Legal Protections and Management Obligations of "Secrets": A First Step in Considering Information Security Law

ABSTRACT

With the full-scale incorporation of the Information Privacy Protection Law on 1 April 2005, the level of awareness regarding the issue of information security is higher than ever. However, the protection of personal information is but one aspect of the broader issue of information security. Without exhaustive research as to how the intangible commodity of information in general is legally protected, it is impossible to survey the legal system of information security.

In response to this, this report first introduces the three facets of information security and touches upon the subtleties of information. Additionally, this report raises the topic of "secrets"-what legal constituents (state/companies/individuals) most want to protect-and examines how secrets are legally protected and what management responsibilities are necessary in order to enjoy such protection.

It is concluded that, for current legal constituents, "secrets" as legal objects are not sufficiently considered nor protected, and that there is clear nonconformity and a lack of appropriate law. Furthermore, constituents appealing for protection must conduct suitable secrets-management in order for secrets to be legally protected, but what degree this management must satisfy is not always clear.

If the above observations are expanded to include other elements of future information security like "integrity" and "availability", and further, digital information goods in general, general principles concerning the appropriate parameters of information protection for each object can be extracted. This report does not intend to be comprehensive, but rather to serve as a first step, drawing on and revising the first half of Hayashi and Ishii (2005).