The end of the “era of collecting too much personal information” is said to be gathering pace, and the data landscape in Japan is beginning to change. Some have also pointed out that Japanese companies are slower to respond than their overseas counterparts amid tighter regulations abroad, and attention is focused on how the imbalance between data collection and use will change going forward.
In Japan, the trend toward marketing based on collecting personal information continued for many years, and companies actively accumulated customer data through member registrations via official apps. However, following the disclosure of a method known as the A2B attack, among other developments, the risk of information leaks has become apparent, and the need for urgent countermeasures has been highlighted.
Overseas, the implementation of the GDPR and tighter regulations in the Americas have advanced data minimization, bans on use for purposes other than those specified, and mandatory data deletion. Awareness of risk mitigation has consequently increased compared with Japan. By contrast, Japanese companies remain strongly focused on the benefits of data collection, and delays in implementing countermeasures have been pointed out.
Specific examples include cases involving Times CAR and BOOKOFF, where the impact expanded because data on members who had withdrawn was retained. The limited awareness of the risks of data use has been called into question. The recognition that data is an asset but can also pose risks is once again being tested.