Japan's E-Government Policy - Its Security and Privacy

If you carefully trace the discussions in Japan over the protection of privacy and the Basic Resident Register Network, you come to notice that the discussions have become strangely complicated. The three milestone laws involved are the following:

• Law to Partially Revise the Law on Basic Resident Register (the so-called Basic Resident Register Network Law, enacted on 12 August, 1999)
• Bill for Protection of Personal Information (submitted on 27 March, 2001)
• Legislation concerning the Protection of Personal Information in the Possession of Administrative Agencies and Independent Administrative Institutions (submitted on 14 March, 2002)

How to protect personal information flying about on the networks has been a major policy challenge over the past few years, even spawning a major dispute between the United States of America and the European Union (EU). At the center of the international controversy was the reciprocity clause in the EU's directive on personal data protection (1995 EU Directive 95/46), which denies national treatment in an exchange of information with the EU on the network to any country that fails to provide the protection of personal information to the same extent being undertaken by the EU. The Bill for Protection of Personal Information listed above secondly was written in the context of these international trends.

The legislation calls, among others, for the "clarification of purposes of the collection of personal information," "prohibition, in principle, of the use of personal information for purposes other than the stated purposes," and "disclosure of information in response to the request of individuals concerned." These points alone, in a sense, are nothing special, and give you the impression that there are no problems to worry about. However, these provisions gave rise to a swirl of arguments that they threaten to undermine the freedom of media coverage and the people's right to know, ultimately leading to state control of information. For example, media have misgivings that when they make investigations into individual parliamentarians or bureaucrats on suspicions of corruption, they might be challenged to divulge the information they collected under the law for the protection of personal information, or could face governmental pressure for excessive encroachment on privacy.

In fact, the proposed legislation exempts the following organizations from the law, allowing them to protect personal information in accordance with self-regulation.

It would seem therefore, that there should be no problems. However, critics point their finger at the "gray" areas, such as the status of independent journalists who do not belong to any "organizations" or weeklies and other magazines. So, freelance journalists and writers as well as photo weeklies and other magazine publishers leaped to the forefront of those who were critical of the proposed legislation. The Yomiuri Shimbun (which evidently will be exempt from the law's provisions) received scathing criticism after it came up with own proposals to revise the proposed legislation, emphasizing that such legislation should be enacted. According to recent press reports, the government is considering revising the legislation by inserting a phrase assuring that the law would not "obstruct the freedom of expression" and by exempting the use of information for "literary purposes."

I know I am risking a barrage of condemnation, but I still feel that these arguments against the legislation are the "question of degree," so to speak. Is it possible in the first place to clearly define the scope of news reporting or literature just from the surface? I myself write several lightweight articles for several media, but does this make me a journalist? (I do not regard myself as one at all). The other day, I had an opportunity to talk with Mr. Harris Miller, president of the Information Technology Association of America (ITAA). He told me, "In the United States, the exemption is applicable, in principle, to 'news organizations,' not individuals. In a recent court case over the protection of privacy where the issue was whether a prominent journalist's activities to collect materials should be regarded as 'activities for news reporting,' the decision was negative." The exemption from rules beyond measure could give rise to moral degeneration. The most desirable path, it seems to me, would be for the law to put forth only the principles and the basic framework, with individual cases, if disputed, brought before court. At least, I harbor serious doubts about the advisability of entirely exempting all media organizations and people who are working in this area, most of which only until recently were clamoring for the "protection of privacy," but, when they sensed they could be cited for encroaching on that privacy, demanded they be "let off the hook," loudly declared their "total opposition" to the bill for the protection of personal information and called for the "complete withdrawal of the bill." I personally question the wisdom of providing the state with the discretion to predetermine "what is news reporting and what is not." On the other hand, however, there should be a certain mechanism in place that could "address, for instance, in court" whether individual media reports are really free from problems by way of protecting personal information. Unconditional release of media from the privacy protection is quite worrying to me.

What has made the already complicated situation even more complicated is this legislation. The bill was prepared to overhaul the "Act for Protection of Computer Possessed Personal Data Held by Administrative Organs," enacted in 1988 to clarify rules for the treatment of personal information held by administrative organizations.

Actually, the legislation contains a provision that enables the government to utilize personal information for purposes other than original purposes "if personal information held is used internally within the scope necessary for the execution of mandated business stipulated under law and when good reason for the use of such information is recognized." Moreover, the only penalty spelled out by the bill is the "penalty against those who obtain the disclosure of personal information for false reasons or through devious means," with a much narrower scope for punitive provisions than the Bill for Protection of Personal Information. It appears that regulations are softer on the "public sector" than on the private sector.

This issue is open to a variety of views. In Europe and the United States, it appears, the governments have considerable leeway in the use of personal information for non-original purposes when national security is at stake. In Japan, however, you get almost "allergic" responses to the use of certain terms such as national security. These circumstances may explain the above-mentioned general provision allowing the governmental use of information for non-original purposes. However, things became further complicated in the wake of the revelation that the Defense Agency made and circulated internally the list of individuals who requested certain information disclosure from the agency under the Information Disclosure Law. Personally, I would not want to entrust the nation's security to a government agency that readily hands out any information requested without identifying individuals who seek the disclosure of information. However, the Defense Agency has no excuses for concealing the results of its investigation after pledging its investigation into the list case and public disclosure of its outcome. The agency's blunder undoubtedly gave ammunition to those who argue that every government agency must be doing the same as the Defense Agency and therefore existing laws are inadequate to prevent these practices.

These developments are spilling out to affect discussions about the Basic Resident Register Network Law. Initially, the Basic Resident Register Network was contemplated as a response to the Internet age where a variety of information is being digitized, to make it possible to conduct various administrative procedures or receive various administrative services regardless of time or where you are. The Basic Resident Register Network was an idea to digitize resident registration information across Japan, and exchange and provide that information through the network. The law for launching the network was enacted in 1999. However, as concerns were voiced over the protection of personal information exchanged over the network, calls mounted for enactment of the Law for Protection of Personal Information. This time around, as the Bill for Protection of Personal Information was shelved, calls were spreading for shelving the planned 5 August 2002 launch of the Basic Resident Register Network. In addition, some began to question the security and technical specifications of the network itself. Such issues attracted little attention was the law was enacted in 1999. It is not at all inappropriate to discuss key technical problems concerning the network, but I still cannot help but wonder why now. Things have become so entangled that you are no longer sure what the original idea about the controversial network was and what are going to be the ultimate results.

First of all, the Basic Resident Register Network has been constructed in a disappointingly half-baked form. While it was originally designed to provide diversified administrative services of higher quality in the network (Internet) age, the controversy over privacy and other issues has turned the Basic Resident Register Network into the "closed" network comprising the leased private line and the virtual private network (VPN), making it impossible for individuals or businesses to access the data via the Internet. Furthermore, administrative procedures that can make use of the data have been limited only to a range of administrative work specified by the Ministry of Public Management, Home Affairs, and Posts and Telecommunications, relegating the whole system to a network that only serves the internal use by the government. The system built to take advantage of the convenience of the network has been cut off from the very network. Here again, there could be a legitimate question to be asked: Is it worth spending several tens of billions of yen in construction and billions of yen in upkeep to have a network that will be used simply to receive a resident card at a place other than the formal place of residence? Besides, we also feel inclined to question the government's assurances that "every possible measure has been taken to ensure the privacy and the system's security." All in all, we have ended up with this "disappointingly half-baked" result.

Personally, I am not too much concerned that much data contained in my resident register being exchanged through the network backed up with currently available security technology. This much risk, in my view, can be justified by the expected convenience of being able to handle such matters as seal registration, tax declaration, and notice of change of address from my home 24 hours a day. Further, risking being condemned as irresponsible, I would think that if IDs for the Basic Resident Register Network can be used for the computer-aided name identification, that could help to cause tax dodgers shrink, raise tax revenue, and ultimately lessen the burden on ordinary people like me. But I understand that there are people who like none of those things. Come to think of it, the Internet intrinsically is the network that respects "individuality." Various problems arise when the government tries to force that kind of system on the public. How about this: individuals should be given a choice between digitizing and not digitizing personal data contained in the resident register. Those who accept the digitization of personal information should be allowed to use the Basic Resident Register Network for various enhanced administrative services, while those who do not embrace the digitization are asked to live with some inconveniences relative to the network users. If the network's security is empirically verified by actual operations and everybody comes to see the benefits of the digitization and networking, then, as a result, we may be able to build a Basic Resident Register Network that is far more valuable than the current "half-baked" network.

What is complicating the situation further is the (intentional?) confusion of the issue of the protection of personal information by private as well as public organizations with the issue of restrictions on the media and distrust of government. Various views have been expressed over how to exempt the media from the application of the Law for Protection of Personal Information. However, the Japanese media that have been reporting on the issue of the protection of personal information by news organizations as if it were the question of restrictions on media activities are much less qualified to claim the legitimacy of their arguments. Or, am I the only person to feel that way about the media's behavior? There are problems on the part of the administration as well. The government's way of handling the Defense Agency list problem cannot be described as "noble," and its reasons to oppose new penalties against government officials for failure to protect personal information are far from convincing. If the government unequivocally demonstrates self-discipline, we then can discuss openly and in public whether the media's assertions are appropriate or self-serving. This may be the only way to reach some kind of understanding on either side. Unfortunately, however, the government is giving the impression that it wants to skirt that kind of discussion as much as possible. I would like to suggest the government initiate a lively and open discussion on these issues, interpreting the failure to enact the Law for Protection of Personal Information as an excellent opportunity to spend some time on such discussion. It has become evidently clear that the government's old way of getting key legislation enacted by adjusting interests only with the ruling parties is no longer tenable.