here. The consent withdrawal process in the third embodiment will be described by replacing the flowchart in Fig. 5 in the first embodiment with the flowchart in Fig. 13. Note that the same processes as those in the flowchart in Fig. 5 are given the same step numbers and their description will be omitted.

[0102] The control unit 11 judges whether or not an instruction to revoke the privacy policy has been received via the privacy policy management screen (step S34). If it is judged that an instruction to revoke the privacy policy has been received, the control unit 11 judges whether or not the user who inputted the instruction to revoke the privacy policy is an administrator user (step S34; Yes→step S60).

[0103] If it is determined that the user who input the instruction to revoke the privacy policy is an administrator user, the control unit 11 notifies the general user that the privacy policy has been revoked, for example, by email (step S60; Yes → step S62).

[0104] On the other hand, if it is determined that the user who input the instruction to cancel the privacy policy is a general user and not an administrator user, the control unit 11 notifies the administrator user that the privacy policy has been canceled (step S60; No → step S64).

[0105] After being notified that the privacy policy has been revoked (step S62 or step S64), the control unit 11 erases the corresponding consent log from the consent log storage area 197 (step S36). If it is determined that the instruction to revoke the privacy policy has not been accepted, the control unit 11 continues to display the privacy policy management screen (step S34; No→step S32).

[0106] As described above, according to the third embodiment, when an administrator user revokes a privacy policy, general users are notified that the privacy policy has been revoked, and when a general user revokes a privacy policy, the administrator user is notified that the privacy policy has been revoked, so that all users of the multifunction device 10 can easily grasp the consent status of the privacy policy.

[0107] [4 Variations] The present disclosure is not limited to the above-described embodiments, and various modifications are possible. In other words, the technical scope of the present disclosure also includes embodiments obtained by combining technical means that are appropriately modified within the scope of the gist of the present disclosure.

[0108] Although the above-described embodiments are described separately for convenience of explanation, they may be combined and executed within a technically feasible range.

[0109] In addition, the programs that run on each device in the embodiments are programs that control the CPU and the like (programs that make a computer function) so as to realize the functions of the above-mentioned embodiments. Information handled by these devices is temporarily stored in a temporary storage device (e.g., RAM) during processing, and is then stored in various storage devices such as ROMs (Read Only Memories) and HDDs, and is read, modified, and written by the CPU as necessary.

[0110] Here, the recording medium for storing the program may be any of semiconductor media (e.g., ROM, non-volatile memory cards, etc.), optical recording media, magneto-optical recording media (e.g., DVD (Digital Versatile Disc), MO (Magneto Optical Disc), MD (Mini Disc), CD (Compact Disc), BD (Blu-ray (registered trademark) Disc, etc.)), magnetic recording media (e.g., magnetic tape, flexible disk, etc.), etc. Furthermore, not only are the functions of the above-mentioned embodiments realized by executing the loaded program, but the functions of the present disclosure may also be realized by processing in cooperation with an operating system or other application programs, etc., based on instructions from the program.

[0111] In addition, when distributing the program on the market, the program can be stored in a portable recording medium and distributed, or transferred to a server computer connected via a network such as the Internet. In this case, the storage device of the server computer is of course included in the present disclosure. [Explanation of symbols]

[0112] 1 Processing equipment 10 Multifunction device 11 Control section 13 Display section 15 Operation input section 17 Communications Department 19 Memory section 191 Control Program 192 Display Processing Program 193 Consent Log Related Programs 194 Policy Enforcement Program 195 Personal Information Processing Program 196 Certification Program 197 Consent log storage area 198 Personal information storage area 21 Image processing section 23 Image input section

Claims

1. a storage unit that stores a consent log that allows application of the privacy policy regarding the use of personal information based on an operation by a user; A display unit that displays the application status of the privacy policy via a management screen; a control unit that controls application of the privacy policy depending on whether the consent log is stored, The control unit is A processing device characterized in that, when the application of the privacy policy is permitted and a cancellation instruction to deny the application of the privacy policy is received via the management screen, the processing device erases the consent log from the memory unit.

2. The storage unit is storing said personal information; The control unit is 2. The processing device according to claim 1, further comprising: a processor for erasing the personal information from the storage unit when the consent log is erased.

3. The control unit is When an instruction to revoke the privacy policy is received from an administrator user having administrator authority of the processing device, 3. The processing device according to claim 2, wherein the consent logs relating to all the users of the processing device are erased, and the personal information of all the users stored in the processing device is erased from the storage unit.

4. The control unit is When an instruction to revoke the privacy policy is received from a general user who has the right to use the processing device, 3. The processing device according to claim 2, further comprising: deleting the consent log relating to the general user; and deleting the stored personal information of the general user from the storage unit.

5. The control unit is 3. The processing device according to claim 2, wherein the personal information that is not to be deleted from the storage unit is accepted via the management screen.

6. The processing device according to claim 5, characterized in that the personal information that is not to be erased from the memory unit includes information stored in a shared memory area available to the user of the processing device, a public address book, or information specified by the administrator user.

7. The storage unit is storing said personal information; The control unit is 2. The processing device according to claim 1, further comprising: encrypting the personal information when the consent log is deleted.

8. The control unit is The processing device according to claim 1, characterized in that when the application of the privacy policy is permitted and a cancellation instruction to deny the application of the privacy policy is received via the management screen, other users other than the user who input the cancellation instruction are notified that a cancellation instruction to cancel the privacy policy has been input.

9. storing a consent log in a storage device, the consent log indicating that the privacy policy regarding the use of personal information is applicable based on an operation by a user; Displaying the application status of the privacy policy via a management screen; Controlling application of the privacy policy depending on whether or not the consent log is stored; A method for revoking a privacy policy, characterized in that when the privacy policy is applied and a revocation instruction to deny application of the privacy policy is received via the management screen, the consent log is erased from the storage device.

10. A control unit that applies a privacy policy regarding the use of personal information based on a user's consent to the privacy policy; a display unit that displays a user's consent status to the privacy policy via a management screen; The control unit is The processing device is characterized in that, when a cancellation instruction to cancel the privacy policy is received via the management screen while the privacy policy is being applied, the processing device terminates application of the privacy policy.

Images