The Need for a National Consensus

Three major tasks remain before the legal system can be revised. First, Japan must form a national consensus regarding the use of personal information as big data. 

An incident that symbolized the lack of this consensus came to light in June 2013, when it became known that the East Japan Railway Company (JR East) had partnered with Hitachi, Ltd. to gather and anonymize passenger data collected from the railway’s Suica contactless smart card, with an eye to then selling this big data to third-party companies. This revelation sparked a reaction among JR East customers concerned about privacy infringement.

Some said that JR East had not taken adequate steps to anonymize the data. The company was not engaged in any illegal activity as long as it was complying with the Act on the Protection of Personal Information, though. The reason that JR East came under such harsh criticism was that its business partner Hitachi suddenly announced a new service that would make use of the data, raising questions about whether it was operating in good faith.

Although the data was anonymized, the fact that it would be used for commercial purposes clearly upset some customers. This case points to the need, first of all, to explain to customers whose information is provided to third parties what are the reasons for utilizing this information, in both social and business terms, and how the use of big data will benefit them.

Taking Into Consideration Overseas Rules

The second need concerns how to establish fair competition among foreign and domestic firms. The European Union has issued a directive on safeguarding privacy that forbids importing data on individuals from EU countries to any country whose own standards of privacy protection are not on par with those of the EU.

Therefore, even if the Japanese government succeeds in creating a new law on private information and establishes a third-party regulatory body, if the EU determines that the level of protection in Japan remains inadequate, Japanese firms will be unable to conduct business on an equal footing with firms based in EU countries. If Japanese companies cannot globally manage their information on local employees and customers, this will place them at a disadvantage against their European rivals. 

When it comes to the search engines, social media sites, and security software that are now so important to network information services, countries like China and South Korea have developed their own domestic offerings. Japan, meanwhile, still relies heavily on the United States. Because information on Japanese consumers is handled by firms like Google, Apple, and Amazon, Japan is not able to control its own data. If concerns arise in Japan about those firms violating customer privacy, those concerns may not be adequately addressed because of differences in legal jurisdiction.

The Role of the “Third-Party Body”

The third and final question to address is the role of the third-party body. The current discussions within the IT Strategic Headquarters envisage the body’s role as evaluating the voluntary standards created by the private sector and holding screenings to address problems that arise. But giving this body too much authority could stifle private sector activity and impede the free utilization of data.

In the case of the United States, there is no comprehensive law in place to protect
personal information such as Japan's PIPA. Instead, industries are required to institute their own rules; when problems arise the Federal Trade Commission can issue harsh punishments. Japan probably would not be able to easily adopt a similar approach due to differences in culture and public opinion. The key point, in any case, is the need to build the environment necessary for the use of big data in a way that is well balanced with policies that safeguard personal information.

The outline for revisions of the personal data usage system formulated by the IT Strategic Headquarters calls for safety measures for consumer data provided to a third party, including the requirement that those handing over the information anonymize the data. The outlines strictly forbid the receipient to compare it to other data in order to verify the identity of customers. From the perspective of safeguarding privacy, such measures are natural, as well as an important way to craft the sort of environment where people can feel peace of mind about the provision of their personal data while still permitting that big data to bring tangible benefits to everyone.

The economic benefits of the use of big data are estimated by the government to be around ¥7 trillion. And these benefits will extend to a wide range of areas, including medical care and transportation as well as research and development. Some private-sector estimates even claim that the economic benefits will exceed ¥20 trillion.

The US government, with its sights set on these benefits, has been making a concerted effort to assist the training of more data scientists and to support investment in technical developments related to big data. Japan cannot sit idly by. Now that the Abe administration has been making steady progress toward new IT and big-data strategies, we can hope that big data will be utilized to strengthen Japan’s global competitiveness and improve the quality of citizens’ lives. 

(Original article in Japanese published on October 17, 2014. Banner photograph: A woman trying out facial recognition technology at a trade show © Jiji Press.)