個人資料作業風險評鑑機制之建構與實證

A Study of Risk Assessment Mechanism for Personal Information Operations

蘇仲杰(Jung-Jei Su)

指導教授 ： 張碩毅

國立中正大學/管理學院/會計與資訊科技學系/碩士(2013年)

摘要

近年來資訊科技的應用成為企業成功與具備競爭力的關鍵因素之一。然而隨著時代的演進，各種採用資訊科技所導致的資訊安全事件層出不窮。2011年日本Sony與2012年我國兆豐銀行，分別因網站遭到駭客入侵以及硬碟銷毀過程的監督不慎等資訊安全事故，導致組織所持有的大量個人資料外洩，進而遭到台灣司法單位與金管會開罰。
針對個人資料保護的部分，我國於2102年正式實施新版的個人資料保護法，擴大保護主體與客體，現今所有的自然人以及各種形式的資料均受到新法的保護與規範。在新法中亦加重罰則並嚴格要求蒐集、處理與利用的過程中應遵循之規定，此法之實施勢必對持有個人資料的組織造成不同等級之衝擊。因此本研究期許能建構一套風險評鑑機制，協助企業或組織有效的辨識個人資料在作業過程中(蒐集、處理與利用)所可能產生的風險，使企業能杜絕個人資料外洩以及觸法的風險，並善盡資料管理的責任。
本研究採用Gowin’s Vee的研究策略，在文獻端以紮根理論的方式進行文獻的蒐集與探討，找出個人資料作業過程中可能的風險，並採用ISO 27001的11個控制領域作為本研究所探討出64項風險因子的分類架構，建構本研究之風險評鑑機制。接著透過專家問卷的發放，確定本研究所探討之風險因子是否適合，並透過專家的填答獲得不同風險因子間的重要性，藉以了解風險因子的排序。在實證研究端透過個案訪談的方式，了解實務界目前對於個人資料保護法實施所面臨的衝擊以及因應方式，並進一步的探討本風險評鑑機制在實務界使用的可行性。期許藉由本研究之成果，能有效且快速的協助企業或組織辨識個人資料作業過程中可能的風險以及風險的重要性，使組織或企業不會忽略可能的風險，同時也不會誤判風險的重要性，進而使組織可以降低違法或是產生個人資料外洩的風險與機率。

關鍵字

ISO 27001 ； 風險評鑑 ； 個人資料 ； 資訊安全

並列摘要

In recent years, the application of information technologies have become one of the key factor for companies to make business successfully and competitively. However, with the evolution of the times, all of the information security events resulting from the use of information technologies occurred one after another. The events of SONY Japan in 2011 and Mega Financial Holding Taiwan in 2012, for example, due to the information security accidents of website hacked and the careless supervision for hard disk drive destruction process, respectively, resulted in a lot of personal information leakage, and was fined by Taiwan's judicial authorities and FSC.

In Taiwan, Personal Information Protection Act was implemented formally in 2102, the protected subject and object was expanded, all of today's natural and various forms of information are protected and regulated by the new law. In the new law, the penalty is also enhanced and strictly requires that some rules must be followed during the process of collecting, processing, and using, and the implementation of this low should results in different levels of impact to those organizations who own personal information. Therefore, it is expected to build up a risk assessment mechanism in this research to help enterprises effectively identify those possible risks generated during the process (collection, processing, and using) of personal information.

In this research, Gowin's Vee research strategy is adapted. In theoretical side, the literature collecting and studying are based on the approach of Grounded Theory to identify the possible risk (factors), and build up the risk assessment mechanism (discussed in this research) by the 64 risk factors classification framework which is generated from the 11 control areas of ISO 27001. Then, make sure the risk factors discussed in this research are suitable through the mechanism modification by expert questionnaires distribution. In the methodological side, through interviewing individual case to realize the impact to the implementation of the Personal Information Protection Act in the industry, and take further feasibility evaluation. Based on the results of this research, it is expected that an effective and quick method is developed to assist enterprises to identify possible risks and the importance of those risks in processing personal information, such that, the enterprises will not ignore those possible risks, on the same time, will not misjudge the importance of those risks either, therefore, reduce the chance of risk and possibility of illegal issues or personal information leakage generated by enterprise.

並列關鍵字

Risk Assessment ； Personal Information ； Information Security ； ISO 27001

參考文獻

朱柔若（2000）。社會研究方法: 質化與量化取向：楊智文化事業股份有限公司。

行政院研究發展考核委員會（2005）。國家資通安全技術服務與防護管理計畫電子資料保護參考指引(草案)。

何星翰、呂敏誠（2010）。由資訊安全管理之風險評鑑，協助企業營運永續，確保核心競爭力。品質月刊，46（7），26-27。

李順仁（2006）。資訊安全：文魁資訊。

李榮耕（2009）。個人資料外洩及個資外洩通知條款的立法芻議。東吳法律學報，20（4），251-291。