Safety in numbers?

The expanding scope of the My Number system

Text by Gavin Blair

The issue of personal data protection has been gaining increasing attention as ever greater chunks of our lives are recorded, and conducted, on the internet. Networks belonging to government pension systems, e-mail servers, gaming platforms and major companies have all been the victim of hackers.

When it was announced, the Japanese government’s My Number system was widely understood to be simply needed for tax and social security purposes. However, individuals’ numbers are already being required for some financial transactions, and the government has announced trials for later this year that could see the system expand in scope.

There are concerns that increasing use of the My Number system as a more general form of ID could heighten the risk of personal information leakage. At the same time, and partly in response to worries about leaks of such data, the government is introducing amendments to the law relating to the protection of personal information — a move that has implications for foreign companies doing business in and with Japan.

The Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, as the My Number legislation is referred to in English, was amended to expand its use even before it came into effect. The original 2013 act, which stipulated that every resident of Japan, citizen or otherwise, would be assigned a 12-digit ID number for tax and welfare purposes, similar to the National Insurance number in the UK and Social Security number in the US. Amendments to the act in 2015, however, added the provision for banks to collect the ID numbers of customers, on a voluntary basis, and for health insurance associations and local governments to make use of My Number for administrative purposes.

Some foreign residents of Japan have complained about being asked for their My Number ID when making or receiving overseas wire transfers at banks and post offices.

“As well as government authorities, some commercial entities such as securities companies can ask for people’s My Number if they are dealing in shares, because they have to submit records for the purposes of taxation,” explains Masako Banno, an attorney at Okuno & Partners, a Tokyo law firm. “Banks are also asking customers to provide their My Number, but it is not mandatory at this point.”

In fact, my Japanese bank told me that I needed to provide a My Number ID in order to receive an overseas wire transfer last year. When I pointed out that the bank’s own information stated it was not required by law until 2019, they reluctantly backed down.

“Some financial institutions have voluntarily added a clause to their standard terms and conditions forms stating that their customers must submit their My Number even before the end of 2018,” Banno notes. “These financial institutions want to collect this information smoothly before it becomes mandatory. In these cases, customers are bound by the contract and are obliged to submit their My Number.”

For now, the sole entity with the unquestionable right to ask for most people’s My Number is an employer.

“The only place My Number has been fully implemented is at the payroll level, though it is set to be introduced next year for life insurance,” notes Nancy Ngou, a partner at EY Advisory & Consulting.

“The risk of information leaks is one of the main reasons a lot of companies have outsourced the administration of My Number,” Ngou continues. “Then the third-party would be responsible if something happened; that is the way the contracts have been written. But there haven’t been any leaks so far, which was a concern before the system was introduced.”

This summer, the government is planning trials using My Number for library cards and shopping point cards, as well as to allow the sharing of information on residents between the central government and its prefectural and municipal counterparts. There are also plans to release a smartphone app in 2019 that will function as My Number ID verification. The gradually expanding use raises worries about information security and privacy, though the latter seems to be more of a concern for non-Japanese residents.

“Japanese people tend to be more trusting of government agencies and major financial institutions than Europeans,” suggests Banno. “If the My Number card were to be used for purposes such as a library card, the actual number on the back would be covered, but still be in the IC chip in the card. It wouldn’t be mandatory to use them, but it would increase the risk of information leaks.”

However, the government of Japan is taking steps to protect people’s personal information. Its primary means for ensuring the security of all private data, including My Number data, is in the amendments to the Act on the Protection of Personal Information (APPI) that were passed in 2015 and come into effect this year. Based on the amended version of this act, employees deemed to have misused any kind of personal information for “wrongful gain” could face up to a year in prison, as well as fines.

“From May 30th this year, APPI will also be applied to overseas companies doing business in Japan, even if they are not based here, like hotel-booking services or online shopping sites,” says Banno.

If a company in Japan transfers personal information to a company overseas, the company in Japan will be responsible for the security of the information at the overseas company. This will apply to every company, regardless of its size. If a company in Japan does not comply, it may be penalised by the Personal Information Protection Commission of Japan.

“Japanese companies are taking this very seriously,” Banno observes, “but many foreign companies don’t seem to realise its importance.”  •