EDITORIAL: Rikunabi scandal highlights risks of exploitation of personal data

People’s behavior is measured in various ways to produce all forms of data that can be used for commercial purposes.

But most people are not aware of what is occurring and remain vulnerable to uninformed and unapproved use of their personal data.

This real privacy risk in networked society was underscored by recent revelations about how Recruit Career Co. used data collected through a popular job-placement website it operates, called “Rikunabi," to make estimates of job-seeking students’ odds of declining job offers. It then sold the data to companies.

Recruit Career collected data of job-seeking students, such as their browsing history, through its Rikunabi DMP Follow service and analyzed the data with artificial intelligence to evaluate each student’s probability of declining the job on a five-point scale if a certain company offered to hire the individuals.

The forecasts thus made were sold to 38 firms for prices of 4 million to 5 million yen ($37,950 to $47,450).

Recruit Career says it showed users terms of service when they registered with the site and obtained their consent to use their data for business purposes. But the text only says the users’ data “may be provided to corporate clients to support their recruitment efforts.”

There was no way for the students to know how their data would be used specifically.

The company also claims it sold the estimates only to companies that promised not to use the information for their hiring decisions. But there is no way for outsiders to confirm whether these companies have honored their promises.

It is hardly surprising that the revelations have made students feel distrust for the company. Recruit Career has refused to disclose how many students had their data sold, raising more questions about its sincerity.

In addition, a number of cases have surfaced where the company did not obtain consent to use the data as required by the law when students registered to use the Rikunabi website. Eventually, the company had to stop selling the predictions.

The company has the responsibility to make an inquiry to identify the problems that led to the ethical lapse including those with its in-house system to monitor operations for compliance and announce the findings.

The companies that bought the job-declining forecasts from Recruit Career should also be held accountable. They provided information about job-seeking students who declined their job offers in the past to Recruit Career, which used the data for the AI-based analyses. Did these firms obtain the consent of the students?

The Personal Information Protection Law requires companies dealing with personal information to make clear for what purpose the data will be used. But the law does not define the scope or other specifics of this disclosure requirement.

The reality is that many companies that collect personal data are doing so by using vague terms of service.

Analyzing a person’s history of behavior and other records to describe the person’s characteristics, traits and other elements of the personality is called profiling.

The Rikunabi scandal has raised fresh concerns that personality descriptions based on profiling could be used for hiring, credit and other business-related decisions. Some people could be put at a disadvantage concerning these matters without knowing the reason why.

The law is scheduled to be reviewed next year. But there has been no sufficient debate on how to address these and other concerns.

The Fair Trade Commission is moving toward stronger regulations on the operations of powerful service providers, such as Internet giants, to collect personal data in unfair ways based on their market dominance.

The antitrust watchdog thinks such operations constitute “the abuse of an advantageous position” as defined as a violation of the Anti-Monopoly Law.

A popular job-placement website used by the large majority of job-seeking students as a key tool to find employment should also be regarded as a service with a market-dominating position.

It is vital to expand and accelerate broad-based public debate on how to protect individuals from information-related risks in networked society.

Businesses, for their part, should act according to the ethical norms and common sense even before the law to regulate their personal data operations is established.

If they fail to do so, they will lose public trust.

--The Asahi Shimbun, Aug. 12