Privacy management system, privacy management method, and privacy management program

Abstract

To provide a privacy management system that reduces psychological suppression.SOLUTION: The present invention is a privacy management system that shares information among members. The privacy management system is configured to: store, for each member, display setting information for setting a disclosure condition of existence information on a member, search setting information for setting a range of information serving as a search object when searching for, and communication setting information for setting communication means communicatable among the members; set whether the existence information on the member stays open at all times, to disclose the existence information when a prescribed time condition is met, to disclose the existence information irregularly, or not to disclose the existence information and the like; search for by making a range of a search object different such as a prescribed range, a range narrower than the prescribed range, or only the existence information, or a non-search object and the like; and regarding communication between a communication source and a communication destination, set to permit the communication, to ask the communication source to separately communicate, to ask the communication destination to separately communicate, or not to permit the communication and the like.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a privacy management system, a privacy management method, and a privacy management program. [Background technology]

[0002] Recently, there are increasing cases of detailed personal information being disclosed and shared in information sharing systems such as virtual office tools, and the psychological burden on users is becoming an issue.

[0003] Patent Document 1 discloses a program that distributes the working status of users in a virtual office and enables them to view each other's status on their respective terminals. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2005-327197 A Summary of the Invention [Problem to be solved by the invention]

[0005] The above system takes into consideration the privacy of users by updating image data representing their work status at times specified by the user, but users cannot refuse delivery of their work status while logged in.

[0006] In the environment provided by such information sharing systems, there is a high possibility of inadvertent interference from others, which can lead to a loss of concentration on work and a violation of privacy. This can also lead to an increase in mental illnesses due to psychological pressure and obsessions from which there is no escape, and may induce crimes in the office (harassment, stalking, etc.). In particular, in recent years, virtual offices have become more realistic due to improvements in metaverse technology, making it even more important to ensure safety by protecting privacy.

[0007] The present invention has been made in consideration of the above-mentioned points, and has an object to provide an environment capable of reducing psychological oppression and burden in a system in which multiple people share information. [Means for solving the problem]

[0008] The present application includes a number of means for solving at least part of the above problems, examples of which are as follows.

[0009] In order to solve the above problem, one aspect of the present invention is a privacy management system in which a plurality of members participate and share information among the members, comprising: a memory unit that stores, for each member, presence setting information for setting the conditions for disclosing the presence information of the member, search setting information for setting the range of information to be searched during a search, and contact setting information for setting a means of communication by which the members can communicate with each other; a display setting unit that uses the presence setting information to set whether the presence information of the member is to be always disclosed, disclosed when a predetermined time condition is met, disclosed irregularly, or not disclosed; a search processing unit that uses the search setting information to search the information of the member by changing the search range to a predetermined range, a range narrower than the predetermined range, or only presence information, or not to be searched; and a contact means setting unit that uses the contact setting information to set, with regard to communication between a contact source and a contact, whether to allow communication, to request a separate contact from the contact source, to request a separate contact from the contact, to temporarily prohibit communication, or to always prohibit communication, etc.

[0010] The time condition may further include a condition for specifying a time period during which the presence information is to be made public, and the display setting unit may determine whether to make the presence information public, private, or limited to public during that time period.

[0011] The memory unit may store personal information identifying attributes of the member, and the display setting unit may set the presence information to be public, private, or limited to public for members whose attributes meet specified conditions.

[0012] The personal information may include working conditions.

[0013] The memory unit may store a search level that determines whether the member's presence information and personal information should be made public, private, or limited to public, and the display setting unit may decide whether each piece of information should be made public, private, or limited to public depending on the search level.

[0014] The communication means setting section may set the communication means desired by the member to be contacted or the communication means desired by the member making the contact as the communication means between the two members.

[0015] The communication means may include video calls, voice conversations, messages, image sharing, and the like.

[0016] Another aspect of the present invention is a privacy management method that supports information processing in which a plurality of members participate and share information among the members, in which an arithmetic device of an information processing device performs a display setting step using presence setting information that sets the disclosure conditions of the member's presence information for each of the members to set whether the member's presence information is to be made public at all times, made public when a specified time condition is met, made public irregularly, or not made public; a search processing step using search setting information that sets the range of information to be searched during a search to search the member's information by varying the search range to a specified range, a range narrower than the specified range, or presence information only, or not to be searched at all, etc.; and a contact means setting step using contact setting information that sets a contact means by which the members can contact each other to set, with regard to contact between a contact source and a contact, whether to allow contact, to request a separate contact from the contact source, to request a separate contact from the contact, to temporarily disallow contact, or to always disallow contact, etc.

[0017] Another aspect of the present invention is a privacy management program for an information processing device in which a plurality of members participate and share information among themselves, the program causing the information processing device to execute the following: a display setting unit that uses presence setting information that sets the conditions for disclosing the presence information of the member for each of the members to set whether the presence information of the member is to be made public at all times, when a specified time condition is met, whether it is to be made public irregularly, or not to be made public, etc.; a search processing unit that uses search setting information that sets the range of information to be searched during a search to search the information of the member by varying the search range to a specified range, a range narrower than the specified range, or only presence information, or not to be searched, etc.; and a contact means setting unit that uses contact setting information that sets a contact means by which the members can contact each other to set, with regard to contact between a contact source and a contact, whether to allow contact, to request a separate contact from the contact source, to request a separate contact from the contact, to temporarily disallow contact, or to always disallow contact, etc. Effect of the Invention

[0018] According to the present invention, it is possible to provide a privacy management system (information processing system) that reduces psychological oppression and burden.

[0019] Problems, configurations, effects, and the like other than those described above will become apparent from the description of the following embodiments. [Brief description of the drawings]

[0020] [Figure 1] FIG. 1 is a diagram showing an example of an overview of a privacy management system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a functional block diagram of a privacy management system according to an embodiment of the present invention. [Diagram 3] FIG. 3 is a diagram showing an example of the presence information according to one embodiment of the present invention. [Figure 4]FIG. 4 is a diagram showing an example of user information according to an embodiment of the present invention. [Diagram 5] FIG. 5 is a diagram showing an example of the presence setting information according to an embodiment of the present invention. [Figure 6] FIG. 6 is a diagram showing an example of display setting information according to an embodiment of the present invention. [Figure 7] FIG. 7 is a diagram showing an example of search setting information according to an embodiment of the present invention. [Figure 8] FIG. 8 is a diagram showing an example of search level setting information according to an embodiment of the present invention. [Figure 9] FIG. 9 is a diagram showing an example of contact setting information according to an embodiment of the present invention. [Figure 10] FIG. 10 is a diagram showing an example of a hardware configuration of a terminal device according to an embodiment of the present invention. [Figure 11] FIG. 11 is a flow diagram of a display setting process according to an embodiment of the present invention. [Figure 12] FIG. 12 is a flow diagram of a search process according to an embodiment of the present invention. [Figure 13] FIG. 13 is a flow diagram of a contact process according to an embodiment of the present invention. [Figure 14] FIG. 14 is an example of a display screen according to an embodiment of the present invention. [Figure 15] FIG. 15 is a conceptual diagram according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0022] Groupware and virtual office tools that allow members to be disclosed and shared in an organization are known. In general, in such tools, certain personal information and current status are always made available to other members, making it possible to smoothly communicate and manage employees. However, in such an environment, the psychological pressure of being monitored may affect the members' minds and bodies, and there is a risk that it may induce crimes in the office, such as harassment and stalking, and there is a possibility that undesirable situations may occur from the perspective of privacy protection. In particular, in virtual offices that have been used in recent years, realism has increased due to improvements in metaverse technology, and ensuring safety by protecting privacy has become essential. Based on this, an embodiment of the present invention provides a privacy management system (information processing system) that can protect the privacy of members and reduce psychological oppression and burden.

[0023] According to an embodiment of the present invention, for example, as shown in FIG. 15, it is possible to set whether the presence information of the member is always open to the public, periodically open when a predetermined time condition is satisfied, irregularly open, or not open to the public. In addition, even if the information is open to the public, it is possible to set a limited open (limited open) such as whether the public is open to a predetermined range or the information to be opened is limited to a predetermined range. In addition, by setting search conditions, it is possible to search the member information by changing the search target range to a predetermined range (all range), a range narrower than the predetermined range (general information only), presence information only, or not to be searched (unsearchable). In addition, as a contact means (communication method), it is possible to set whether to allow contact, to request a separate contact (request from the contact source or from the contact), to temporarily prohibit contact, or to always prohibit contact, regarding the contact between the contact source and the contact. You can also set the means of communication to be video calls (image and audio), voice conversations, messages (text), image sharing, etc., and you can also set the preferred means of communication for the member receiving the contact or the member making the contact.

[0024] Fig. 1 is a diagram showing an example of an overview of the privacy management system 1, and Fig. 2 is a diagram showing an example of a functional block of the privacy management system 1. Note that the privacy management system 1 in this embodiment includes, for example, any tool that enables organized communication on a network, such as a virtual office that exchanges information using images or avatars of employees, or groupware used in a real office.

[0025] The privacy management system 1 is a system that supports mutual information sharing among members participating in a specific group. The privacy management system 1 includes a plurality of terminal devices 100 that are operated by the members as users, and a management server 200 that manages the entire group. The space shared by the group may be either virtual or real. Furthermore, the present invention is not necessarily limited to the following, and the configurations of the terminal devices 100 and the management server 200 may be arranged in any manner as long as the following processes can be executed, and some functions may be executed on an application.

[0026] The management server 200 is an information processing device such as a server computer or a PC (Personal Computer), etc. The management server 200 creates a virtual office and provides it to the terminal device 100, and also stores and manages various types of information.

[0027] The terminal device 100 is an information processing device such as a PC, a smartphone, a PDA (Personal Digital Assistant), or a tablet terminal, and is communicatively connected to the management server 200 via a network NW. In this embodiment, for example, the terminal device 100 is a PC, a smartphone, or a tablet terminal owned by each member of an organization.

[0028] The terminal device 100 includes a control unit 110, a storage unit 120, an input unit 130, an output unit 140, and a communication unit 150. The control unit 110 performs overall control of the terminal device 100. The storage unit 120 stores information required for processing by the control unit 110. The input unit 130 accepts information input to the terminal device 100 from an input device connected via an input IF 14 described later. The output unit 140 outputs information to an output device connected via an output IF 15 described later. The communication unit 150 mediates the transmission and reception of information to and from the management server 200.

[0029] The control unit 110 exchanges information with the management server 200 to enable the user to communicate in the virtual office. When the user performs operations to request various inputs, settings, displays, searches, contacts, etc., the control unit 110 transmits the necessary information to the management server 200 and outputs the received information to the output unit 140.

[0030] The storage unit 120 temporarily or continuously stores the input information. The stored contents are similar to the information stored in the storage unit 220 described later, and therefore a description thereof will be omitted here.

[0031] Next, the management server 200 will be described. The management server 200 comprises a control unit 210 that performs processing related to the virtual office and its management, a storage unit 220 that stores information related to the virtual office, and a communication unit 230. The control unit 210 performs overall control of the management server 200. The storage unit 220 stores information necessary for the processing of the control unit 210. The communication unit 230 mediates the transmission and reception of information to and from the terminal device 100.

[0032] The control unit 210 has an information receiving unit 211 that receives various setting operations from the user and stores the contents in the memory unit 220, a display setting unit 212 that sets whether or not information about the user is to be disclosed to other users in the virtual office, a search processing unit 213 that performs user search processing, a contact means setting unit 214 that sets the means of contact from the user to other users in the virtual office, and a screen construction unit 215 that executes processing related to the construction of the virtual office screen.

[0033] The memory unit 220 stores presence information 221 that stores information regarding the user's current situation, user information 222 that stores the user's personal information, presence setting information 223 that stores information regarding the disclosure settings of the presence information, display setting information 224 that stores information regarding the disclosure settings of the user information 222, search setting information 225 that stores settings for whether various information is to be subject to search operations, search level setting information 226 described later, and contact setting information 227 that stores settings regarding the method of contact between users.

[0034] The information receiving unit 211 receives the current situation of the user, and stores this information in presence information 221 shown in Fig. 3. The presence information 221 is information indicating the presence or absence and location of the user, and includes a user ID 221a that is a unique identifier given to identify the user, and situation information 221b for identifying the situation of the user identified by the user ID.

[0035] The status information 221b is information indicating the current status of the user, for example, before coming to work, after coming to work, at his / her desk, away from his / her desk, out of the office, in a meeting, on a business trip, working, serving customers, on vacation, etc. The information receiving unit 211 updates the status information 221b based on the input operation performed by the user himself / herself (for example, "out of the office", "working", "serving customers", etc.). In addition, the status information may be automatically updated by using information from a registered schedule (for example, "in a meeting", "on a business trip", "on vacation", etc.), the status of login to the system, attendance and departure operations (for example, "before coming to work", "after leaving work", etc.), and the operation status of the terminal device 100 (for example, "at his / her desk", "away from his / her desk", etc.).

[0036] Furthermore, the situation information 221b may include information indicating the user's current location. For example, this may be detailed location information such as "your desk," "building name," and "room name" (in a real office), or general location information such as "home," "business trip destination," and "on the move." The information receiving unit 211 may update this information based on an input operation performed by the user, or may automatically update the information based on a schedule, an operation within the system, an operation status of the terminal device 100, and the like. It is also possible to obtain and update detailed locations at regular intervals using a GPS device of the terminal device 100 or other mobile terminals.

[0037] Furthermore, the information receiving unit 211 receives input of personal information about the user via the terminal device 100. Such information is stored in user information 222 shown in FIG. 4. The user information 222 includes a user ID 222a and personal information 222b of the user identified by the user ID. The personal information 222b is various information about the user, such as basic information such as the name, information about an image (photo, illustration, avatar, etc.) showing an employee, information showing attributes within an organization including affiliation such as the business establishment or department to which the employee belongs, employment type, work system, working hours, etc., and contact information such as an email address and a telephone number required for contact.

[0038] In this embodiment, personal information 222b stores information corresponding to various items such as "name," "avatar," "business establishment," "department," "job rank," "employment type," "work system," "email (address)," and "company mobile phone (number)." However, this is not necessarily limited to this, and any information relating to the user may be stored, such as "nickname," "employee number," "extension phone number," etc.

[0039] In addition, in this system, it is possible for a user to set in advance the disclosure conditions desired by the user for each item of the presence information 221 and the user information 222. The information receiving unit 211 receives detailed settings registered from the user via the terminal device 100, and stores the contents in the presence setting information 223 and the display setting information 224 in the storage unit 220.

[0040] 5 shows an example of the presence setting information 223. As shown in the figure, the presence setting information 223 stores a user ID 223a, range information 223b indicating the range in which the user specified by the user ID allows the disclosure of the presence information 221, and time information 223c setting a disclosure time period in which the disclosure of the presence information 221 is allowed.

[0041] The range information 223b indicates the range of disclosure of the presence information 221. For example, if it is "all", disclosure of the contents of "status" of the presence information 221 is permitted to all users, if it indicates attributes such as "full-time employee", "third factory", "accounting department", etc., disclosure is permitted only to users who meet the conditions corresponding to the attributes, and if it indicates "private", disclosure is not permitted to all users.

[0042] The time information 223c stores a disclosure time period during which the user permits the disclosure of the presence information 221. For example, if the condition is "always", it indicates that the disclosure of the situation information 221b is permitted at all times, and if it is "regularly", it indicates that the disclosure of the situation information 221b is permitted during a set time period, for example, "7:00-19:00" (between 7:00 a.m. and 7:00 p.m.). Note that "irregularly" indicates that random disclosure is permitted, and the situation information 221b is disclosed at a time determined randomly. Furthermore, if it is "not permitted", it indicates that disclosure is not permitted. Note that a configuration may be adopted in which not only the time of disclosure but also the day of the week can be set.

[0043] 6 shows an example of the display setting information 224. As shown in the figure, the display setting information 224 stores a user ID 224a and range information 224b indicating the range to which the user specified by the user ID allows each item of the user information 222 to be made public. The range information 224b is a condition for narrowing down the targets to which the disclosure of the personal information 222b is permitted. The contents are the same as the above-mentioned range information 223b, so a description thereof will be omitted here.

[0044] Although the above examples show range information 223b and range information 224b with a single condition set, it is also possible to set and register multiple conditions using and or or. For example, <"accounting department" and "full-time employee"> indicates that disclosure is permitted only to users whose item "department" registered in personal information 222b is "accounting department" and whose item "employment type" is "full-time employee." Also, <"third factory" or "manager"> indicates that disclosure is permitted to both users whose item "business establishment" is "third factory" and users whose item "job rank" is "manager."

[0045] Furthermore, the information receiving unit 211 receives a setting as to whether or not the contents of the above-mentioned presence information 221 and user information 222 are to be searched in a search process on the system. FIG. 7 shows an example of search setting information 225 in which this content is registered. As shown in the figure, the search setting information 225 includes a user ID 225a and search level information 225b. The search level information 225b stores a search level set by the user. FIG. 8 shows an example of search level setting information 226. The search level is a condition set that combines items to be searched for in the presence information 221 and the user information 222, and the user can collectively set whether or not each item is to be searched for by selecting a search level.

[0046] As shown in the figure, in "search level 0", all items are searched, and 100% of the contents of the presence information 221 and the user information 222 are included in the search target. In "search level 1", about 65 to 75% of the general information is searched, and items other than those with high privateness such as "job rank", "employment type", "work system", and "company mobile phone" are searched. In "search level 2", about 25 to 35% of the items are searched, and items with high business necessity such as presence information ("status"), "name", and "email" are searched. In "search level 3", only "name" and presence information ("status") are searched. In "search level 4", all information is not searched. The information receiving unit 211 allows the user to select such a search level, and the user can easily conceal desired information by simply selecting a search level.

[0047] The information receiving unit 211 also receives contact settings regarding the user's desired contact method. FIG. 9 shows an example of the contact setting information 227. As shown in the figure, the contact setting information 227 includes a user ID 227a, response information 227b, and a contact means 227c. The response information 227b stores information regarding whether the user will respond to a contact request from another user on the system. For example, the content is "OK" if the user always responds to a contact request, "NO" if the user never responds, "TEMPORARILY NO" if the user does not respond temporarily, or "CONDITIONALLY OK" if the user is allowed to contact under certain conditions. Examples of "CONDITIONALLY OK" include "OTHER PARTY SEPARATE CONTACT" which does not respond to the first contact and asks the other party (contact source: hereinafter, for convenience, A) to contact again separately, and "OUR SEPARATE CONTACT" which does not respond to the first contact and indicates that the user (contact source: hereinafter, for convenience, B) will contact the other party separately.

[0048] The contact means 227b stores information that specifies the contact means that the user allows to be contacted. It is assumed here that the contact means in the system are "video + audio," "audio," "text," and "image." Note that "video + audio" is video calling, "audio" is voice conversation, "text" is email or messages, and "image" is, for example, illustrated messages such as stamps, or a contact method such as sharing still images using online storage. Note that other contact means such as email or an extension outside the system may also be stored.

[0049] Regarding the above-mentioned registration of settings via the information receiving unit 211, the registration screen used by the user for various settings may be any screen that allows input registration. In addition, the above-mentioned settings may be registered by an administrator on behalf of each user.

[0050] In this embodiment, all items can be selected to be public or private, but the initial settings for certain items may not be changed. For example, at least one piece of information that identifies a user, such as a name or employee number, may be permitted to be disclosed.

[0051] Next, the display setting unit 212 will be described. The display setting unit 212 executes a display setting process for determining whether or not to display the contents of each item of the above-mentioned presence information 221 and user information 222 on the terminal device 100. Such a display setting process is executed in every situation when, for example, in groupware or a virtual office, information related to a user is displayed on a screen.

[0052] Specifically, first, the display setting unit 212 accepts a display request for personal information of another user via the terminal device 100. Upon accepting the display request, the display setting unit 212 reads out the user ID of the user who made the display request and the user ID of the user who is the destination of the display request, which are included in the display request, and compares the information stored in the user information 222 of the user who made the display request with the information stored in each item of the range information 223b and the range information 224b of the user who is the destination of the display request, and determines whether the user who made the display request is appropriate as an information disclosure destination of the user who is the destination of the display request.

[0053] For example, when determining whether or not a user is appropriate as a disclosure destination of the presence information 221, if the content stored in the "department" field of the personal information 222b of the user who made the display request is "legal affairs department" and the content stored in the range information 223b of the user who is the recipient of the display request is "all", the display setting unit 212 determines that the user who made the display request has an appropriate attribute as a disclosure destination of information related to the "situation" of the user who is the recipient of the display request. However, if the disclosure range stored in the range information 223b does not include "legal affairs department" but is "accounting department" or "private", for example, the user who made the display request is determined to have an inappropriate attribute as a disclosure destination of information.

[0054] Furthermore, in the above process, when the display setting unit 212 determines that it is appropriate for the user who has made the display request to disclose the status information 221b of the presence information 221, it reads out the time conditions for disclosure from the time information 223c of the user who has received the display request. When a disclosure time period permitting periodic display is stored, it is determined whether or not the current time is included in the disclosure time period, and when the current time is included in the disclosure time period, it is determined that disclosure of the presence information 221 is appropriate. On the other hand, when the current time is not included in the disclosure time period, it is determined that disclosure of the information is not appropriate. Note that when the disclosure time period stored in the time information 223c is "irregular", the display setting unit 212 randomly determines whether or not to disclose the presence information 221.

[0055] Next, the display setting unit 212 reads out the record of the user who is the destination of the display request from the presence information 221 and the user information 222, creates information storing only the items that are determined to be appropriate for disclosure based on the above-mentioned determination content, and outputs this as display result information to the screen construction unit 215. Note that if there is no item that is determined to be appropriate for disclosure, the display setting unit 212 generates display result information indicating that fact and outputs it to the screen construction unit 215.

[0056] The screen construction unit 215 generates a display screen on which the contents of the items that are determined to be appropriate for disclosure are displayed, and transmits the display screen to the terminal device 100. At that time, for example, the items that are not to be disclosed may be configured to be left blank or to display the characters "-" or "private".

[0057] FIG. 14 shows an example of a display screen on which such display processing has been performed. Display 190 is an example of a case where the "status" of a user (User C) is not disclosed. The screen construction unit 215 indicates that the current status is unknown by displaying such a user in gray or semi-transparent color. The existence of the user itself may be hidden. Display 191 is an example in which part of the personal information of a user (User B) is displayed as "-" and is not displayed. If the "name" is not disclosed, a user ID, nickname, employee number used within an organization, or the like may be displayed instead.

[0058] By such processing of the display setting unit 212, the user can set in advance the disclosure range and disclosure time period of information about himself / herself, thereby preventing his / her information from being displayed to those to whom he / she does not wish to disclose it. In addition, by making private information such as his / her situation and whereabouts private, he / she can work without feeling psychological oppression. Since the time period can also be set for such information, during the time period when disclosure is not being made (for example, during early morning hours or overtime work), he / she can refrain from contacting other users and prevent his / her activity time in the organization from being known. In addition, by randomly disclosing information, excessive attention and the oppressive feeling of always being watched by someone can be reduced.

[0059] Next, the search processing unit 213 will be described. The search processing unit 213 starts executing a search process when there is a search request related to a user on the system. Specifically, when an operation to search for a user is executed on the terminal device 100, the control unit 110 transmits the search request to the management server 200. When the search processing unit 213 accepts the search request, it reads out the search conditions (e.g., search word) included in the search request, and identifies search matching records that match the search conditions. Specifically, the search processing unit 213 identifies the item to which the search word belongs (e.g., if the search word is "presence", the item is "status").

[0060] Next, the search processing unit 213 acquires search level information by referring to the search setting information 225 of each user, and identifies the items that each user is searching for (stores "○") from the search level setting information 226, and sets them as search targets. For example, if the search level is 0, all items are set as search targets, if it is 1 to 2, general items according to the search level are set as search targets, if it is level 3, only existence information ("status" item) is set as search targets, and if it is level 4, no items are set as search targets since there are no items to search.

[0061] Next, the search processing unit 213 judges whether or not information matching the search word is stored in the above-mentioned search target items in the presence information 221 and user information 222 of each user. If matching information is stored, it is judged to be a search match record and its user ID is extracted. Then, the search processing unit 213 outputs these as search result information to the screen construction unit 215. The screen construction unit 215 generates a search result screen from the search result information and transmits it to the terminal device 100. Note that if no search result records exist, the search processing unit 213 generates search result information indicating that fact and outputs it to the screen construction unit 215.

[0062] By such processing of the search processing unit 213, the user can set a search level in advance to protect himself / herself from being searched and identified for contents that he / she does not want to be known. The search result screen may be of any type, for example, a screen that displays a list of the names of users who are hit by the search. In such a case, the name or the like can be specified to obtain further information about the user. This operation corresponds to a display request, and the display setting process may be performed by the display setting unit 212. Also, instead of the name, a user ID, a nickname, an employee number used in an organization, or the like can be displayed. Furthermore, according to the search level set by each user, items to be searched may be read from the presence information 221 and the user information 222, listed, and displayed on the search result screen.

[0063] Next, the contact means setting unit 214 will be described. The contact means setting unit 214 executes a contact process when there is a request to contact another user on the system. First, when an operation is executed on the terminal device 100 by a user requesting contact with another user, the control unit 110 transmits the contact request to the management server 200.

[0064] When the contact method setting unit 214 receives a contact request, it reads out the user ID of the contact (B) included in the contact request. Next, the contact method setting unit 214 extracts a record in which the user ID of the contact (B) is stored in the user ID 227a from the contact setting information 227, reads out the information stored in the response information 227b, and specifies whether or not the response is permitted.

[0065] If the stored information indicates that contact is permitted (here, "OK"), the contact means setting unit 214 reads out the contact means set by the user of contact (B) from the contact means 227c, and outputs a request to generate a notification screen to the screen construction unit 215. When the screen construction unit 215 receives the request to generate a notification screen, it generates a notification screen for contacting by the contact means set by the contact (B), and returns it to the terminal device 100 of the user of contact origin (A).

[0066] In addition, such a notification screen will display a message such as "Contact is possible via video call, voice call, and text," along with buttons to execute contact using each means of communication. The contact source (A) user can then start contacting the contact (B) user directly from this screen.

[0067] Furthermore, if the information indicates that contact is not permitted (here, "not permitted" and "temporarily not permitted"), the contact method setting unit 214 outputs to the screen construction unit 215 a request to generate a notification screen indicating that contact (B) is not accepting contacts. Note that in the case of "temporarily not permitted", a message indicating that the refusal to permit contact is temporary, such as "Contacts are currently not being accepted temporarily", may be displayed.

[0068] Furthermore, if the information stored in the response information 227b is “recipient will be contacted separately,” the contact method setting unit 214 reads the contact method set by the contact (B) from the contact method 227c, and outputs a request to the screen creation unit 215 to generate a notification screen requesting that the recipient be contacted separately again at a later date.

[0069] When the screen construction unit 215 receives a notification screen generation request, it generates a notification screen that prompts the user to contact the contact (B) separately later by the contact means set by the contact. For example, a message such as "You can contact the contact by video call, voice call, or text. Please contact the contact later" is displayed along with a contact execution button for each contact means. The message may specify a time for re-contact such as "after x minutes." In addition, the contact may be restricted by making the contact execution button function after a predetermined time has elapsed (for example, after 5 minutes). In this way, by not responding to the first contact and asking the other party to contact the other party again, the first contact functions as a prior contact. This prevents the user of the contact (B) from being contacted suddenly and allows them to respond with plenty of time.

[0070] Furthermore, when the information stored in the response information 227b is “we will contact you separately”, the contact method setting unit 214 reads out the contact method set by the contactor (A) from the contact method 227c, and outputs to the screen creation unit 215 a request to generate a notification screen that prompts the contact (B) to contact the contactor (A) and a notification screen that includes a notification that prompts the contactor (A) to wait for a return call from the contact (B).

[0071] When the screen construction unit 215 receives the generation request, it generates a notification screen including a message such as "Please wait for a reply" and transmits it to the terminal device 100 of the user of the contact (A). It also generates and transmits a notification screen to the terminal device 100 of the user of the contact (B). At that time, the screen construction unit 215 generates a notification screen for contacting the contact source (A) by the contact means desired by the contact means 227c. For example, it displays a message such as "A has contacted you. Please reply. You can contact by text or image" along with a contact execution button by each contact means. In this way, by not responding to the first contact and contacting back, it is possible to avoid sudden contact and make a contact with plenty of time.

[0072] In addition to the above, a message such as "Please contact us via a separate internal line" may be displayed to encourage the user to contact the person by other means.

[0073] Here, the contact method setting unit 214 may further read the working hours from the "Work System" item of the personal information 222b of the contact (B), and if the current time is outside working hours, process the "Yes" item as either "I will contact you separately" or "No." This makes it possible to prevent contact outside of the designated working hours.

[0074] Furthermore, the contact means setting unit 214 may refer to the current situation from the presence information 221 to determine whether or not contact is possible. For example, if the content of the situation information 221b is "on a business trip" or "in a meeting", the user of the contact (B) is highly likely to be unable to respond. Therefore, by carrying out the same process as when the response information 227b is "temporarily unavailable" or "will contact separately", it is possible to restrict contacts that require an immediate response in a situation where a response is impossible. Furthermore, if the current situation is "on vacation", etc., by carrying out the process when the response information 227b is "unavailable", it is possible to prevent contact during the vacation itself.

[0075] In this way, since communication is made using the contact method preferred by the contact recipient, the contact recipient can wait for the contact with peace of mind, and the contact person can also take the other person's feelings into consideration when making a contact. The contact means can also be set in consideration of the contact means desired by the contacting party. For example, the contact means setting unit 214 refers to the contact setting information 227 to identify the contact means desired by the contacting party (e.g., text + image) and the contact means desired by the contact receiving party (e.g., text). Then, the contact means common to both parties (e.g., text) is set as the contact means between the two parties.

[0076] 10 is a diagram showing an example of the hardware configuration of the above-mentioned terminal device 100. The terminal device 100 has a calculation device 11, a memory 12, an external storage device 13, an input IF 14, an output IF 15, and a communication IF 16, and each component is connected by a bus.

[0077] The arithmetic device 11 is a arithmetic device such as a CPU (Central Processing Unit), and executes processing according to a program recorded in the memory 12 or the external storage device 13. In the terminal device 100, processing is performed by the arithmetic device 11 that operates according to a program read onto the memory 12 or the external storage device 13. The control unit 110 realizes each function by the arithmetic device 11 executing the program.

[0078] The memory 12 is a storage device such as a RAM (Random Access Memory) or a flash memory, and functions as a storage area from which programs and data are temporarily read. The external storage device 13 is a writable and readable storage device. The function of the storage unit 120 is realized by the memory 12 or the external storage device 13. The function of the storage unit 120 may be realized by a storage device connected via the communication IF 16. The output IF 15 is an interface for outputting information to an output device. The communication IF 16 is an interface for communicatively connecting the terminal device 100 to an external device.

[0079] The processing of each component of the terminal device 100 may be executed by one piece of hardware or by multiple pieces of hardware. Also, the processing of each component of the terminal device 100 may be realized by one program or by multiple programs.

[0080] The management server 200 has substantially the same configuration as the terminal device 100, and is configured by combining the above-described elements, so a description thereof will be omitted.

[0081] Next, the flow of processing in the privacy management system 1 will be described. <Display setting process> 11 is a flow diagram showing an example of a display setting process executed by the display setting unit 212 of the management server 200. When the display setting unit 212 receives a display request for information related to a user from the terminal device 100, the display setting unit 212 starts this process.

[0082] When the display setting unit 212 receives a display request from the terminal device 100, the display setting unit 212 identifies personal information of the user who has made the display request (step S11).

[0083] Specifically, the display setting unit 212 first reads out the user ID of the user who has made the display request, which is included in the display request, and identifies, from the user information 222, the record of the user who has made the display request.

[0084] Next, the display setting unit 212 identifies setting information of the user to whom the display request is made (step S12).

[0085] Specifically, the display setting unit 212 reads out the user ID of the user who is the destination of the display request from the display request, and identifies the record of the user who is the destination of the display request from the presence setting information 223 and the display setting information 224.

[0086] Furthermore, the display setting unit 212 judges whether or not the requester is appropriate as a disclosure destination of each piece of information (step S13).

[0087] Specifically, the display setting unit 212 compares information stored in the user information 222 of the user who made the display request with information stored in each item of the range information 223b and the range information 224b of the user who is the recipient of the display request. If the set range stored in the range information 223b and the range information 224b includes the attribute of the display requester stored in the user information 222, it is determined that the user who made the display request is appropriate as a recipient of information for that item. On the other hand, if the attribute of the display requester is not included in the set range, it is determined that the user who made the display request is inappropriate as a recipient of information for that item.

[0088] Next, the display setting unit 212 determines whether or not the information stored in the existence information 221 is to be disclosed as a result of the process of step S13 (step S14).

[0089] If the result of the process in step S13 is that the presence information 221 is to be disclosed (Y in step S14), the display setting unit 212 proceeds to step S15, and if the presence information 221 is not to be disclosed (N in step S14), the display setting unit 212 proceeds to step S18.

[0090] In step S14, if the situation information 221b of the presence information 221 is to be disclosed (Y in step S14), the display setting unit 212 refers to the time information 223c to identify the stored content. If the content is "always" (always in step S15), the process proceeds to step S19; if it is "regularly" (regular in step S15), the process proceeds to step S16; if it is "irregularly" (irregular in step S15), the process proceeds to step S17.

[0091] If the content stored in the time information 223c in step S15 is "regular", the display setting unit 212 judges whether the current time is included in the disclosure time period stored in the time information 223c (step S16). If the current time is included in the disclosure time period (Y in step S16), the process proceeds to step S19, and if the current time is not included in the disclosure time period (N in step S16), the process proceeds to step S18.

[0092] In the case of "irregular" in step S15, the display setting unit 212 randomly judges whether or not to actually disclose the status information 221b to be disclosed (step S17). If it is judged that the status information 221b is to be disclosed (Y in step S17), the process proceeds to step S19, and if it is judged that the status information 221b is not to be disclosed (N in step S17), the process proceeds to step S18.

[0093] The display setting unit 212 determines in step S18 not to disclose the situation information 221b, and in step S19 determines to disclose the situation information 221b, and proceeds to step S20.

[0094] Finally, the display setting unit 212 generates display determination result information based on the contents determined in steps S18 and S19, and outputs the information to the screen creating unit 215 (step S20).

[0095] Specifically, the display setting unit 212 reads out the record of the user who is the destination of the display request from the presence information 221 and the user information 222, creates information storing only the items that are determined to be appropriate for disclosure based on the contents determined in steps S18 and S19, outputs this as display result information to the screen construction unit 215, and ends the process. Note that if there is no item that is determined to be appropriate for disclosure, the display setting unit 212 generates display result information indicating that fact, outputs it to the screen construction unit 215, and ends the process.

[0096] The screen creator 215 generates a display screen that displays only the items that have been determined to be appropriate for disclosure from such display result information, and returns the display screen to the terminal device 100 that has made the display request.

[0097] <Search process> 12 is a flow diagram showing an example of the search process executed by the search processing unit 213 of the management server 200. When the search processing unit 213 receives a search request for information on a user from the terminal device 100, the search processing unit 213 starts this process.

[0098] First, the search processing unit 213 reads the search condition (here, the search word) included in the search request and identifies the item to which the search word belongs (step S21). For example, if the search word is "presence", the search item is "status".

[0099] Next, the search processing unit 213 refers to the search level information 225b of the search setting information 225 of each user, and determines whether the search level is 0 or not (step S22). If the search level is 0 ("level 0" in step S22), the process proceeds to step S23, and all items are set as search targets according to the search level setting information 226. If the search level is 1-4 ("level 1-4" in step S22), the process proceeds to step S24.

[0100] If the search level is 1-4 ("level 1-4" in step S22), the search processing unit 213 further specifies the search level (step S24). Specifically, if the search level is 1 or 2 ("level 1-2" in step S24), the process proceeds to step S25, where general items are set as search targets according to the search level setting information 226. If the search level is 3 ("level 3" in step S22), the process proceeds to step S26, where only the "status" item, which is existence information, is set as search targets according to the search level setting information 226. If the search level is 4 ("level 4" in step S22), the process proceeds to step S27, where no items are set as search targets.

[0101] After setting such search items, the search processor 213 judges whether information matching the search word is stored in the set search target items in the presence information 221 and the user information 222. If matching information is stored, the search processor 213 judges the record to be a search match record (step S28).

[0102] Next, the search processing unit 213 extracts the user ID from the search matching record identified in step S28, outputs this to the screen generating unit 215 as search result information, and ends the process.

[0103] The screen construction unit 215 generates a search result screen from the search result information and transmits it to the terminal device 100. If no search result records exist, the search processing unit 213 generates search result information indicating that fact and outputs it to the screen construction unit 215.

[0104] <Contact Processing> Next, a description will be given of the contact processing executed by the contact means setting unit 214. Fig. 13 is a flow diagram showing an example of the contact processing executed by the contact means setting unit 214 of the management server 200. The contact means setting unit 214 starts the contact processing when there is a contact request from the terminal device 100 to another user.

[0105] First, the contact means setting unit 214 reads out the user ID of the contact (B) included in the contact request (step S31).

[0106] Next, the contact means setting unit 214 extracts a record in which the user ID of the contact (B) is stored in the user ID 227a from the contact setting information 227, and refers to the response information 227b (step S32). If the content indicates that the contact is permitted (here, "OK"), the process proceeds to step S34.

[0107] If the response information 227b is "OK", the contact means setting unit 214 reads the contact means set by the contact from the contact means 227c, sets it as a contact means available between them (step S34), outputs a request to generate a notification screen to the screen construction unit 215 (step S35), and ends the process. When the screen construction unit 215 receives the request to generate a notification screen, it generates a notification screen for contacting by the contact means set by the contact, and returns it to the terminal device 100 of the user of the contact source (A).

[0108] Furthermore, if the response information 227b indicates that contact is not permitted (here, if it is "Not permitted" or "Temporarily not permitted" ("Not permitted" and "Temporarily not permitted" in step S32), the contact means setting unit 214 outputs a request to generate a notification screen indicating that contact is not permitted to the screen construction unit 215 (step S36), and terminates the process. When the screen construction unit 215 receives the notification screen generation request, it generates a notification screen indicating that the contact is not accepting contact, and returns it to the terminal device 100 of the user of the contact source (A).

[0109] Furthermore, if the information stored in the response information 227b is "conditionally acceptable" (step S32: "conditionally acceptable"), the communication means setting unit 214 further reads out a condition from the response information 227b (step S33).

[0110] If the condition is "contact the other party separately" (step S33: "contact the other party separately"), the contact means setting unit 214 reads the contact means set by the contact from the contact means 227c, sets it as a contact means available between the two parties (step S34), outputs a request to generate a notification screen requesting separate contact at a later date to the screen construction unit 215 (step S35), and ends the process. When the screen construction unit 215 receives the notification screen generation request, it generates a notification screen for contacting the contact via the contact means set by the contact, and returns it to the terminal device 100 of the user of the contact source (A).

[0111] If the condition is "we will contact you separately" ("we will contact you separately" in step S33), the contact method setting unit 214 reads out the contact method set by the contact source (A) from the contact method 227c, sets it as the contact method available between the two parties (step S34), and outputs a request to the screen creation unit 215 to generate a notification screen that prompts the contact to contact the contact source (A) and a notification screen that prompts the contact source (A) to wait for a contact from the contact (step S35), thereby completing the process.

[0112] When the screen construction unit 215 receives the generation request, it transmits a notification screen urging the user of the contact source (A) to wait for a call to the terminal device 100. It also generates and transmits to the terminal device 100 of the contact user a notification screen urging the user to call back by the contact means set by the contact source (A). Note that the contact means can be set in consideration of the contact means desired by the contacting party. For example, in step S34, the contact means setting unit 214 refers to the contact setting information 227 to identify the contact means desired by the contacting party (e.g., text + image) and the contact means desired by the contact receiving party (e.g., text). Then, the contact means common to both parties (e.g., text) is set as the contact means that can be used between the two parties.

[0113] An embodiment of the present invention has been described above. According to this embodiment, the user himself / herself can limit the spread of personal information. This allows the user to be relieved of the psychological pressure of being constantly monitored, and makes it difficult for excessive observation or contact to occur, thereby realizing a safe office environment.

[0114] The present invention is not limited to the above-mentioned embodiment, and various modified examples are included. For example, the above-mentioned embodiment has been described in detail to make the present invention easier to understand, and the present invention is not limited to having all the configurations described here. It is also possible to replace a part of the configuration of one embodiment with the configuration of another embodiment. It is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration. In addition, each of the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in hardware by designing them as integrated circuits, for example, in part or in whole. In addition, the control lines and information lines in the figure show those that are considered necessary for explanation, and do not necessarily show all of them. It may be considered that almost all of the configurations are connected to each other.

[0115] Moreover, the functional configuration of each device described above is classified according to the main processing content for ease of understanding. The classification method and names of the components do not limit the present invention. As described above, the configuration of the terminal device 100 and the management server 200 can be further classified into more components according to the processing content. Also, one component can be classified to perform more processes. [Explanation of symbols]

[0116] 1... privacy management system, 11... arithmetic unit, 12... memory, 13... external storage device, 14... input IF, 15... output IF, 16... communication IF, 100... terminal device, 110... control unit, 120... storage unit, 130... input unit, 140... output unit, 150... communication unit, 190-191... display, 200... management server, 210... control unit, 230... communication unit, 211... information reception unit, 212... display setting unit, 213... search processing unit, 214... contact means setting unit, 215... screen construction unit, 220... storage unit, 221... presence information , 221a...user ID, 221b...status information, 222...user information, 222a...user ID, 222b...personal information, 223...presence setting information, 223a...user ID, 223b...range information, 223c...time information, 224...display setting information, 224a...user ID, 224b...range information, 225...search setting information, 225a...user ID, 225b...search level information, 226...search level setting information, 227...contact setting information, 227a...user ID, 227b...response information, 227c...contact means.

Claims

1. A privacy management system in which a plurality of members participate and share information among the members, For each of said members, Presence setting information for setting disclosure conditions of the presence information of the members; Search setting information for setting the range of information to be searched during a search; A storage unit that stores contact setting information for setting a contact means by which the members can contact each other; a display setting unit that uses the presence setting information to set whether the presence information of the member is to be always disclosed, disclosed when a predetermined time condition is satisfied, disclosed irregularly, or not disclosed at all; a search processing unit that uses the search setting information to search the member information by changing the range of search targets, such as a predetermined range, a range narrower than the predetermined range, only existence information, or no search target, etc.; a contact means setting unit that uses the contact setting information to set whether to permit contact between a contact source and a contact, to request the contact source to make a separate contact, to request the contact source to make a separate contact, to temporarily prohibit contact, or to always prohibit contact; A privacy management system comprising:

2. The privacy management system of claim 1, The time condition further includes a condition for specifying a time period during which the presence information is to be made public; The display setting unit determines whether to make the presence information public, private, or limited public during the time period. Privacy Management System.

3. The privacy management system of claim 1, The storage unit stores personal information that identifies attributes of the members, The display setting unit sets the presence information to be public, private, or limited to members whose attributes satisfy predetermined conditions, in this privacy management system.

4. The privacy management system according to claim 3, A privacy management system in which the personal information includes terms and conditions of employment.

5. The privacy management system according to claim 3, The storage unit stores a search level that defines whether the presence information and personal information of the member are to be made public, private, or limited to public; The display setting unit is a privacy management system that determines whether each piece of information is to be made public, private, or restricted from public depending on the search level.

6. The privacy management system of claim 1, A privacy management system in which the communication means setting unit sets the communication means desired by the member receiving the communication or the communication means desired by the member making the communication as the communication means between the two members.

7. The privacy management system of claim 1, A privacy management system in which the communication means include video calls, voice conversations, messages, image sharing, etc.

8. A privacy management method for supporting information processing in which a plurality of members participate and share information among the members, comprising: A calculation device of the information processing device, For each of said members, a display setting step of setting whether the presence information of the member is to be always disclosed, disclosed when a predetermined time condition is satisfied, disclosed irregularly, or not disclosed, using presence setting information that sets a disclosure condition of the presence information of the member; a search processing step of searching the member information by changing the range of the search target among the member information, such as a predetermined range, a range narrower than the predetermined range, only existence information, or no search target, using search setting information that sets the range of information to be searched at the time of the search; The privacy management method includes a contact means setting step for setting, using contact setting information that sets a contact means by which the members can contact each other, whether to permit contact between the contact source and the contact, to request the contact source to make a separate contact, to request the contact source to make a separate contact, to temporarily disallow contact, or to always disallow contact, etc.

9. A privacy management program for an information processing device in which a plurality of members participate and share information among the members, For each of said members, a display setting unit that uses presence setting information that sets disclosure conditions for the presence information of the members to set whether the presence information of the members is to be always disclosed, disclosed when a predetermined time condition is satisfied, disclosed irregularly, or not disclosed at all; a search processing unit that uses search setting information that sets the range of information to be searched during a search to search for different ranges of information to be searched among the member information, such as a predetermined range, a range narrower than the predetermined range, only existence information, or no information to be searched at all; a communication means setting unit that uses communication setting information that sets a communication means by which the members can communicate with each other to set whether to permit communication between a contact source and a contact, to request the contact source to make a separate contact, to request the contact source to make a separate contact, to temporarily prohibit communication, or to always prohibit communication; A privacy management program for causing the information processing device to execute the above.

Images