Why do Japan’s Line users worry when data is stored in South Korea but not in the US, with companies like Google and Apple?

Millions of users of the messaging app – including government departments – were shocked to learn their data was stored on servers in South Korea and had been accessed by engineers in Shanghai
While Line has promised to transfer the data, experts say Japanese must wake up to the fact that there are risks to storing data abroad

Japan

Julian Ryall

Published: 5:25pm, 24 Mar 2021

Why you can trust SCMP

Corrected [5:42pm, 31 Mar, 2021]

[5:42pm, 31 Mar, 2021]
This piece originally said Line stored data in China, a reference that was removed after a notification from the company saying this was not the case.

We are part of the Trust Project What is it?

Like millions of other Japanese users of the Line messaging app, university student Emi Izawa was shocked at revelations this week that her personal data was being stored on servers in South Korea and accessed by engineers in China, even though it is common for tech companies to outsource data management operations abroad.

Izawa, 18, uses Line to message friends but also its e-payments service to buy items and get discount coupons. She also gets updates on Line from her home prefecture government on natural disasters and other local news.

As news emerged in the past week that engineers at a Shanghai affiliate of Line’s parent, Softbank’s Z Holdings, were able to access user data, Izawa said she checked her LinePay account balance and found nothing amiss.

“But that is not the point,” she said. “The information there – which includes photos of me and my friends and family – is meant to be kept safe and secret.”

Tokyo-headquartered Line Corp stressed it had not flouted any of the Japanese government’s legal or regulatory requirements and there had been no leak of users’ information. CEO Takeshi Idezawa stated in a press conference this week that the use of foreign contractors and the storage of data overseas were carried out “appropriately”.

“The big issue was that the name of the country was not specified in our privacy policy,” he said.

Indeed, as Japan seeks to tighten laws and regulation around the use and storage of personal data held by internet companies, analysts said the concern in the case of Line was that domestic Chinese laws grant authorities there far wider access to personal data belonging to private-sector companies than in other jurisdictions.

A host of national and local governments, and NGOs, have now moved to suspend use of the app, including the health and welfare ministry, which had used Line for a suicide prevention project that had been used by more than 57,000 people for consultations.

Osaka city authorities have halted 60 services provided via Line. Photo: Bloomberg

The prefectural government of Chiba, west of Tokyo, announced it was suspending use of its Line accounts for residents’ services, including one used to track and trace people infected with the coronavirus and required to quarantine, while Osaka city authorities halted 60 services provided via Line, including information for new mothers and students just starting university.

Line launched its free instant messaging service in June 2011 and has around 86 million users in Japan, meaning that well over half of the country’s 126 million residents have an account.

Line’s management on Tuesday announced that all data presently being stored in South Korea would by June be transferred to databases in Japan to better protect users’ personal information. Similarly, the company has blocked access to its database from China and shut down development work there.

But an editorial in the Asahi newspaper on Tuesday questioned whether it would get to the bottom of its “shoddy information management” and called on the government to conduct an investigation.

Izawa said she would have been less worried if Line data was stored in the United States or a European country.

“There are stronger laws on privacy in those countries, although the ideal situation would be for the data to be held here in Japan,” she said.

Is data stored with Google safer than data stored in China? Photo: AP

Morinosuke Kawaguchi, a technology strategist and consultant who was previously a lecturer at the Tokyo Institute of Technology, said Line had been “naive in its governance of security”, but added there was a similar amount of risk associated with storing data in other countries, such as the US or European nations.

“Apple or Google know all about their account holders as well,” he said. “When it comes to companies in the US, for example, we users accept or just ignore that risk as it is not seen as a threat, but that changes when it comes to China or South Korea.

“I hope this incident will serve to wake Japanese people up to the fact that … there are dangers elsewhere and the only completely safe solution is to have the data stored here in Japan and under Japanese law.”