There have been numerous reports lately of privacy breaches from Japanese businesses. On October 7, Lawson, a huge convenience store chain published that more than 2 million pieces of privacy information has been breached. The informtion includes names, addresses, email, phone numbers which will easily identify the individual. In light of the news, the administator of the governmental Digital Agency held a press interview and urged users to protect their information “by themselves.”
Needless to say, a most efficient approach would be that the businesses handling vast personal information data should protect them through technical and other means. The question is what kind of financial consequences the parties face under the law in the event of breach, and the damage is only 3,000 yen (about 20 US dollars) per individual according to a high court ruling. If the rate is applied to 2 million cases, Lawson will have to pay the maximum of about 6 billion yen (or 40 million dollars) for the breach, when and if all 2 million indviduals sue. Needless to say, it is not feasible for individuals to sue a major company for the benefit of 3,000 yen, and this low level of damage is effectively safeguarding the business’ lack of diligence in privacy protection because consequences are not important enough for the business to invest in data protection. So breaches will continue, regardless of governmental appeals or encouragement, as long as courts award only a minimum amount as damages.