Personal information deletion system, personal information deletion method, transaction device, program, and processing device

Abstract

To provide a personal information deletion system etc. that can facilitate the use of a request for deletion of personal information. [Solution] A personal information deletion system comprising: a personal information acquisition unit that acquires personal information of a customer; a non-personal information acquisition unit that acquires non-personal information related to the customer; a memory unit that stores the personal information of the customer acquired by the personal information acquisition unit and the non-personal information related to the customer acquired by the non-personal information acquisition unit in association with each other; a provision unit that provides the customer with deletion request information regarding a request to delete the customer's personal information and non-personal information related to the customer; a reception unit that accepts a deletion request made by the customer using the deletion request information and non-personal information related to the customer; and a deletion unit that deletes the personal information stored in the memory unit in association with the non-personal information corresponding to the deletion request accepted by the reception unit.

Description

[Technical Field]

[0001] The present invention relates to a personal information deletion system, a personal information deletion method, a transaction device, a program, and a processing device. [Background technology]

[0002] Conventionally, there have been proposed technologies for deleting personal information held by service providers (hereinafter sometimes simply referred to as "providers") at the request of customers. For example, in the personal information deletion request form in Non-Patent Document 1, the customer must enter their email address, phone number, and name. [Prior art documents] [Patent documents]

[0003] [Non-Patent Document 1] Personal information deletion request form [Retrieved July 8, 2024], Internet, <URL: https: / / cloud.swcms.net / joyfulhondaPublic / ja / contact / contact8 / inquiry8.html> Summary of the Invention [Problem to be solved by the invention]

[0004] The personal information deletion request form in Non-Patent Document 1 forces customers who want to delete their personal information to provide personal information, which creates psychological resistance among customers and prevents them from using the deletion request form. An object of the present invention is to provide a personal information deletion system and the like that can facilitate the use of a request to delete personal information. [Means for solving the problem]

[0005] The present invention, which was completed with the above objective in mind, is a personal information deletion system comprising a personal information acquisition unit that acquires personal information of a customer, a non-personal information acquisition unit that acquires non-personal information related to the customer, a memory unit that associates and stores the personal information of the customer acquired by the personal information acquisition unit with the non-personal information related to the customer acquired by the non-personal information acquisition unit, a provision unit that provides the customer with deletion request information regarding a request to delete the customer's personal information and non-personal information related to the customer, a reception unit that accepts a deletion request made by the customer using the deletion request information and non-personal information related to the customer, and a deletion unit that deletes the personal information stored in the memory unit in association with the non-personal information corresponding to the deletion request accepted by the reception unit. Here, the personal information may be biometric information of the customer detected from an image of the customer. The system may also include an imaging device that captures images of the area near the transaction device used for transactions with the customer, and the personal information acquisition unit may acquire the biometric information contained in an image of the customer captured by the imaging device. The imaging device may be installed in the transaction device. The non-personal information may also include the date and time when the customer was photographed. The non-personal information may also include information that identifies a transaction performed by the customer on a transaction device used for the transaction with the customer. The deletion request information may also include access information that enables access to a deletion request form for requesting deletion of the personal information. The providing unit may also output a recording medium on which a code including access information for accessing a deletion request form for requesting deletion of the personal information and the non-personal information is printed. In addition, the deletion unit may delete the personal information stored in association with the non-personal information received by the reception unit, and may also delete personal information that is not stored in association with the non-personal information but matches the deleted personal information. Also, from another perspective, the present invention is a personal information deletion system comprising: a memory unit that stores a customer's personal information and non-personal information related to the customer in association with each other; a provision unit that provides the customer with deletion request information regarding a request to delete the customer's personal information and non-personal information related to the customer; a reception unit that accepts a deletion request made by the customer using the deletion request information; and a deletion unit that deletes the personal information stored in the memory unit in association with the non-personal information corresponding to the deletion request accepted by the reception unit. Also, from another perspective, the present invention is a personal information deletion method that stores a customer's personal information and non-personal information related to the customer in association with each other, provides the customer with deletion request information regarding a request to delete the customer's personal information and non-personal information related to the customer, accepts a deletion request made by the customer using the deletion request information, and deletes the personal information stored in association with the non-personal information corresponding to the accepted deletion request. From another perspective, the present invention is a transaction device used for transactions with a customer, which includes an output unit that outputs the customer's personal information and non-personal information that identifies transactions conducted by the customer to an external device, and a provision unit that provides the customer with deletion request information regarding a request to delete the customer's personal information and the non-personal information. From another perspective, the present invention is a program that causes a computer to execute the functions of outputting a customer's personal information and non-personal information that identifies transactions conducted by the customer to an external device, and providing the customer with deletion request information regarding a request to delete the customer's personal information and the non-personal information. Also, from another perspective, the present invention is a processing device that includes an acquisition unit that acquires personal information of a customer and non-personal information related to the customer from a transaction device used for transactions with the customer, a memory unit that associates and stores the personal information of the customer acquired by the acquisition unit with the non-personal information related to the customer, a reception unit that accepts a deletion request made by the customer, and a deletion unit that deletes the personal information stored in the memory unit in association with the non-personal information corresponding to the deletion request accepted by the reception unit. From another perspective, the present invention is a program that causes a computer to execute the following functions: acquire personal information of a customer and non-personal information related to the customer from a transaction device used for transactions with the customer; associate the personal information of the customer and the non-personal information related to the customer acquired by the acquiring function and store them in a memory unit; accept a deletion request made by the customer and the non-personal information related to the customer; and delete the personal information stored in the memory unit in association with the non-personal information corresponding to the deletion request accepted by the accepting function. [Effects of the Invention]

[0006] According to the present invention, it is possible to provide a personal information deletion system and the like that can make it easier to request deletion of personal information. [Brief explanation of the drawings]

[0007] [Figure 1] 1 is a diagram illustrating an example of a schematic configuration of a personal information deletion system according to an embodiment; [Figure 2] FIG. 2 is a diagram illustrating an example of a schematic configuration of an ordering device, a personal information management server, a store terminal, and a mobile terminal. [Figure 3] FIG. 2 is a diagram illustrating an example of a schematic configuration of an ordering device. [Figure 4] FIG. 10 is a diagram showing an example of a receipt issued by the ordering device. [Figure 5] FIG. 4 is a diagram illustrating an example of information stored in a storage unit. [Figure 6] FIG. 10 is a diagram showing an example of a deletion request form displayed on an operation display unit. [Figure 7] FIG. 10 is a sequence diagram showing an example of a process for storing personal information performed in the system. [Figure 8] FIG. 10 is a sequence diagram showing an example of a process for deleting personal information performed in the system. DETAILED DESCRIPTION OF THE INVENTION

[0008] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. FIG. 1 is a diagram showing an example of a schematic configuration of a personal information deletion system 1 (hereinafter, may be simply referred to as "system 1") according to an embodiment. FIG. 2 is a diagram showing an example of a schematic configuration of the ordering device 10, the personal information management server 30, the store terminal 50, and the mobile terminal 70. FIG. 3 is a diagram showing an example of a schematic configuration of the ordering device 10. As shown in FIG. FIG. 4 is a diagram showing an example of a receipt 100 issued by the ordering device 10. As shown in FIG.

[0009] The system 1 includes an ordering device 10 that accepts orders for products and services from customers, and a personal information management server 30 (hereinafter sometimes simply referred to as "server 30") that stores and deletes personal information of customers. The server 30 may be installed inside the store where the ordering device 10 is installed, or may be installed outside the store. The system 1 also includes a store terminal 50 that is installed in the store and manages order information accepted by the ordering device 10, and a display device (not shown) that is installed in the store and displays orders accepted by the ordering device 10. The system 1 also includes a mobile terminal 70 that is carried by the customer.

[0010] The ordering device 10 and the server 30 are capable of data communication via a network 5. The mobile terminal 70 is also capable of data communication with the server 30 via the network 5. The network 5 is not particularly limited as long as it is a communication network used for data communication between devices, and examples thereof include the Internet, a WAN (Wide Area Network), and a LAN (Local Area Network). The communication line used for data communication may be either wired or wireless, and a combination of these may be used. An example of a wireless LAN is WiFi (registered trademark).

[0011] The store terminal 50, the ordering device 10, and the display device (not shown) are connected via, for example, a wireless LAN or a wired LAN. If the store is a restaurant, the display device can be, for example, a display device installed in the kitchen that displays still images, moving images, etc. The display device may also be a touch panel that combines a display device and a position input device.

[0012] (Ordering device 10) As shown in FIGS. 1 and 3 , the ordering device 10 includes a control unit 20 that controls the entire device and a memory unit 11 used to store data, etc. The ordering device 10 also includes an operation display unit 12 that can display an operation reception screen and images and receive input operations, and a communication unit 13 such as a communication interface used for communication with the server 30. The ordering device 10 also includes a printing unit 14 that prints receipts 100 (described later) and the like, and a code reader 15 that reads barcodes, two-dimensional codes (hereinafter sometimes referred to as “codes”), etc. Examples of two-dimensional codes include QR Code (registered trademark) and data matrix codes. The ordering device 10 also includes a card reader 16 that reads credit cards, IC cards, and store-issued membership cards. The ordering device 10 also includes a camera 17. The ordering device 10 also includes a banknote processing unit 18 that performs banknote deposit and withdrawal processes, and a coin processing unit 19 that performs coin deposit and withdrawal processes.

[0013] The storage unit 11 can be exemplified as a storage device such as a semiconductor memory. The storage unit 11 stores information on products and services that can be provided at the store. The storage unit 11 also stores address information of the server 30, store identification information that identifies the store where the ordering device 10 is installed, and device identification information that identifies the ordering device 10 itself. The operation display unit 12 can be exemplified as a touch panel that combines a display device that displays still images, moving images, etc. with a position input device.

[0014] The code reader 15 reads a code displayed on the mobile terminal 70, for example. The card reader 16 has a card terminal 16a that processes payments using a credit card inserted by a customer, and an IC terminal 16b that processes payments using an IC card held by a customer. The card terminal 16a can read information contained in a membership card inserted by a customer, and the IC terminal 16b can read information contained in a membership card held by a customer.

[0015] The camera 17 can be exemplified as a digital camera capable of taking still images or videos. The camera 17 can be exemplified as taking an image of the area in front of the ordering device 10. By taking an image of the area in front of the ordering device 10, the camera 17 can take an image of the face of a customer operating the ordering device 10. The camera 17 can be exemplified as being installed inside (in other words, built-in to) the ordering device 10, as shown in FIG. 1. The camera 17 may also be attached to, for example, the top of the housing of the ordering device 10 so as to protrude from the housing.

[0016] The banknote processing unit 18 has a banknote input port 18a through which banknotes are inserted into the ordering device 10, and a banknote output port 18b through which banknotes are ejected from the ordering device 10. The coin processing unit 19 has a coin insertion port 19a through which coins are inserted into the ordering device 10, and a coin ejection port 19b through which coins are ejected from the ordering device 10.

[0017] The control unit 20 is composed of a CPU (Central Processing Unit) (not shown), a ROM (Read Only Memory) (not shown), and a RAM (Random Access Memory) (not shown). The ROM stores a basic program (operating system) executed by the CPU, various settings, etc. The CPU uses the RAM as a working area and executes application programs read from the ROM or the storage unit 11.

[0018] The control unit 20 includes a receiving unit 21 that receives information from the server 30 and a transmitting unit 22 that transmits information to the server 30. The control unit 20 also includes a display control unit 23 that controls the operation / display unit 12, an order receiving unit 24 that receives orders from customers, and a payment processing unit 25 that performs payment processing. The control unit 20 also includes an extraction unit 26 that extracts personal information of customers from images captured by the camera 17, and an association unit 27 that associates the extracted personal information with non-personal information that can identify the personal information but is not personal information. The control unit 20 also includes a generation unit 28 that generates a code readable by the mobile terminal 70 and a printing control unit 29 that controls printing by the printing unit 14. The personal information can be, for example, biometric information. The non-personal information can be, for example, the date and time the ordering device 10 was used, store identification information, and device identification information.

[0019] The display control unit 23 displays order buttons for products and services that can be provided at the store on the operation display unit 12. Fig. 1 shows an example in which the display control unit 23 displays, as an example of an order button, a food and drink button 121 that displays an image of a food or beverage that the restaurant can provide to customers on the operation display unit 12. After the order details are determined by pressing an order button, for example, the display control unit 23 displays a payment method selection screen on the operation display unit 12. For example, the payment method selection screen is displayed so that the customer can select one payment method from among cash, credit card, electronic money, and code payment.

[0020] When a customer touches an order button displayed on the operation display unit 12, the order receiving unit 24 receives an order for a product or service related to the order button. For example, when a customer presses the eating and drinking button 121 illustrated in FIG. 1, the order receiving unit 24 receives an order for the food or beverage product whose image is displayed on the eating and drinking button 121.

[0021] When cash is selected as the payment means, the payment processing unit 25 performs payment processing using the banknote processing unit 18 and the coin processing unit 19. When a credit card or electronic money is selected as the payment means, the payment processing unit 25 performs payment processing using the card reader 16.

[0022] The extraction unit 26 extracts biometric information (an example of personal information) of the customer from the image captured by the camera 17. The biometric information can be, for example, at least one of facial feature amounts, irises, and eyeball blood vessels. In this embodiment, the extraction unit 26 extracts facial feature amounts as biometric information. That is, the extraction unit 26 extracts facial feature amounts of the customer operating the ordering device 10. The facial feature amounts can be, for example, numerical values ​​of the positional relationships of the eyes, nose, mouth, etc.

[0023] The associating unit 27 associates the biometric information (an example of personal information) extracted by the extracting unit 26 with transaction information (an example of non-personal information) performed by a customer related to the biometric information extracted by the extracting unit 26. The transaction information can be, for example, at least one of the date and time when the ordering device 10 was used (hereinafter, may be referred to as the "date and time of use"), store identification information of the store where the used ordering device 10 is installed, device identification information of the used ordering device 10, and the date and time when the image related to the biometric information extracted by the extracting unit 26 was captured. Note that, for example, the date and time when the ordering device 10 was used (in other words, the date and time of use) can be, for example, the date and time when the payment processing unit 25 performed the payment processing.

[0024] The transmitting unit 22 transmits the biometric information and the transaction information associated by the associating unit 27 to the server 30. The biometric information transmitted by the transmitting unit 22 is stored in the server 30. This allows a business operator who owns the ordering device 10 and the server 30 to use the stored biometric information for sales promotion. Furthermore, when the payment is completed, the transmission unit 22 transmits the order information relating to the paid order to the store terminal 50.

[0025] The generation unit 28 generates a code 110 including a URL (Uniform Resource Locator) of a deletion request form 80 (described later) using transaction information (for example, the date and time when the ordering device 10 was used, store identification information) as a query. The print control unit 29 prints the payment information on a recording medium (e.g., paper) and issues it as a receipt 100. The payment information can include, for example, the date and time when the ordering device 10 was used (e.g., the date and time when the payment processing unit 25 performed the payment process), the name of the store where the used ordering device 10 is installed, the payment method (e.g., code payment, credit card payment, cash payment), etc.

[0026] The printing control unit 29 also prints the code 110 generated by the generation unit 28 on the receipt 100 in addition to the payment information. The print control unit 29 also prints on the receipt 100 the following message: "If you wish to delete an image taken with the camera, please access using the QR code below."

[0027] The ordering device 10 is an example of a transaction device used for transactions with customers. As described above, the ordering device 10 includes a sending unit 22 (an example of an output unit) that outputs the customer's personal information (e.g., biometric information) and non-personal information (e.g., transaction information) that identifies the transaction conducted by the customer to a server 30 (an example of an external device). The ordering device 10 also includes a printing unit 14 (an example of a providing unit) that prints a code 110 (an example of deletion request information) related to a request to delete the customer's personal information and the non-personal information on a receipt 100 and provides the receipt to the customer.

[0028] (Server 30) 2, the server 30 includes a control unit 40 that controls the entire device, and a storage unit 31 that is used to store data, etc. The server 30 also includes a display unit 32 that is used to display an operation reception screen and images, an operation unit 33 that receives input operations from the user, and a communication unit 34 that is used to communicate with the ordering device 10 and the mobile terminal 70.

[0029] The storage unit 31 can be exemplified by a semiconductor memory, a hard disk drive (HDD), or the like. The display unit 32 is a display device that displays still images, moving images, etc. The display unit 32 can be exemplified by a liquid crystal display or an organic EL display. The operation unit 33 is an input device that accepts operations from a user, and examples of the operation unit 33 include a button, a switch, and a touch panel. The communication unit 34 can be exemplified as a communication interface.

[0030] The control unit 40 is composed of a CPU (not shown), a ROM (not shown), and a RAM (not shown). The control unit 40 has a receiving unit 41 that receives information from the ordering device 10 and the mobile terminal 70, a transmitting unit 42 that transmits information, for example, to the ordering device 10, and a deletion unit 43 that deletes information stored in the memory unit 31. The receiving unit 41 receives information in which the biometric information and the transaction information are associated with each other from the ordering device 10, and stores this information in the storage unit 31.

[0031] FIG. 5 is a diagram showing an example of information stored in the storage unit 31. As shown in FIG. As shown in FIG. 5, the memory unit 31 stores transaction information, such as the date and time when the ordering device 10 was used (in other words, the date and time of use), and store identification information of the store where the ordering device 10 used is installed, in association with facial features.

[0032] Furthermore, the receiving unit 41 receives a deletion request from the mobile terminal 70. When the receiving unit 41 receives a deletion request, the deletion unit 43 deletes the facial feature stored in the storage unit 31 in association with the transaction information included in the deletion request. For example, if the usage date and time and store identification information included in the deletion request are "July 30, 2024, 15:05" and "1111", respectively, the deletion unit 43 deletes the facial feature "AAAAAAA" stored in association with "July 30, 2024, 15:05" and "1111".

[0033] As described above, the server 30 is an example of a processing device that performs storage processing and deletion processing of personal information. The server 30 includes a receiving unit 41 (an example of an acquiring unit) that acquires personal information of a customer (e.g., biometric information) and non-personal information related to the customer (e.g., transaction information) from the ordering device 10. The server 30 also includes a storage unit 31 that stores the personal information of the customer acquired by the receiving unit 41 in association with the non-personal information related to the customer. The server 30 also includes the receiving unit 41 (an example of a receiving unit) that accepts a deletion request made by the customer, and a deletion unit 43 that deletes the personal information stored in the storage unit 31 in association with the non-personal information corresponding to the accepted deletion request.

[0034] (Store terminal 50) 2, the store terminal 50 includes a control unit 51 that controls the entire device, a storage unit 52 used to store data, etc., and a display unit 53 used to display an operation reception screen and images. The store terminal 50 also includes an operation unit 54 that receives input operations from the user, and a communication unit 55 that is used to communicate with the ordering device 10, the server 30, and a display device (not shown).

[0035] The control unit 51 is composed of a CPU (not shown), a ROM (not shown), and a RAM (not shown). The ROM stores a basic program (operating system) executed by the CPU, various settings, etc. The CPU uses the RAM as a working area and executes application programs read from the ROM or the storage unit 52. The control unit 51 has a receiving unit (not shown) that receives information from the ordering device 10, and a transmitting unit (not shown) that transmits information to a display device (not shown). The receiving unit receives the names and ordered quantities of products and services ordered via the ordering device 10. The transmitting unit transmits the names and ordered quantities of products and services ordered via the ordering device 10 to the display device.

[0036] The storage unit 52 can be exemplified by a semiconductor memory, a HDD, etc. The storage unit 52 stores the names and the ordered quantities of products and services ordered at the store where the ordering device 10 is installed. The storage unit 52 may also store information on products and services that can be provided at the store where the ordering device 10 is installed.

[0037] The display unit 53 is a display device that displays still images, moving images, etc. The display unit 53 can be exemplified by a liquid crystal display or an organic EL display. The operation unit 54 is an input device that accepts operations from the user. Examples of the operation unit 54 include buttons, switches, and a touch panel. The communication unit 55 can be exemplified as a communication interface.

[0038] The store terminal 50 can be exemplified by a notebook PC, a desktop PC, a tablet PC, a tablet terminal, or a personal digital assistant (PDA) having a POS (Point Of Sale) function.

[0039] (Mobile terminal 70) 2, the mobile terminal 70 includes a control unit 71 that controls the entire device, a storage unit 72 used to store data, etc., and an operation display unit 73 that can display an operation reception screen and images and receive input operations from the customer. The mobile terminal 70 also includes a communication unit 74 that is used to communicate with an external device (e.g., server 30), and a camera 75. Examples of the mobile terminal 70 include a multi-function mobile phone (a so-called "smartphone"), a mobile phone (a so-called "feature phone"), a personal digital assistant (PDA), a tablet terminal, etc.

[0040] The storage unit 72 can be exemplified by a storage device such as a semiconductor memory. The operation display unit 73 can be exemplified by a touch panel that combines a display device that displays still images, moving images, etc. with a position input device. The communication unit 74 can be exemplified as a communication interface. The camera 75 can be exemplified as a digital camera capable of taking still images or moving images.

[0041] The control unit 71 is composed of a CPU (not shown), a ROM (not shown), and a RAM (not shown). The ROM stores a basic program (operating system) executed by the CPU, various settings, etc. The CPU uses the RAM as a working area and executes application programs read from the ROM or the storage unit 72.

[0042] FIG. 6 is a diagram showing an example of a deletion request form 80 displayed on the operation display unit 73. As shown in FIG. When the camera 75 reads the code 110 printed on the receipt 100 (see FIG. 4), the control unit 71 accesses the URL included in the code 110 to obtain a deletion request form 80, which is then displayed on the operation display unit 73, as shown in FIG. 6. Furthermore, because the code 110 printed on the receipt 100 contains transaction information, the control unit 71 automatically displays the store used and the date and time of use included in the transaction information in the "Store Used" field 81 and the "Date and Time of Use" field 82, respectively, on the deletion request form 80. Furthermore, the control unit 71 displays a button 83 labeled "Submit" on the operation display unit 73. When button 83 is pressed, the control unit 71 transmits the information displayed in the "Store Used" field 81 and the "Date and Time of Use" field 82 of the deletion request form 80 to the server 30, thereby transmitting the deletion request. The control unit 71 also transmits store identification information corresponding to the store name entered in the "Store Used" field 81 to the server 30.

[0043] (sequence) Next, an example of the process of storing personal information performed by the system 1 will be described with reference to a sequence diagram. FIG. 7 is a sequence diagram showing an example of the process of storing personal information performed by the system 1. As shown in FIG. When a customer stands in front of the ordering device 10 (S701), the camera 17 of the ordering device 10 takes an image of the customer (S702). Then, the extraction unit 26 of the ordering device 10 extracts facial features of the customer from the image taken by the camera 17 (S703).

[0044] Thereafter, when the customer places an order by operating the ordering device 10 (S704), the ordering device 10 accepts the order (S705). Then, when the customer makes a payment via the ordering device 10 (S706) and the ordering device 10 completes the payment process (S707), the ordering device 10 issues a receipt 100 (see FIG. 4) on which a code 110 (see FIG. 4) is printed (S708). Then, the ordering device 10 transmits information that associates the facial features extracted in S703 with transaction information (e.g., date and time of use and store identification information) related to the payment process completed in S707 to the server 30 (S709).

[0045] After receiving information in which facial feature amounts and transaction information are associated with each other from the ordering device 10 (S710), the server 30 associates the facial feature amounts with the transaction information and stores them in the storage unit 31 (S711).

[0046] Next, an example of the process of deleting personal information performed in the system 1 will be described with reference to a sequence diagram. FIG. 8 is a sequence diagram showing an example of a process for deleting personal information performed by the system 1. In FIG. When a customer reads the code 110 printed on the receipt 100 (see FIG. 4) with the mobile terminal 70 (S801), the mobile terminal 70 displays the deletion request form 80 on the operation and display unit 73 (S802). As shown in FIG. 6, the "store used" and "date and time of use" are automatically entered in the deletion request form 80. When the customer presses the button 83 labeled "Send" displayed on the operation and display unit 73 of the mobile terminal 70, the mobile terminal 70 sends the "store used" and "date and time of use" to the server 30 (S803). When the server 30 receives a deletion request together with the information on "store used" and "date and time of use" (S804), it deletes the facial features stored in association with the information on "store used" and "date and time of use" (S805).

[0047] As described above, the system 1 includes a receiving unit 41 (an example of a personal information acquiring unit) that acquires personal information (e.g., biometric information) of a customer, and a receiving unit 41 (an example of a non-personal information acquiring unit) that acquires non-personal information (e.g., transaction information) related to the customer. The system 1 also includes a memory unit 31 that stores the personal information and non-personal information of the customer acquired by the receiving unit 41 in association with each other, and a printing unit 14 that prints a code 110 related to a request to delete the customer's personal information and non-personal information related to the customer on a receipt 100 and provides the receipt to the customer. The system 1 also includes a receiving unit 41 that accepts a deletion request made by the customer using the code 110 and non-personal information related to the customer (the store used and the date and time of use in FIG. 6). The system 1 also includes a deletion unit 43 that deletes personal information (facial features in FIG. 5) stored in the memory unit 31 in association with the non-personal information (the date and time of use and store identification information in FIG. 5) corresponding to the accepted deletion request.

[0048] With the system 1 configured as described above, customers can read the code 110 printed on the receipt 100 with the camera 75 of the mobile terminal 70 and use the displayed deletion request form 80 and non-personal information to request the deletion of personal information. This makes it easier to request the deletion of personal information than, for example, a configuration that forces customers who want to delete their personal information to provide personal information. This is because customers are psychologically reluctant to have to provide other personal information (such as their name or email address) when requesting the deletion of their personal information.

[0049] The system 1 also includes a camera 17 (an example of an imaging device) that captures an image near the ordering device 10 (an example of a transaction device) used in transactions with customers, and the receiving unit 41 of the server 30 acquires biometric information (for example, facial features) contained in an image of the customer captured by the camera 17. Businesses that own the ordering device 10 and the server 30 can use the biometric information to promote sales, which is expected to result in highly accurate sales promotion.

[0050] In the system 1 according to this embodiment, the camera 17 is installed on the ordering device 10. By installing the camera 17 on the ordering device 10, it is possible to capture a frontal image of the customer, compared to a configuration in which the camera 17 is installed higher than the ordering device 10 (for example, a configuration in which the camera 17 is installed on the ceiling), and therefore the customer's face can be captured with higher accuracy. However, the camera 17 does not have to be installed on the ordering device 10. For example, the system 1 may extract the customer's biometric information using an image captured by a camera suspended from the ceiling.

[0051] The personal information is not limited to the biometric information of the customer, but may be, for example, information contained in a membership card read by the card reader 16 of the ordering device 10 (such as name, age, and gender).

[0052] Furthermore, in the system 1 according to this embodiment, non-personal information includes information (e.g., transaction information) that identifies a transaction performed by a customer on the ordering device 10. This makes it possible to obtain information for identifying personal information using images captured by the camera 17 of the ordering device 10. Furthermore, in FIGS. 5 and 6, multiple pieces of information, such as the date and time of use and store identification information, are used as non-personal information for identifying personal information. This makes it possible to identify personal information that should be deleted with high accuracy. In other words, since non-personal information may overlap with different personal information (e.g., the facial features "AAAAAAA" and "DDDDDDD" in FIG. 5) (e.g., the store identification information "1111" overlaps), using multiple pieces of information makes it possible to identify the information with high accuracy.

[0053] 5 and 6, the date and time of use and store identification information are used as non-personal information for identifying personal information, but if multiple ordering devices 10 are installed in a store, device identification information may also be used. In such a case, the storage unit 31 may store the device identification information in association with the personal information, and embed the device identification information in addition to the date and time of use and store identification information in the code 110 of the receipt 100.

[0054] Furthermore, the non-personal information may include the date and time of the image taken by the camera 17. For example, the date and time of the image taken may be used instead of the date and time of use. Even if the date and time of the image taken is used as non-personal information, it is possible to identify personal information. It is considered that after a customer appears in front of the ordering device 10, they select a product or service to be provided at the store (in other words, they press the food / drink button 121), complete the payment, receive the receipt 100, and leave the ordering device 10. Therefore, from the time the customer appears in front of the ordering device 10 until they leave, the camera 17 takes a picture every 10 seconds, for example, and the extraction unit 26 extracts the customer's biometric information from the image taken by the camera 17, thereby enabling highly accurate extraction of biometric information. Then, by using at least one of the date and time of the image taken or the date and time of use (in other words, the date and time when the payment was completed) together with the store identification information, it is possible to identify personal information with high accuracy.

[0055] Furthermore, in the system 1 according to this embodiment, the code 110 includes a URL (an example of access information) that can access the deletion request form 80 for requesting the deletion of personal information. This allows the customer to easily reach the web page of the deletion request form 80 by reading the code 110 with the camera 75 of the mobile terminal 70.

[0056] Furthermore, in the system 1 according to this embodiment, the printing unit 14 outputs a receipt 100 (an example of a recording medium) on which is printed a code 110 including a URL for accessing the deletion request form 80 and transaction information (an example of non-personal information). This enables the customer to automatically input the transaction information required to identify personal information into the deletion request form 80, which can be displayed on the operation display unit 73, by reading the code 110 with the camera 75 of the mobile terminal 70.

[0057] Here, a comparative configuration is considered in which, when requesting the deletion of personal information, a customer declares the date and time of their store visit, and personal information (e.g., photographed images) acquired at the declared date and time is deleted. In the comparative configuration, since it is possible that the exact time the customer visited the store is unknown, it is necessary to delete all personal information acquired during a certain time period, including the declared time. Therefore, even though it would be sufficient to delete the personal information of the requesting customer, there is a possibility that personal information of other customers that does not need to be deleted may also be deleted. As a result, in the comparative configuration, there is a risk that the accumulated personal information cannot be used for sales promotion. In contrast, the system 1 according to this embodiment automatically inputs transaction information necessary to identify personal information, thereby preventing the deletion of personal information that does not actually need to be deleted.

[0058] Instead of printing the code 110 on the receipt 100, a URL that can be used to access the deletion request form 80 can be printed in text on the receipt 100. This is because the customer can access the deletion request form 80 by manually entering the URL into the mobile terminal 70. The customer can also request deletion by manually entering the store used and the date and time of use printed on the receipt 100 into the "Store Used" field 81 and the "Date and Time of Use" field 82, respectively, on the deletion request form 80.

[0059] Furthermore, printing the code 110 and the URL for accessing the deletion request form 80 in text form is not limited to the receipt 100 on which payment information is printed. The printing unit 14 may, for example, print the code 110 used for the deletion request on a recording medium other than the receipt 100 (such as paper on which a reception number is printed (e.g., a product voucher or meal ticket)) and output it together with the receipt 100.

[0060] Furthermore, in the above-described embodiment, in the ordering device 10, the extraction unit 26 extracts biometric information (for example, facial features) of the customer from the image captured by the camera 17, and the association unit 27 associates the biometric information with the transaction information, but the present invention is not particularly limited to such an embodiment. For example, the ordering device 10 may associate the image captured by the camera 17 with the transaction information and transmit them to the server 30, and the server 30 may extract the biometric information (for example, facial features) of the customer from the image captured by the camera 17 and store it in association with the transaction information transmitted together with the image.

[0061] In addition, in the personal information deletion method performed by the system 1, the server 30 stores the customer's personal information and non-personal information related to the customer in association with each other, and the ordering device 10 provides the customer with deletion request information regarding a request to delete the customer's personal information and the non-personal information related to the customer. Then, the server 30 accepts a deletion request made by the customer using the deletion request information, and deletes the personal information stored in association with the non-personal information corresponding to the accepted deletion request.

[0062] Furthermore, the processes performed by the ordering device 10, server 30, mobile terminal 70, etc. described above can be realized by cooperation between software and hardware resources. In this case, the CPU of the control unit (e.g., control unit 20) of each device (e.g., ordering device 10) executes a program that realizes each function of the device, thereby realizing each function. For example, a non-transitory computer-readable recording medium on which a program is recorded is provided to each device (e.g., ordering device 10), and the CPU of the device (e.g., ordering device 10) reads the program stored in the recording medium. Alternatively, the CPU of the device (e.g., ordering device 10) downloads the program via the network 5. In these cases, the program read from the recording medium or the downloaded program itself realizes the functions of the above-described embodiments, and the program itself and the recording medium on which it is recorded constitute the present invention.

[0063] For example, the program realizing the functions of the ordering device 10 causes the ordering device 10 to execute a function of outputting the customer's personal information and non-personal information that identifies a transaction made by the customer to an external device (e.g., the server 30). In addition, the program realizing the functions of the ordering device 10 causes the ordering device 10 to execute a function of providing the customer with deletion request information related to a request to delete the customer's personal information and non-personal information.

[0064] Furthermore, the program realizing the functions of the server 30 causes the server 30 to execute a function of acquiring personal information of a customer and non-personal information related to the customer from the ordering device 10, and a function of storing the acquired personal information of the customer and non-personal information related to the customer in association with each other. Furthermore, the program realizing the functions of the server 30 causes the server 30 to execute a function of accepting a deletion request made by a customer and non-personal information related to the customer, and a function of deleting the personal information stored in the storage unit 31 in association with the non-personal information corresponding to the accepted deletion request.

[0065] In the configuration of the above-described embodiment, the store is a restaurant, but the store to which the system 1 is applied is not limited to a restaurant. For example, the store to which the system 1 is applied may be a retail store that sells products other than food or beverages. The store to which the system 1 is applied may also be a store that provides services such as a barber shop or a massage parlor. Alternatively, the system 1 may be applied to facilities such as art galleries, museums, and movie theaters.

[0066] (Modification of the deletion unit 43 of the server 30) The deletion unit 43 of the server 30 deletes personal information stored in association with the non-personal information received by the receiving unit 41, and may also delete personal information that is not stored in association with the received non-personal information but matches the deleted personal information. For example, if the date and time of use and the store identification information included in the deletion request are "August 1, 2024, 3:30 PM" and "1111," respectively, the deletion unit 43 deletes the facial feature "AAAAAAA" stored in association with "August 1, 2024, 3:30 PM" and "1111." In addition, the deletion unit 43 deletes all of the facial feature "AAAAAAA" stored in the storage unit 31. For example, in the example shown in FIG. 5, the deletion unit 43 deletes the facial feature "AAAAAAA" stored in association with the date and time of use and the store identification information "July 30, 2024, 3:05 PM" and "1111," respectively, and "July 31, 2024, 4:00 PM" and "1111." This allows the customer to delete even the data for which they forgot to submit a deletion request, improving convenience. [Explanation of symbols]

[0067] 1...personal information deletion system, 5...network, 10...ordering device, 14...printing unit (an example of a providing unit), 17...camera (an example of an imaging device), 20...control unit, 22...transmitting unit (an example of an output unit), 26...extracting unit, 27...associating unit, 28...generating unit, 29...printing control unit (an example of a providing unit), 30...personal information management server (an example of an external device), 41...receiving unit (an example of an acquiring unit, a receiving unit), 50...store terminal, 70...mobile terminal, 100...receipt, 110...code (an example of deletion request information)

Claims

1. a personal information acquisition unit that acquires personal information of customers; a non-personal information acquisition unit that acquires non-personal information related to the customer; a storage unit that stores the personal information of the customer acquired by the personal information acquisition unit and the non-personal information related to the customer acquired by the non-personal information acquisition unit in association with each other; a providing unit that provides the customer with deletion request information regarding a request to delete the customer's personal information and non-personal information related to the customer; a reception unit that receives a deletion request made by the customer using the deletion request information and non-personal information related to the customer; a deletion unit that deletes the personal information stored in the storage unit in association with the non-personal information corresponding to the deletion request received by the reception unit; A personal information deletion system comprising:

2. The personal information is biometric information of the customer detected from an image of the customer. The personal information deletion system according to claim 1.

3. an imaging device for imaging an area near the transaction device used for transactions with the customer; the personal information acquisition unit acquires the biometric information included in an image of the customer captured by the imaging device. The personal information deletion system according to claim 2.

4. The imaging device is installed in the transaction device. The personal information deletion system according to claim 3.

5. The non-personal information includes the date and time when the customer was photographed. The personal information deletion system according to claim 1.

6. The non-personal information includes information identifying a transaction performed by the customer on a transaction device used for the transaction with the customer. The personal information deletion system according to claim 1.

7. The deletion request information includes access information for accessing a deletion request form for requesting the deletion of the personal information. The personal information deletion system according to claim 1.

8. the providing unit outputs a recording medium on which a code including access information for accessing a deletion request form for requesting deletion of the personal information and the non-personal information is printed. The personal information deletion system according to claim 1.

9. the deletion unit deletes the personal information stored in association with the non-personal information received by the reception unit, and deletes personal information that is not stored in association with the non-personal information but matches the deleted personal information. The personal information deletion system according to claim 1.

10. a storage unit that stores personal information of a customer and non-personal information related to the customer in association with each other; a providing unit that provides the customer with deletion request information regarding a request to delete the customer's personal information and non-personal information related to the customer; a reception unit that receives a deletion request made by the customer using the deletion request information; a deletion unit that deletes the personal information stored in the storage unit in association with the non-personal information corresponding to the deletion request received by the reception unit; A personal information deletion system comprising:

11. Store the customer's personal information in association with non-personal information related to the customer, providing the customer with deletion request information regarding the deletion request for the customer's personal information and non-personal information related to the customer; Accept the deletion request made by the customer using the deletion request information, Delete the personal information stored in association with the non-personal information corresponding to the received deletion request; How to delete your personal information.

12. A transaction device used for transactions with customers, an output unit that outputs the personal information of the customer and non-personal information that identifies the transaction performed by the customer to an external device; a providing unit that provides the customer with deletion request information regarding the deletion request for the customer's personal information and the non-personal information; A trading device comprising:

13. On the computer, a function of outputting to an external device the personal information of the customer and non-personal information that identifies the transaction performed by the customer; a function of providing the customer with deletion request information regarding a request to delete the customer's personal information and the non-personal information; A program that executes the following.

14. an acquisition unit that acquires personal information of a customer and non-personal information related to the customer from a transaction device used in a transaction with the customer; a storage unit that stores the personal information of the customer acquired by the acquisition unit and non-personal information related to the customer in association with each other; a reception unit that receives a deletion request made by the customer; a deletion unit that deletes the personal information stored in the storage unit in association with the non-personal information corresponding to the deletion request received by the reception unit; A processing device comprising:

15. On the computer, A function of acquiring personal information of a customer and non-personal information related to the customer from a transaction device used in a transaction with the customer; a function of storing the personal information of the customer acquired by the acquiring function and non-personal information related to the customer in a storage unit in association with each other; A function to accept deletion requests made by the customer and non-personal information related to the customer; a function to delete the personal information stored in the storage unit in association with the non-personal information corresponding to the deletion request accepted by the accepting function; A program that executes the following.

Images