Privacy rights and ‘big data’

The government is moving to expedite the use of massive amounts of personal data — collected online or otherwise from a variety of sources — for commercial purposes on condition that the data is processed to ensure anonymity of the information.

The move is in line with the Abe administration’s position to facilitate businesses’ greater use of “big data” for development, sale and advertising of new products and services. The government estimates huge economic benefits from the use of personal data, but it needs to take effective steps to make sure that people’s privacy is not compromised in promoting the use of private information as a business tool.

With the advance in information and communications technology that enables quick and cheap collection as well as analysis of massive streams of electronic data sent from personal computers, smartphones and other devices, businesses in particular place high value on information such as people’s gender and age, records of their Internet browsing and transactions, as well as the location of their smartphone handsets — which shows the movements of users — as tools for identifyng the needs and preferences of customers as well as their behavioral patterns.

What has been lacking up to now is a clear set of legal rules on how far these data can be utilized without violating people’s privacy. Under the 2005 privacy protection law, parties that handle people’s personal information are not allowed to provide their data to third parties without obtaining consent from those individuals.

An outline of such rules compiled in June by a government conference discussing the nation’s information technology strategy, led by Prime Minister Shinzo Abe, said that people’s individual data can be supplied to third parties or used in ways other than originally specified purposes without their consent on condition that information such as names and addresses are deleted to reduce the risk of the individuals being identified.

It urged that sensitive information such as the ethnicity of the individuals or those pertaining to thoughts and beliefs be handled carefully and that furnishing such data to third parties be prohibited in principle.

The outline said collection and analysis of big data on individuals will contribute greatly to the creation of new industries and services, and called for clarifying the scope of information to be protected and the rules businesses must follow in situations that were not assumed under the existing legal system but are now possible because of advances in information technologies.

While rules such as the specific methods for processing data to ensure its anonymity is to be set by the private sector, the outline called for the establishment of a third-party body to ensure effective implementation of the rules.

The government plans to have the outline reflected in a proposed amendment to the privacy protection law to be submitted to the Diet next year.

The latest edition of the government’s information and communications white paper estimates that the growing use of big data by Japanese firms pushed up the combined sales of domestic industries in 2012 by ¥60.9 trillion, or 4.6 percent of total sales, by contributing to product development and promotional activities.

Some estimates show the domestic market of big data analysis service will top ¥1 trillion in 2015. Big data analysis is also expected to play an important role in scientific research including studies into remedies for diseases that are extremely difficult or impossible to cure.

It seems obvious that use of such personal data provides ample business opportunities. The question is whether the rules to be adopted will make sure that the information to be used and circulated will be kept strictly anonymous to protect individuals’ privacy. Experts point out that it would be possible to identify individuals from the seemingly anonymous data by comparing it with other sets of data.

The government and businesses also need to realize that people are wary of having their personal information used without their consent — even if there is little chance that they will be identified.

Last year, East Japan Railway Co. (JR East) was forced to suspend its sale of data culled from passenger records kept on its Suica train pass and e-money cards to Hitachi Ltd. when it was revealed that such data had been supplied without informing its customers of the arrangement.

The supplied data, which Hitachi used to start a service to provide marketing information related to areas around JR stations, included cardholders’ birth year and month, their gender, the stations at which they got on and off the train and the times, and their train fares.

The ID numbers on the cards were altered so that individual holders would not be identified, and JR East said it did not consider the data private. Yet, more than 60,000 holders of Suica cards — more than 45 million of which have been issued — urged the firm to delete their data from the information to be sold after JR East said it would accept such a request from customers.

The new rules for commercial use of personal information should be crafted in ways that address people’s legitimate concerns. The third-party organ to certify the voluntary rules to be set by private-sector organizations and supervise their implementation needs to be given sufficient power so that it can provide effective oversight over the way such data is actually be used.

No efforts should be spared in order to obtain sufficient public support in the matter.