遵循個人資料保護法之人事薪資系統再造-論文印刷版

Compliance with the Privacy Protection Act: The Implications for Human Payroll System Reengineering

劉漈浚(Chi-Chun Liu)

指導教授 ： 李興漢

大同大學/經營設計學院/資訊經營學系所/碩士(2011年)

摘要

新版台灣個人資料保護法於民國99年4月27日正式三讀通過，有可能在2012年正式實施，全台灣各政府單位及各產業都必須遵循此保護法的規範，企業為避免遭受龐大的罰款與名譽受損，因此必須更加注重資訊安全的重要性；而在企業資訊系統中擁有最多個人資料的系統應屬人事薪資系統(Human Payroll System)，經查目前市佔率較高的人事薪資系統都還存有一些洩漏個人資訊的弱點存在，例如：資料庫欄位未加密、存取筆數未設限和顯示畫面未對敏感性欄位隱藏等。有鑑於此，本文參考現行國內法規以及探討企業內部資訊安全控制，藉由專家學者的協助調查人事薪資系統應該做哪些必要調整，透過個案公司之人事薪資系統之配合修正，以驗證相關之修改能符合個人資料保護法之要求，降低此法對企業所帶來的相對衝擊，期望能找出低成本的因應方案，正視個人資料保護法帶來的好處，最終能將資料外洩犯罪率降到最低。

關鍵字

人事薪資 ； 個人資料保護法 ； 資訊安全

並列摘要

Passed by the legislature on Apr. 27, 2010, Taiwan’s new Privacy Protection Act will take effect in 2012. By then, all government departments and private sectors around the nation will be subject to the regulation of this protection act. In order to avoid penalties and loss of reputation for violation of the act, all enterprises must pay additional attention to information security. Among the current corporate information systems, human payroll systems contain most personal information of a company. A review of dominant human payroll systems in the market shows that most of these systems still have some weaknesses that may easily result in personal information leakage, including non-encryption of database columns, no limitation on maximum data access, visibility of sensitive columns, and so on. Therefore, this thesis investigates domestic laws governing information security and internal information security controls commonly used by enterprises. With assistance of experts and scholars, this thesis explores the necessary adjustments of human payroll systems for compliance with the Privacy Protection Act. The human payroll systems of a case company is used as an example to validate whether these adjustments can make it compliant with the Privacy Protection Act and reduce the relative impacts on the company. Holding a positive view of the benefits of the Privacy Protection Act, this thesis attempts to find a cost-effective response plan, which can ultimately minimize the crime rate of information leakage.

並列關鍵字

Human Payroll System ； Privacy Protection Act ； Information Security

參考文獻

35.陳蘭津,保護顧客資訊安全之探討,崑山科技大學企業管理研究所碩士論文,2005.

22.林蔭峰,"資料庫稽核技術新趨勢－Database activity monitors",電腦稽核期刊,Vol.22,pp.131-135,2010.

21.林益正,"資安保證與資料庫稽核",電腦稽核期刊, Vol.22,pp.118-127,2010.

14.余俊賢,"因應個資法修正後電子商務業者之資料安全管理與稽核實務",電腦稽核期刊,Vol.22,pp.103-109,2010.

11.行政院,個人資料保護法,2010.