East Japan Railway Co.’s sales of passenger records from its Suica electronic cards has highlighted the problem of how to protect individuals’ privacy when huge amounts of money can be made from so-called big data--huge amounts of data that businesses see as gold.

Such data include what time people pass through the ticket gates of certain stations, what kind of books they buy and which TV personalities they like. Also included are information such as goods purchased through online shops, tweets and location information based on the Global Positioning System.

“They say it’s anonymized, but it’s still creepy somehow,” said Hitomi Shibasaki, 24, a company employee who had just passed through a ticket gate Thursday at JR Kanda Station using a Suica card. Suicas are e-cards with an IC chip that people can use to ride buses and trains mainly in the Tokyo metropolitan area.

On July 1, JR East began selling records of the use of trains and buses by Suica card holders to Hitachi, Ltd. for market research purposes. JR East sells data only on the users’ gender, age and time of getting on and off trains and buses, after removing their names and addresses.

However, this triggered protests among cardholders because the railway operator did not give customers prior notice. JR East claimed the information did not constitute personal data.

A 35-year-old company employee from Funabashi, Chiba Prefecture, complained: “Isn’t it a problem that a company uses data without letting the [card] users know?”

As the spread of personal computers and smartphones continues, extensive records of individual behaviors are stored on the Internet or at companies. Businesses have high hopes regarding those data, believing they can analyze them to create ads or products to meet consumer needs based on individuals’ hobbies and tastes.

The U.S. online retail giant Amazon.com provides information on recommended products to customers, based on their past purchase records, when they log on NTT Data Corp. buys tweets from Twitter Inc. to use for market research, while Yahoo Inc. distributes digital advertisements to meet its users’ interests by reading the contents of their e-mails. Fujitsu Ltd. uses location information provided by taxi companies to forecast traffic jams.

The government’s growth strategy, approved at a Cabinet meeting in June, incorporates “utilization of data.” The Internal Affairs and Communications Ministry estimates the potential economic effects at about 7.77 trillion yen a year.

However, the business of utilizing big data has not taken off as expected. A senior ministry official said: “While Japanese are sensitive to privacy issues, there are no rules to deal with privacy. So companies are hesitant to enter the market.”

A Hitachi spokesperson said the company has been seeking ways to utilize big data since around 2005: “We’re carefully looking for the right timing to enter the market for individuals’ information.” It seems businesses were also reluctant to buy the analyzed data from Hitachi, worrying about customers’ reactions.

Legal pitfalls

The Personal Information Protection Law stipulates that a person’s consent is required when providing individual information about that person to a third party. However, most personal data included in big data do not fall under the law’s protection because the law defines “personal data” as information that can identify individuals with names and addresses, for instance.

Since around 2005, when the amount of personal data collected or stored began to drastically increase, the ministry and other bodies repeatedly held study meetings to set appropriate rules, but all such efforts ended with only compiling proposals.

A recent study group of the ministry compiled basic rules for utilizing personal data in June. The rules stated that a company should incorporate privacy protection measures when developing a new product and that the amount of data to be acquired should be the minimum amount necessary. It also said the data should be used in ways that conform to individuals’ expectations and people should be involved in the process of deciding how their data will be used.

However, improvement of the legal system does not follow such a situation.

“Japan does not have a public body to handle privacy issues. Therefore, people cannot tackle a problem even when their personal information is handled in a murky way. This also causes businesses to hesitate to aggressively use such data,” said Prof. Fumio Shimpo of Keio University, an expert on information-related legislation and privacy issues. “I think a third-party organization with the authority to monitor and consult with companies and individuals should be established immediately, as in European countries.”