Jun. 11, 2020

Summary

• With the new lifestyle these days (the new normal), measures that will both prevent infection and stop the spread of infection are necessary, and active utilization of ICT can be expected. Services that provide large-scale statistical data utilizing location information and services that alert people to the possibility etc. of contact with infected persons, and efforts to effectively use personal data including personal information, are being developed by private enterprises and governments while taking into consideration privacy protection.
• Generally, Japanese people have a rather low tolerance to the provision of personal data. On the other hand, if personal data is to be provided to help stop the spread of infection, even in the case of highly sensitive information such as location information of mobile phones, as long as the data is anonymized, the percentage of Japanese people willing to allow government use increases to 74%. The tendency to allow use of location information services to prevent infection and to stop the spread of infection is generally high, and it is thought that the provision of such services will be effective.
• Measures to protect privacy in the utilization of ICT differ significantly among countries. China and South Korea have both taken measures where the governments mandatorily collect information that can identify persons who have had contact with infected persons and location information, while the U.S., U.K., and Japan do not access information of persons who have had such contact, and downloading contact tracing applications is voluntary.
• An analysis of the relationship between the level of government intervention in measures to stop the spread of Covid-19 infection in various countries and the reduction in the number of new infections showed that Japan was unique in that even though the level of government intervention was low, because Japanese people voluntarily stayed at home, Japan was able to reduce the number of new infections. While it is projected that anti-infection measures will continue for some time going forward, Japan is not a “surveillance society” where the government forcibly collects and uses data, and efforts are expected for the realization of a “protective society” where people mutually exchange information.

Contents

• 1．

  Current state of anti-Covid-19 measures through the use of personal data in Japan

• 2．

  Consumers’ attitudes regarding government use of personal data

• 3．

  Examples of utilization of personal data in major countries, and the effect of such utilization

• 4．

  Toward Achieving a “protective society” that is not a “surveillance society”

1．Current state of anti-Covid-19 measures through the use of personal data in Japan

After a state of emergency was declared, to put “stay-at-home” into practice, utilization of ICT such as online shopping and online meetings rapidly increased. Japan has lifted the state of emergency, but each and every Japanese citizen will have to live under a new normal through “a new lifestyle” going forward in order to stop the spread of infection, and active utilization of ICT can be expected both to prevent infection and to stop the spread of infection.
It is widely recognized that privacy measures are important in the utilization of ICT, but in the case of measures against Covid-19 infections, protection of personal data including personal information becomes even more important. Information relating to a positive diagnosis is personal information that requires special care, and information about contact with infected persons and visits to places where infected persons were present also needs to be handled carefully. For that reason, utilization of ICT in Japan until now has always taken privacy concerns into consideration (Fig. 1).

Provision of large-scale statistical data utilizing location information

In response to “requests for provision of data that will contribute to stopping the spread of Covid-19 infections,” from the government, Yahoo! Japan, NTT docomo, and other platform business operators and telecommunication carriers have been providing large-scale statistical data utilizing location information that they manage.
By combining users’ location information, as well as their search and purchase histories, based on the rate of changes in the types of search and purchase activities people infected with Covid-19 are expected to carry out in different areas, Yahoo! Japan has been providing statistical data on areas with potential clusters of Covid-19 infections. Data used for statistics cover only users who consented to cooperating with the project.^*1
NTT docomo, using the “Mobile Spatial Statistics” services that it offers, is providing statistical data on populations in areas and populations that move between areas etc. by attribute (gender, age, and residential area). In providing data to the government, NTT docomo is issuing press releases^*2, and has declared that it will cooperate with the government while taking privacy into consideration.

Notification of possibility etc. of contact with a person infected with Covid-19

Local governments are also proceeding with anti-Covid efforts. Osaka Prefecture and Kanagawa Prefecture etc. are utilizing QR codes to provide services that alert users to the possibility etc. that they have had contact with persons infected with Covid-19.
Retail business operators and event organizers etc. are to obtain and print QR codes issued by local governments, and to display them at entrances to stores and event venues. Users are to scan the QR codes, and register their email addresses, LINE accounts, or other contact information. It is expected that if after the users leave a store or an event, anyone infected with Covid-19 is identified, the local government will simultaneously notify users through their contact information, and encourage them to receive consultations depending on the state of their health, thereby stopping the spread of infection . Both parties, taking privacy into consideration, are prevented from obtaining personal information such as names, addresses, telephone numbers or location information, and notifications do not indicate the places where, or the times when, contact with an infected person might have occurred.
As a related effort, the Ministry of Health, Labour and Welfare is developing a “Contact Confirmation Application (tentative name).” Users will be alerted if there has been any contact with an infected person under certain conditions, and it is hoped that by encouraging consultations with health centers etc., the spread of infection can be stopped.

2．Consumers’ attitudes regarding government use of personal data

Japan is one of the countries that is carefully tackling ICT utilization while placing importance on privacy protection. This is because historically, Japanese people have been averse to providing personal information. In comparison to other countries, the degree of tolerance in Japan toward providing information for both public purposes and commercial purposes is quite low (Fig. 2).

Meanwhile, according to a survey titled “Survey Relating to Lifestyle Changes from the Spread of Covid-19 Infection” conducted by NRI in April of this year, the percentage of people who will allow government use of sensitive information such as mobile phone location information to stop the spread of infection as long as the information is anonymized increases to 74% (Fig. 3).
The most common reasons given were, first, “I want to help stop the spread of infection,” followed by “I don’t want to inconvenience others” and “I don’t want myself or my family to get infected”; thus, it appears that the tolerance level increases if the use is in line with the nature of Japanese people to care about society and relationships with other persons (Fig. 4).
Further, generally, willingness to allow the use of location information to prevent infection and to stop the spread of infection was high, and it is thought that providing such services will be effective (Fig. 5).

3．Examples of utilization of personal data in major countries, and the effect of such utilization

An examination of foreign countries shows that there are significant differences among them with respect to privacy protection measures in the utilization of ICT. The following discusses the extent of government access to personal data in the utilization of ICT for anti-Covid-19 measures in six countries, namely China, South Korea, Singapore, U.S., U.K., and Japan (fig. 6).
In examining “contact confirmation applications” and health condition management applications, which have been introduced in the six countries as tools to stop the spread of infection under the new normal, comparisons were made with a view to three factors: “mandatory nature of application download,” “government access to personal information,” and “obtainment/non-obtainment of sensitive information for stopping the spread of infection use.” With respect to “obtainment/non-obtainment of sensitive information for stopping the spread of infection,” “information that can identify persons who have had contact,” which can lead to discrimination, and “location information,” which can lead to information regarding an individual’s home or workplace or suppositions regarding an individual’s interests and preferences, were evaluated. However, if location information was processed to ensure that individuals are not identified, such information was not evaluated.

Of the six countries that were examined, the governments of China and South Korea mandatorily collected information that can identify persons who have had contact with infected persons and location information, and utilized such information for measures to stop the spread of infection. On the other hand, in U.S., U.K., and Japan, the government can ascertain information relating to infected persons, but cannot access information regarding persons who have had contact with infected persons, and application download is voluntary.^*3 The contact confirmation application being developed by the Ministry of Health, Labour and Welfare stores data only on users’ terminals, allows only the users themselves to learn of any contact with infected persons, and deletes such data automatically every two weeks.^*4 Further, in registering information on an infected person, the consent of the individual is required.
Singapore falls between China/South Korea and Japan/U.S./U.K. Its government can access information on persons who have had contact with infected persons, but application download is voluntary. It is said that generally, contact confirmation applications only work if about 60% of the population uses them^*5, but only about 20% of Singapore’s population is using the system, and it is also subject to the constraint that data cannot be collected unless the application has been activated; thus, the application has produced little effect.
There is a concern that, similarly to Singapore, there will not be much effect in Japan, where application download is voluntary and government access to data is kept at a minimum. Meanwhile, even without government compulsion, Japanese people voluntarily stayed at home, and Japan was successful in significantly reducing the number of infected persons in a short period of time (discussed below). This is a phenomenon not seen in other countries, and it appears that it was the discipline of Japanese people and the pressure to conform, a national trait, that brought about such success.
By the national and prefectural governments fully conveying the importance of contract confirmation applications, there is a possibility that the necessary numbers can be secured even without stringent measures.

Relationship between the level of government intervention in measures to stop the spread of infection and the rate of decrease in new infections among countries

An analysis was conducted to determine the relationship between the level of government intervention in measures to stop the spread of infection (stringency of restrictions on outings, and the privacy level of data that government can access), and the reduction in the number of new infections among countries (Fig. 7).

In accordance with the criteria mentioned above, we compared the countries’ infection control measures relating to restrictions on outings and privacy levels, and the effect of the control measures (the rate of decrease of new infections calculated on the basis of numbers at peak time during the lockdown period and lockdown lifting date^*7) (Fig. 8).
U.K. and the U.S. state of California in principle ordered people to stay at home and took other measures that highly restricted outings, but they have not collected much data that governments can access, and they have not been able to control the spread of infection.
Meanwhile, countries such as China and South Korea, where outings are restricted and governments have access to highly private data, have been able to control the spread of infection.
However, although restrictions on outings were merely requested and government access to highly private data has been extremely limited, Japan has been successful in controlling the spread of infection. In other words, Japan can be seen as a unique country that has been able to control the spread of infection without stringent restrictions on personal rights or using surveillance measures with a high risk of privacy invasion, while continuing to take privacy into consideration at a level that is equal to or higher than western countries.

4．Toward Achieving a “protective society” that is not a “surveillance society”

Japan is rare among countries because even though it only requested that people stay at home voluntarily without applying criminal provisions, it was able to control the first wave of the spread of Covid-19 infection. In light of the fact that measures against infection will continue for some time going forward, efforts are expected to ensure that Japan is not a “surveillance society,” where the government forcibly collects and uses personal data, but instead a “protective society” where privacy is respected and information is mutually exchanged to support one another.
Contact confirmation applications could become a touchstone for the realization of such a protective society. Contact confirmation applications currently under development are basically constructed to store personal data on users’ terminals, and have specifications whereby governments cannot identify persons who may have had contact with infected persons, but ask for the consent of the individuals when registering information of infected persons and take other technical and systematic privacy protection measures. In addition, it has been noted that the applications undergo expert review, and are very transparent in their operation.^*8 These are perfect examples of “privacy by design,” which takes pre-emptive privacy measures, and is an essential practice for a protective society.
Going forward, in order to make contact confirmation applications more effective, it is necessary to use measures against clusters to identify and isolate infection sources and places that can become infection sources, and the utilization of location information is important to this end. In fact, in China and South Korea, where the number of new infections has been suppressed, governments are ascertaining and utilizing location information at the individual level. However, it is unrealistic to expect that Japan will utilize location information in the same way as China and South Korea in light of the aversion of Japanese people to providing personal information. On the other hand, as seen in the results of the above-mentioned survey, it is expected that many Japanese citizens will allow their personal information to be provided for the purposes of preventing infections and stopping the spread of infections if individual people cannot be identified.
Further, users can benefit from the utilization of location information, too. It would be possible to provide information regarding congested stores and areas in real time, or provide information on places that are not congested. Such information will not only help prevent infections and stop the spread of infections, but also contribute to people being able to spend their everyday lives comfortably. In this way, generating ideas to utilize personal data while protecting privacy is the path that will lead to a protective society, something that should be a goal.

Reference

Overview of Survey Relating to Lifestyle Changes from the Spread of Covid-19 Infections;

• Survey method:  

  Internet survey

• Survey subjects:  

  Men and women aged 15-69 across the country (demographically weighted)

• Number of valid responses:  

  2,064 people

• Survey period:  

  April 22-24

• *1 

  Yahoo! Japan press release material (April 13, 2020)
  https://privacy.yahoo.co.jp/notice202004.html#purpose

• *2 

  NTT docomo press release material (May 28, 2020)
  https://www.nttdocomo.co.jp/info/news_release/2020/05/28_03.html

• *3 

  Covid-19 Infection Countermeasures Tech Team “Contact Confirmation Applications and Related Systems Specifications” (May 26, 2020)

• *4 

  Because this application uses API provided by Apple and Google and can collect data even if the application is not running, there are no concerns relating to running of the application.

• *5 

  From Oxford University research results (refer to articles etc. in Nature)
  https://www.nature.com/articles/d41586-020-01514-2

• *6 

  Stringency of restrictions on outings was scored from the perspective of whether governments in principle prohibited people from leaving their homes, or only requested that people avoid leaving their homes. Stringency was lowest when people were not prohibited or requested to refrain from leaving their homes, and more points were added in the order of request and then prohibition.
  Further, because stringency is thought to be higher if criminal provisions are applied with the lockdown, scoring also took into account whether criminal provisions were applied. In countries other than Japan that were the subject of the survey, violations of home isolation orders and unauthorized outings were subject to fines, imprisonment, or other criminal provisions. In particular, countries such as Singapore that not only fine violators but can also imprison violators were found to have high stringency.

  

  Next, the privacy level of data that governments can access was evaluated from the perspective of whether the government can learn personal information of users, and whether users can stop governments from learning such information. If downloading a contact confirmation application etc. is compulsory, and governments can access personal information of users, governments can be deemed to be substantially monitoring such individuals. In such a case, while there is a possibility of invasion of the privacy of individuals, it is thought that it will be easier for governments to take effective measures to stop the spread of infection. Further, the level of sensitivity of data that governments can access was evaluated by looking at the above-mentioned “information that can identify persons who have had contact with infected persons” and “location information.”

• *7 

  The rate of decrease in new infections was calculated by comparing the number of new infections during peak time during a lockdown (or issuance of similar declarations urging people to stay-at-home) and the number of new infections on the date the lockdown was lifted. If the lockdown had not been lifted as of May 24, comparison was made with the number of new infections on May 24.

• *8 

  Expert Review Meeting Concerning Contact Confirmation Applications “Evaluation of Privacy and Security and Matters to Note for System Operation Relating to ‘Contact Confirmation Applications and System Specifications’” (May 26, 2020)

Authors