Unauthorized access to corporate systems is leaking personal information at a rising pace in Japan, and a legal scholar who studies privacy says the reason is that companies collect far more data than they can protect.
"Japanese companies are in what you might call a 'data-holic' state, believing the more personal data they collect the better," Hiroshi Miyashita, a Chuo University professor who specializes in constitutional and information law on privacy and personal data protection, said in an interview. Regulation in Japan has lagged behind the European Union, where personal information is strictly protected, he said.
The problem surfaced again when a service run by the GMO Internet Group was hit by unauthorized access. A security company in the group had pointed to vulnerabilities in the system, and the failure to address them drew criticism.
A habit built in the 2010s
Miyashita traces the habit to the push for big data that began in Japan in the 2010s, when smartphones spread and sensors shrank, making large-scale data collection cheap and efficient. The government promoted use of the data too. Its 2014 white paper on information and communications called for promoting the distribution and use of data so it circulates smoothly among individuals, companies and the government, to "accelerate innovation and raise the contribution to economic growth."
For companies, collecting data became an end in itself, Miyashita said. "That not holding more data than necessary is itself the greatest defense against cyberattacks is clear from this leak as well," he said. "Limiting the information you use also becomes the 'offensive' side of using information."
Two reasons leaks have grown
Miyashita gives two reasons why large leaks have become more conspicuous in recent years. The first is the spread, during the coronavirus pandemic from 2020, of identity checks carried out remotely online. Data from identity documents such as driver's licenses came to be sent through apps, multiplying the targets for unauthorized access, from the apps themselves to the cloud server contractors that handle them.
The second is the spread of high-performance artificial intelligence. "There is a risk that AI has lowered the cost of cyberattacks," Miyashita said. He cautioned against concluding that a series of unauthorized accesses were carried out by AI, because the people who break in, and the people who leave the openings, are human. "It can steer the debate toward whether AI itself is good or bad and let human responsibility be overlooked," he said.
Leaks predate the pandemic and AI
Large leaks of personal data by companies were repeated well before either. In July 2014, education publisher Benesse Holdings disclosed that about 35.04 million pieces of personal information had leaked, out of a total of 200 million records improperly taken.
Under Japan's Act on the Protection of Personal Information, deleting personal information that is no longer needed is only an "effort obligation" — a duty to try, not a legal requirement. "At the time of that case, deleting old data should have been made an obligation rather than an effort," Miyashita said.
Deleting data costs companies money. Apart from financial institutions, which are tightly supervised by the Financial Services Agency, many companies may still be holding data on people who have canceled their accounts, he said.