摘要
2010年4月27日立法院三讀通過了個人資料保護法。在未來企業組織無論規模大小、擁有個人資料數量多寡都會受到個資法規範，此法無疑對企業組織造成衝擊。因此積極著手規劃及實行個人資料的資安防護是企業現階段重要的研究課題。ISO 27001是資訊安全管理系統的國際標準，但企業遵循ISO 27001無法代表對於個人資料保護工作的完整性。加上現有企業資訊安全主要重點是放在營運機密資料，較少以客戶的觀點出發，造成個人資料保護上有所不足。因此對於企業組織來說，必須調整與建置合適的資訊安全架構來控管個人資料作業流程以符合法規要求事項。本論文採用Gowin's Vee的研究策略，在理論端先透過文獻探討方式蒐集國外個人資訊管理系統（Personal Information Management System）並與國內個人資料保護法結合，歸納出一套包括四個控制領域、十五個控制目標與七十五個控制項目的企業個人資料保護管理機制雛形。接續透過德爾菲問卷請專家修正及提供建議，並新增為七十六個控制項目。最後在方法論端透過個案研究與使用認知意願問卷，確立企業個人資料保護管理機制的可用性、影響及貢獻。本研究期望能夠提供一套個人資料保護的管理制度，供企業做為參考與遵循之用，幫助企業達成遵法目的，降低罰鍰與訴訟風險且讓企業善盡個人資料保護與管理職責。
並列摘要
The Legislative Yuan passed the Personal Data Protection Act on April 27(superscript th), 2010, and it let the personal data protection issues call the public's attention. In the future organization, regardless of their size or the amount of personal data, will be subject to the Personal Data Protection Act. It affect the data collection and processing way and the marketing practices, and it also increase criminal penalties and compensation. Therefore, the enterprise should engage in planning and implement information security protection of personal data at this stage in quickly. ISO 27001 is an international standard of information security management system. But this is not representative for the integrity of personal data protection in the enterprise when they follow ISO 27001. The enterprise's information security is focus on the confidential information and less to the customer's personal data. It make inadequate on personal data protection. The enterprise must adjust the appropriate security structure to control personal data processes to meet compliance requirements.This study applies the Gowin's Vee research strategy. In the conceptual side, we sorted out 4 control domains, 15 control objectives, and 75 control measures which develop the Enterprise Privacy Protection Management Mechanism by literature review about Personal Information Management System and Personal Data Protection Act. Then we apply the Delphi Expert Questionnaires to fix this mechanism and add a new control measure. In the methodological side, we use the case study to verify and assessment the practicality and availability of this mechanism. This research shows that the research outcome, the Enterprise Privacy Protection Management Mechanism, provides organizations a reference and compliance purpose to help them obey the law, reduce the risk of litigation, and fulfill the responsibilities of protect personal data.