Japanese companies are moving to stop collecting customer personal data they do not need, after a run of breaches caused by unauthorized access, with the operator of a barbecue chain and the parent of a car-sharing service both changing how much they hold.
Yakiniku King, a grilled-meat restaurant chain, disclosed in October that a breach had exposed the names, phone numbers and other details of about 10 million members registered on its official app. Its operator, Monogatari Corporation, has decided that from next year app registration will no longer require a name or phone number, the Asahi Shimbun reported.
A public relations official at the company said cyberattacks are seen as growing more sophisticated with the rise of AI, and that it had concluded "the greatest safety measure is not to hold the personal information that needs protecting in the first place."
License images deleted on the spot
At Times Car, a car-sharing service whose breach exposed personal information including driver's licenses, parent company Park24 announced in October that images of identity documents such as licenses will be deleted immediately after verification at registration.
The company had kept members' image data for seven years after they canceled their memberships. It changed the rule over the risk of holding data for long periods.
The shift is spreading to companies that have not suffered a leak.
An expert familiar with the history of customer-data use has argued that companies should not hold more than they need.