Themes and Policies of Local Government IT Outsourcing and the Protection of Personal Information

ABSTRACT

In order to realize secure IT outsourcing, privacy protection policies that include management by contracted company are an essential precondition. However, local governments' responses to this protection are very often haphazard. If IT outsourcing is implemented without sufficient privacy policies, personal information that is managed by local governments is at risk of being compromised

In order to grasp local governments' awareness of these dangers, FRI, in cooperation with the Institute of Information Security (Jouhou Sekyuriti Daigakuin Daigaku), conducted an inquiry survey of local governments across the country. The survey demonstrates that a necessary close relationship between privacy protection measures and the implementation of outsourcing is not normally present. There are some local governments that are engaged in comprehensive IT outsourcing even while having privacy protection regulations that are unimproved or not established.

Furthermore, it is clear that there exists a gap in perspectives on IT outsourcing between regional metropolitan areas. Though a difference between these areas in regards to the improvement of regulations and guidelines for the protection of personal information was not very noticeable, if we individually examine the actual countermeasures for privacy protection these differences become apparent.

In local governments that are either hoping to engage or are already engaged in IT outsourcing, it is indispensable that countermeasures including the establishment and improvement of privacy protection policies are developed quickly. Moreover, in order to advance IT outsourcing that is safe and secure, supportive measures for small local governments that lack outsourcing know-how are necessary at the national and metropolitan levels.