The internal affairs and communications ministry has issued written administrative guidance to NTT Docomo after the carrier sent the phone numbers and user identifiers of 344,213 customers to Amazon Japan without valid consent, the ministry announced.
The ministry said Docomo's handling of the data violated the Telecommunications Business Act, which requires designated carriers to protect specified user information — data such as phone numbers and identifiers that can be tied to an individual subscriber.
The guidance, dated the day of the announcement, orders Docomo to ensure the information is handled properly and to put recurrence prevention measures in place. The carrier must also report on how those measures are being carried out.
How the data went out
According to Docomo's own report to the ministry, the problem arose when the carrier revised the online application flow for rate plans including Docomo MAX. The section explaining important terms and conditions no longer stated that user information would be provided to Amazon Japan, which runs services for Docomo MAX subscribers.
The division responsible did not notice the omission, and the revised flow was finalized with the disclosure missing. Customers were then not asked for valid consent before their data was sent.
The ministry said Docomo holds a designation under the act that obliges it to handle specified user information properly. Because the data went out without valid consent, the ministry concluded the information had not been adequately managed and that the law had been breached.
The ministry said it will continue to provide necessary guidance and supervision to protect user information.