Personal Information Audit 1

Establish a reporting system for pursuing various agenda items through bodies such as the Privacy Protection Policy Council and Working-Level Council, and for reporting to executives (the CEO) on the Chief Privacy Officer’s (CPO’s) review of compliance with security measures and legal obligations. An internal privacy audit system needs to be established and implemented to conduct expert preliminary investigations and inspections into recent hacking and data breach incidents. Recognize that existing certification frameworks, such as ISMS-P, cannot prevent incidents. Despite the need to develop audit checklists that reflect the diverse characteristics of services and industries, and to carry out wide-ranging tasks—including reviewing internal personal information files and business processes (through flow analysis) at more than 1,000 partner companies and over 100 branches—these tasks are not being pursued. Although diverse blind spots must be addressed, experts lack the necessary knowledge to defend against them. Appropriate audits of existing security systems are not being conducted. Moreover, those regarded as experts in management systems are in fact not experts, resulting in recurring incidents and persistent risks. This study will address blind spots and strengthen reviews of existing security systems through detailed inspections, identify areas for improvement, and report the findings.