SUICA scandal and the privacy in the era of Big Data

Recently, East Japan Railways Company (JR), oneof the biggest companies in Japan apologized for the sales of the data of its consumers. 

JR manages a system of electronic money called SUICA, which started from an electronic ticket for JR’s trains but now is one of the strongest electronic money widely used all over Japan. 

Recently, JR announced that JR and its partner company would sell the marketing report based on the data of SUICA users on (1) which station they get on and get off, (2) when they used the train, (3) how old they are, and (4) their gender.  For this purpose, JR gives the anonymized data of SUICA users to its partner company.  At first, JR got no consent from the users. There was no opt-in nor opt-out for the sale of their data.  When the announcement was made, there are many people opposing the usage, claiming that the sales of user data are an invasion of users’ privacy.

From the viewpoint of the Act on the Protection of Personal Information, which aims to protect personal information, JR may make an argument that it is not violating the Act. The act generally prohibits the transfer of personal information without obtaining the consent. But it is understood that the personal information defined does not include the anonymized information.

However, the fear of the users is that, many people are now using SUICA as their primary means of payment (partly because of SUICA point system whereby some percentages of the purchase are refunded), the log of the SUICA usage is a kind of life-log.  Whereas SUICA data can include sensitive information such as the purchase of certain kinds of books and magazines, it is sometimes possible to identify an individual by a sophisticated analysis of the life-log like data. Finally, JR apologized and offered an opt-out procedure.

It reminds me of the sentence in Viktor Mayer-Schonberger’s recent book “Big Data.” The book argued that the current concept of privacy is out of date in the era of Big Data. At least, one lesson is that companies dealing with Japanese customers which are collecting life-log like data ( including electronic money), must be very careful about its reputation risk when they “sell” user’s information even if they are anonymized.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Governmental Monitoring in Japan - PRISM Scandal?

As the PRISM scandal struck the U.S., there is a controversy over whether or to what extent the government may monitor private activities especially the ones online. The scandal is also widely broadcasted in Japan and last Tuesday, my friend (who is an associate professor at Chuo University) was interviewed live by a Japanese TV show. In Japan, there are two important issues regarding governmental monitoring of private activities.

First, there is a famous scandal of Tokyo Metropolitan Police Department Public Security Bureau. In late 2010, the bureau’s documents on alleged “terrorists” were somehow uploaded to a peer-to-peer network. What struck the Japanese society, especially foreigners residing in Japan, was that the police regarded the Muslim community in Japan as an organization in close connection with terrorists.  After the documents were disclosed, many protests occurred and finally, the police admitted that the information in the documents was the police information. This scandal reminded us how close and constant the police are monitoring us.

Second, another issue is the amendment of the Code of Criminal Procedure in 2011 (introduction of the Article 197-3) by which the police may ask information companies for the preservation of the data of a certain individual. This means that the police may ask for Facebook to preserve the communication log between User A and User B for 30 days and Facebook would have the obligation to comply with the request. Some opponents of the amendment called this a “cyber monitoring law.” 

It is difficult to tell whether it is a cyber monitoring law or not but one thing that is certain is that what this amendment enabled the police to ask is the preservation of past data not the retention of current and future data.  This means that currently the degree of the privacy invasion by the 2011 amendment is not very wide and strong. But we need to be careful about (1) whether the police may abuse the new authority to ask for retention and (2) whether the government will amend the code further to enable the police to ask for preservation, which would be more problematic than mere retention.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

A Japanese Court ordered Google to Enjoin Suggestion Function

In a French case, the court ordered Google Inc. to pay damages because of harmful suggestions when users enter the plaintiff's name. This kind of case also happened in Japan.

On April 15, 2013, Tokyo District ordered a preliminary injunction to enjoin a part of the Google's suggestion function. When you enter a key word, Google automatically suggests related keywords. When one man searched his own name, Google suggested a crime-related word with his name. As a result, users could easily search the allegedly fraudulent web articles which associated him with criminal conducts.

First, he sought a preliminary injunction (karishobun). In Japan, a preliminary injunction is granted when (1) there is a right to protect and (2) a necessity for the preliminary injunction.
In the case of enjoinment based on privacy invasion, the petitioner should at least show that (1) the tort claim is likely to stand and that (2) enjoinment is necessary for avoiding substantial detriment or imminent danger. In 2012, Tokyo District Court found both and issued a preliminary injunction. However, Google Inc. did not comply, saying that adding a search keyword is not a privacy invasion and is lawful according to U.S. laws. Therefore, he sued Google for damages and a permanent injunction. In an unreported judgement on April 15, 2013, Tokyo District Court agreed with him, awarding both damages and a permanent injunction.

Professor Sonoda commented that the Tokyo District Court opinion introduced European concept of "rights to be forgotten."

As the court opinion has not been published yet, I cannot comment on whether or not the court found the rights to be forgotten and if so, in what circumstances plaintiffs can assert such rights. However, two things can be said.

One good thing for the plaintiff is that in 2012, the Civil Procedure Law was amended to clarify the jurisdiction of Japanese courts on international cases. As a result, it has become easier for Japanese plaintiffs to ask for a Japanese court to decide on the merits even if the defendant is a foreign company. This may have contributed to the victory of the plaintiff.

But one bad thing is that it is still unclear whether Google will follow the order. An American lawyer might ask whether Google's conduct is a contempt of the court. In Japan, however, there is no general "contempt of the court" concept. (Note that some actions such as hindering the court procedure are illegal under a Law Concerning the Maintenance of Order in a Court of Law.) As a result, how to enforce a court order is important in Japan. As he got a permanent injunction, after the judgment becomes final, he can seek enforcement under the Civil Execution Act. One of the possible ways is by indirect compulsory execution, which asks the court to order a monetary sanction against the defendant in compliance with the original order. (Like A shall pay B $100 per day until A stops suggesting keywords when users search "B.") But as Japanese sovereignty does not extend to the USA, the enforcement is still unclear.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Google "Spy-Fi" Case in Japan

There are two kinds of issues of Streetview and privacy. One is the potential privacy invasion of pictures taken and uploaded (on which I already posted an article) and the other is Streetview car's collection of privacy information. Google paid a fine over a street view privacy breach in the United States. As the street view car collected privacy data from private networks (sometimes called as "Spy-Fi"), the attorney generals claimed that it was illegal and a settlement was reached. The same conduct also occurred in Japan and I will explain what happened afterwards according to Japanese laws.

Japan, unfortunately, has no overall privacy law. It is a patchwork of many kinds of laws, such as secrecy of communication protected by the Constitution, Act on the Protection of Personal Information, tort laws, Telecommunications Business Act, and other acts specific to certain industries.

In this case, the most relevant was Radio Law. "Nobody shall intercept wireless communication and leak the existence or contents of the communication, nor shall he make use of the information obtained by the interception of wireless communication." Article 59.

This, however, means that the act of intercepting itself is not illegal. According to Alan Eustace, Senior Vice President, Google never disclosed the information and it also has never intended to make use of the information. If it is true, it might be difficult to condemn Google's conduct as an illegal conduct. Of course, those whose privacy was invaded can file a lawsuit against Google by the theory of tort, as the victims do not know whether their own information was collected, this is not a realistic scenario.

What happened was that as Article 4 of the Telecommunications Business Act has a confidentiality clause, the Ministry of Internal Affairs and Communication rendered administrative guidance, saying that the conduct has the possibility to lead to the violation of the confidentiality clause.

But there are some problems on this logic. First, it is said that Google have not been reported itself as conducting telecommunications business (in Japan) according to the Telecommunications Business Act, because its servers are outside of Japan. Article 4 is only applicable to the telecommunications business.  Second, at the time when Google's street view car collected privacy information, Google was not transmitting the information. Article 4 of the Telecommunications Business Act only prohibits the communication business "dealing with" communication from invading confidentiality of the communication. As Google's role was merely a "collector" of information and not a "transmitter" of information, it is unlikely (at least from the rigid interpretation of the text) that Google's act falls in the prohibition of Article 4 of the Act.

I believe that one of the reasons why there was no official administrative or criminal action against Google and just the guidance is that it was difficult to make a clear and convincing argument that Google violated administrative or criminal privacy laws.

This may call for the enactment of a wide privacy statute. Although the new statute can work very well, there is also the concern on undesirable consequences the statute may cause. Therefore, in order to make a good law which reconciles between privacy and other important values such as freedom of speech or access to information, I believe that further research on American or other foreign country's examples might be necessary.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Is Google Street View a Violation of Privacy?

Although Google Street View is convenient and fun, several people have showed concern about it and there have even been some court cases as a result of Google's actions. Japan has a similar case, Jane Doe v. Google Japan Inc., which is called "Google Street View Case". Let me introduce this case briefly.

The case is somewhat similar to a well known American case of Boring v. Google, Inc., 598 F.Supp.2d 695 (W.D. Pa. 2009). Intuitively, you may think that what Google did in the Japanese case is worse than in the Boring case. In the Japanese case, Google accidentally took a picture of some underwear that a young woman had hung out on the balcony to dry. That picture was disclosed in Google Street View. The woman found the picture and sued Google Japan for invasion of privacy. After the woman filed a complaint, Google removed the picture from Google Street View.

The court found that the picture was not a high-resolution image, so the only thing that people using Google Street View could see was some kind of laundry being hung out, it was difficult to see that it was underwear. Based on that fact, the trial court concluded that Google's actions were within the range that the plaintiff should tolerate and rendered their judgment on the side of Google. Jane Doe v. Google Japan Inc., Home Page of Supreme Court (Fukuoka District Court, March 16, 2011). The woman appealed.

The appeal court affirmed. Jane Doe v. Google Japan Inc., unreported (Fukuoka High Court, July 13, 2012). The appeal court decided on two alleged privacy invasions: the invasion of privacy by photographing the underwear and the invasion of privacy by disclosing the photo. First, the court found as a general principle that when the photographing invades the interest of peace in a private life and is evaluated as illegal, such photographing consists of a tort of invasion of privacy. However, regarding this case, as the alleged underwear in the picture was far away from the place the photo was taken, the court found that it was difficult to even conclude that it was a picture of laundry. Therefore the court concluded that from a general point of view, the interest of peace in a private life was not invaded and thus denied the invasion of privacy by the photographing of it. Regarding the disclosure, the court first pointed out the same issue as the photographing. The court then pointed out that the disclosure was conducted not in a way to unreasonably attract the attention of the viewers. As a result, the court also denied the invasion of privacy.

One important thing to note is that at the time the case was argued in trial court, the plaintiff litigated by herself without any support from a lawyer. As a result, the plaintiff failed to secure the important evidence of the digital data of the picture. Before the lawyers became involved, Google had already removed the picture. So, the courts decided the outcome of the case based on the picture which the plaintiff had printed out in an Internet cafe, which the court described as being difficult to tell whether it was laundry or not. It may be another example of the difficulty of conducting a cyberlaw litigation without support from an expert lawyer. 

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Nationwide Shared Address Book App Provoking a Controversy in Japan

The hottest issue of information technology in Japan is the "Nationwide Shared Address Book App" or "Zenkoku Kyoyu Denwa Cho."  This is an android app which by installing you share your address book in your smartphone with all the other users of the app.  The result is that even though you don't want your personal information like name, address, and phone number to be disclosed, your personal information will be compromised, once one of your friends installs this app!  It is said that together with the data already held by the App producer, more than 28,000,000 individuals' personal data have been compromised.

The launcher of the App is called Tottori Loop, a Japanese group in Tottori prefecture (South West of Honshu) protesting the Dowa policy of Japan. The Dowa policy is favorable treatment of the descendants of those who used to be discriminated against.  Already in around 2012, the group ran a site called "Jusho de Pon!," or "Enter the Address and Telephone Number Pops Up!" As the name shows, this is a database site where personal information like the name or the telephone number is searchable by entering the address. The intention of the group is not clear.  As most of these people treated favorably live in a certain area called the "Dowa Area" or "Dowa Chiku," one possible intention is that they want to let people know the information of those who currently live in the Dowa Area.  The group seems to be using the data in published phone books from around 2007, before everyone started being concerned about privacy and is now trying to obtain the newest data by letting users share their own address book information.

Japanese privacy experts are opposed to the group, saying it may violate privacy rights of individuals.  But there is one issue that makes the situation complicated.  All the users of the app agreed to the terms of service and privacy policy of the app when they installed this app.  The famous discussion on twitter between HiromitsuTakagi, a researcher at GTRC, National Institute of Advanced Industrial Science and Technology, and the group members revealed that the group's position is that it has not breached any existing laws and regulations because the users agreed on terms of service and "voluntarily" disclosed the data.

However, it seems to me that the group is misleading the argument.  Let's say Amy's address is in Bill's address book.  When Amy gave Bill her address, in most cases, she did not consent to sharing her address to anyone (other than Bill). By then installing the app, Bill might have consented to share Amy's personal information.  But, of course, Bill cannot lawfully consent to share Amy's personal information because the owner of Amy's information is Amy, not Bill.  So, I do not think that the argument by Tottori Loop is persuasive.  In addition, as most of users do not read the terms of service, there is another argument of whether the users really consented.

Whether the apps will be removed from Google Play is not clear.  But it can be an "unauthorized publishing or disclosure of people's private and confidential information" in violation of the policies.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.