教育機構個人資料保護稽核機制之研究 -以某國立大學為例

A Study of the Personal Information Protection Auditing Procedure for Educational Institutions - A National University as an Example

周楷智(Kai-Chih Chou)

指導教授 ： 張碩毅

國立中正大學/管理學院/會計與資訊科技學系/碩士(2015年)

摘要

立法院於2010年完成延宕多時的新版個資法修訂並於2012年正式實施。新版的個人資料保護法將規範擴大為「個人資料的蒐集、處理與利用」。各大專院校皆積極投入個人資料的保護工作。不論是這幾年各校導入的資訊安全管理系統ISMS，抑或是目前個人資料管理系統PIMS 之建立。即便國內已有大學導入了個資保護機制，也獲得了BS 10012的認證，但其圖書館還是發生了個資外洩的事件(呂瑞麟，2014)，圖書館的館員不小心將廠商的資料外流，造成個人資料的洩漏。可見對於個人資料的保護，若僅導入保護制度是不夠的，必須還要去檢視或評估教育機構所導入的個人資料保護制度是否有落實抑或是否適合教育教構。
本研究透過國際內部稽核執業準則(IPPF 2013)建構出稽核流程之架構，詳細規範依循行政院所頒定之內部稽核應行注意事項、各機關內部控制制度自行評估原則，其中不足處另本研究參考公開發行公司建立內部控制制度處理準則之規範進行整體流程的補強；經由文獻探討，本研究得到了69項的檢查項目，依各機關內部控制制度自行評估原則中所示之COSO構面進行分類得到本研究之初步雛形，並採用德爾菲專家問卷方式，本研究共計進行兩回合的問卷，對本研究所建構之個資保護檢查項目做更進一步的修正與確認；依各機關內部控制制度自行評估原則之評分方法，並輔以CMMI的衡量機制作為評量的方法，作為教育機構在個人資料保護能力的狀態。最後，經個案研究透過受訪者的建議對機制進行修改，並實際進行單位自評，以確認本機制在實務上的可行性。
藉由上述的機制協助各機關快速且有效的辨識教育機構在個人資料保護能力的狀態，並進行後續的控制及改善。降低因個人資料不適當的作業，導致其外洩或違反個人資料保護法之規範所產生之訴訟或罰鍰以及形象受損之情形。

關鍵字

CMMI能力成熟模型 ； 稽核機制 ； 個人資料保護

並列摘要

Legislative Yuan has completed revised the long-delayed new version of Personal Information Protection Act in 2010 and was formally implemented in 2012. The new Personal Data Protection Act has expand including "Collection of personal data, processing and use of personal data." Institutions are actively involved in the protection of personal data. Whether schools in recent years introduced information security management system, ISMS, or establishing personal information management systems, PIMS. Even if one of the university in Taiwan has adopt the protection mechanisms and also received a BS 10012 certification, but an information leak event took place in its library (Lu Rui-Lin, 2014), librarians accidentally give-away vendors information, resulting in the leakage of personal information. Adopting the protection mechanisms alone is not enough. Develop of mechanism to examine or evaluate the appropriateness of the protection mechanisms that educational institutions have introduced is also critical.
This study adopt the international internal audit practice guidelines (IPPF 2013) as the framework of the audit procedure, the Executive Yuan issued Internal audits should be performed Precautions, The principles of self-assessment of internal control system, Guidelines for company to establish on internal control system for detail specification ; Through literature review, this study developed 69 check items, classification by COSO principles obtained initial prototype of this study and through Delphi method, this study conducted a total of two rounds of questionnaires, make further amendments and confirmation of check items of this study;
According to the internal control self-assessment system principles the scoring method is supported by CMMI assessment methods. Finally, through case study the auditing mechanism, has modified by interviewees' recommendations to ensure the feasibility of this mechanism.
With the above mechanisms rapid and effective identification of the state of protection of personal data in each educational institution is possible. Reduce the improper operation of personal data, avoiding breach of Personal Data Protection Act resulting of fines and damage the image of the educational institution.

並列關鍵字

CMMI Capability Maturity Model ； Auditing mechanism ； Personal Data Protection

參考文獻

王光遠. (2006). 公司治理中的內部稽核—從代理理論談起. 內部稽核, (54), 9-12.

任克之 (2012)，企業專家稽核機制之建立.品質月刊,48(5), 32-35.

余俊賢. (2010). 因應個資法修正後電子商務業者之資料安全管理與稽核實務.電腦稽核, (22), 103-109.

李順仁（2006），資訊安全：文魁資訊。

李榮耕. (2009). 個人資料外洩及個資外洩通知條款的立法芻議. 東吳法律學報,20(4), 251-291.