|
<3> The Appointed Information Processing Organization System
Some of the governor's affairs in regard to Basic Resident Registration Network System can be delegated to the organization designated by the Minister, that is, the Appointed Information Processing Organization, because it is more desirable in terms of efficiency, accuracy and security that a simple professional organization implements these affairs rather than each prefecture individually does with adjusting it to other prefectures.
The affairs involved are as follows (Article 30-10, Paragraph 1 of the Basic Resident Registration Law):
(1) Informing the mayor of the Resident Card Code, which the mayor can put on the Resident Card, after allocating it to the municipalities so that Resident Card Codes will not overlap with each other;
(2) Giving Personal Identification Information to an organization which is listed on Appendix 1 of the Basic Resident Registration Law when receiving a request from such an organization with regard to processing the data on that table;
(3) Giving Personal Identification Information to a municipal executive organ within a prefecture when receiving a request from such an organization with regard to processing the data on Appendix 2 of the Basic Resident Registration Law or the affairs on the Basic Resident Registration;
(4) Giving Personal Identification Information to another prefectural executive organ when receiving a request from such an organization with regard to processing the data on Appendix 3 of the Basic Resident Registration Law or the affairs of cooperating with a mayor with regard to the Basic Resident Registration;
(5) Giving Personal Identification Information to a municipal executive organ in another prefecture when receiving a request from such an organization with regard to processing the data on Appendix 4 of the Basic Resident Registration Law or the affairs on the Basic Resident Registration; and
(6) Giving material regarding statistics etc. on Personal Identification Information to a national administrative organization and so forth.
A governor who delegates the above responsibilities to the Appointed Information Processing Organization (delegating governor) does not implement them except 3 and 6(Paragraph 3, ibid). A delegating governor shall inform the Appointed Information Processing Organization of the Personal Identification Information given by mayor through the Basic Resident Registration Network System so that the Appointed Information Processing Organization can implement it (Article 30-11, Paragraph 1 and 2 of the Basic Resident Registration Law). The Appointed Information Processing Organization records the said Personal Identification Information on the Magnetic Disc and preserves it (Paragraph 3, ibid).
When the Appointed Information Processing Organization finds that there is an error in the Personal Identification Information recorded on the Magnetic Disc of a delegating governor when administering and implementing the data, it shall inform the delegating governor of the fact as soon as possible (Paragraph 5, ibid); in addition, it shall give necessary technical advice and information on Personal Identification Information regarding electronic calculation processing to a delegating governor (Paragraph 7, ibid). Also, the Appointed Information Processing Organization must cooperate with a delegating governor to ensure the correctness of residents' records on the Basic Resident Registration (the same article, Paragraph 8).
In this connection, the Basic Resident Registration Law stipulates in detail matters concerning the Appointed Information Processing Organization such as criteria of designation, supervision and so on(Article 30-12〜30-28 of the Basic Resident Registration Law).
<4> Measures to protect personal information in the Network System of Basic Resident Registration
The Network System of Basic Resident Registration is managed communally as a national system for personal identification by Local Public Entities. Since information communication technology has characteristics to send and receive massive data in an instant, the system takes sufficient measures to protect personal information in all aspects, including the system, the technology and the use.
The measures to protect personal information in an institutional manner are, as previously stated, limitation of information in the Basic Resident Registration Network System to personal identification information, and restriction of the range of administrative organs which receive personal identification information, as well as restriction of its use, by the Basic Resident Registration Law. In addition, the law provides that Governors, Appointed Information Processing Organizations and administrative organs supplied with personal identification information may not use personal identification information for purposes not prescribed by the Basic Resident Registration Law. (Article 30-30 and 30-33 of the Basic Resident Registration Law)
Any official of a municipality, prefecture, Appointed Information Processing Organization and administrative organ supplied with personal identification information, who engage, or used to engage in, affairs concerning processing personal identification information on a computer, and any persons which these organizations entrust with processing personal identification information on a computer, may not leak any secrets relating to Personal Identification Information and to processing Personal Identification Information. (Article 30-17, 30-31 and 30-35 of the Basic Resident Registration Law) Any person who leaks said secrets shall receive up to two years imprisonment, or pay a fine of up to one million yen. This penalty is heavier than the normal penalty for a violation by public officials of the obligation to protect privileged information (up to one year imprisonment, or fine of up to thirty thousand yen). Any person entrusted with processing personal identification information on a computer by a prefecture, Appointed Information Processing Organization or an administrative organ (that is supplied with personal identification information) which engages, or used to engage, in affairs concerning trust, may not inform others, without reason, of things that have come to be known with respect to these affairs and may not use said information for inappropriate purposes. (Article 30-32 and 30-36 of the Basic Resident Registration Law) Added to these prescriptions, Article 30-29 and 30-33 of the Basic Resident Registration Law provide Governors, Appointed Information Processing Organizations, organizations which receive personal identification information, and persons which these organizations entrust with processing personal identification information on a computer shall prevent such information from being leaked, lost or damaged, and shall take other necessary measures for appropriate security of the personal identification information.
A Prefecture and an Appointed Information Processing Organization shall constitute a Council of Personal Identification Information or a Committee of Personal Identification Information, which will examine and deliberate regarding protection of personal identification information. (Article 30-9 and 30-15 of the Basic Resident Registration Law)
In regards to direct involvement in the Network System of Basic Resident Registration, first of all, the Basic Resident Registration Law prescribes specifically the range of administrative organs which receive personal identification information and the purpose for which it may be used. In addition, since a Governor (an Appointed Information Processing Organization which a Governor shall designate) shall write and publish a report at least once a year, regarding the status of offering personal identification information to organs of Japanese Government pursuant to Appendix 1 of the law, it is clear how personal identification information of the person is utilized in the Network System of Basic Resident Registration (Article 30-7, Paragraph 8 and Article 30-11, Paragraph 6 of the Basic Resident Registration Law). Anyone may demand of a Governor or an Appointed Information Processing Organization to release (including notification should there be no record of his or her personal identification information in the system.) in writing, his or her personal identification information recorded on magnetic disks (hard drive, floppy disk, etc.) (Article 30-37 through 30-39 of the Basic Resident Registration Law). Moreover, anyone who receives the above-mentioned release may request to correct, add or cut, content of his or her written personal identification information. In this case, a Governor or an Appointed Information Processing Organization shall promptly examine, and notify the applicant in writing as to the results of said investigation. (Article 30-40 of the Basic Resident Registration Law)
The following are measures adopted to prevent intrusion into the system from outside, protecting personal information in the Network System of Basic Resident Registration in a technological and utilitarian manner,
(1) Utilization of special lines; placement of a firewall and IDS (Intrusion Detection System).
(2) Encoding of transmitted data; communication following confirmation of the validity of the recipient's server in order to prevent from wiretapping and identity theft.
(3) In the remote event of an emergency, stoppage of the system based on an emergency plan to give top priority to the protection of personal information.
In order to prevent illegal utilization of the system by employees and so forth, the Network System of Basic Resident Registration has put the following measures into use.
(1) Strict identification by IC card or password of operators of municipalities, prefectures, Appointed Information Processing Organization and administrative organs which receive personal identification information, in order that only legitimate operators may operate terminal machines; limiting of the authority of operators to access data in the Network System of Basic Resident Registration.
(2) Maintenance of a record of terminal machine usage, to be inspected regularly, in order to trace when and what terminal machines are used and by whom.
(3) Organization of a security workshop for operators of municipalities, prefectures, Appointed Information Processing Organization and administrative organs which receive personal identification information.
On and after a determined date by a government decree no later than August 2004, information will be sent, by way of the Network System of Basic Resident Registration, regarding the Resident Card to municipalities. Municipalities will then issue copies of the Resident Card to non-residents. Information regarding Moving-out Certification and Moving-in Notification will be sent in order that people need only submit Moving-in Notification upon relocation. This kind of information will not be held in, nor will they pass through prefectural servers and Appointed Information Processing Organizations.
<5> Basic Resident Registration Card
From the date designated by cabinet order until August 2005, mayor starts the delivery of the basic resident registration cards on residents' applications (Article 30-44, Paragraph 1, 2 and 3 of the Basic Resident Registration Law).
The basic resident registration card is an IC card storing the data of the resident card code with advanced security. It is used for the purpose of personal identification on the delivery of resident cards to nonresidents or in the special procedure of moving-in or out. It is also used for reading out resident card code at the counter of the central government agencies, which are allowed personal identification information provided. Municipalities can use the free space in the card for other purposes provided in their ordinances (Article 30-44, Paragraph 8 of the Basic Resident Registration Law). In addition, Law Concerning Local Government's Public Identity Authentication of Electronic Signatures (Legislation number 153 in 2003) allows using the card as a secret key for the public identity authentication or a data media of electronic certificate. Basic resident registration card with picture is also expected to use as a photo identification card.
Free space and the area storing the data of resident card code is strictly separated by the application fire wall. Combining with the function of authentication of the basic resident registration card, the basic resident registration network system never allows the free space data in the card flowing into the network.
<Bibliography>
The data of the Basic Resident Registration System (Ministry of Home Affairs)
The revised commenter of the Resident Registration Law (Kenta Hiraga and Kiyomichi Agawa, Teikokuhanreisyuppannsya 1959)
The new commenter of the Basic Resident Registration Law (Edited by Ministry of Home Affairs, Nihonkajyosyuppan 1996)
|
