Information leakage poses hurdles to accountability; Times class action lawsuit could drag on - ``Strict control'' says expert, unauthorized access

Victims are moving forward with a class action lawsuit over the leak of member information from the car-sharing service ``Times Car.'' Although there have been judicial decisions ordering companies to pay compensation for leaks of personal information, there are hurdles in pursuing liability in the event of an unexpected cyberattack. Similar lawsuits tend to take longer, and experts point out that ``companies are required to maintain even stricter information management.''

Times Car to file class action lawsuit by the end of this year, demanding up to 50,000 yen over leaked driver's license image - Tokyo District Court

"I want to challenge the way personal information is protected." Attorney Yuki Makino, who is calling for a class action lawsuit against Times Car members, emphasized this at a press conference on October 26th. The operating company announced that it would pay 3,000 yen in solace to those whose driver's license images were leaked, but the company is considering seeking damages of up to 50,000 yen per person in the lawsuit.

In 2002, the Tokyo District Court ordered the company to pay compensation of up to 35,000 yen per person in a lawsuit involving the TBC Group, a major beauty salon, that was discovered in 2002. In addition to her name and address, the name of the beauty salon course she was interested in was also leaked, and it was determined that there was a strong need to keep it a secret.

A case in 2014 in which an employee of Benesse Corporation, a major correspondence school company, sold customer information to a list agency also led to a lawsuit. In 2024, the Tokyo District Court acknowledged Benesse's negligence and ordered it to pay 3,300 yen each to 3,338 people, and the dispute is still ongoing at the Supreme Court. Junya Manabe, an attorney representing the plaintiffs, recalls, ``The issue was whether the plaintiffs were truly victims, and because there were so many plaintiffs, it took many years to identify them.''

Regarding the Times Car lawsuit, he said, ``The loss of driver's licenses causes a great deal of damage, but how far should we go to protect against unexpected unauthorized access?The bar to prove negligence is high.''

Masaki Kito, the lawyer who handled the TBC lawsuit, also pointed out, ``The debate will be whether the attack could have been prevented even with standard defenses.'' While acknowledging the significance of the class action lawsuit, he said, ``This is not an issue that should be left as an issue for individual business operators.The time has come when the public and private sectors need to take measures to protect personal information.''

Kendo Yuasa, a professor at Meiji University who is an expert on information security, takes issue with the fact that the Times retained information on members who had withdrawn from membership without erasing it for seven years. ``It has become clear that holding unnecessary personal information increases the risks, and even stricter management is required.''

He said that, with the exception of critical infrastructure, cyber countermeasures have until now been left to the voluntary measures of companies, adding, ``In the future, the government may have no choice but to impose a net of regulations.''