My Number and Privacy: Requirements for Identifiers

488 VIEWS

Recently, it seems that My Number has been receiving increasing coverage in various media[1]. Leaving aside the fact that this is long overdue, I think it is better than receiving no coverage at all.

Ideally, I should point out any issues with each provision, but unfortunately I am extremely busy and do not have the time. So I will write down a few general points that I would like those discussing these matters to keep in mind.

Table of Contents

Definition of an Identifier

A combination of attributes that can uniquely distinguish (identify) an individual (or object) from others within a group is called an “identifier.”

The so-called My Number is also a type of identifier.

The names “My Number” and “Individual Number” seem to assume that a sequence of digits is used to identify an individual, but an identifier does not have to be numeric, nor does it have to be a single string.

For example, a typical identifier is the so-called basic 4 information: address + name + date of birth + sex. With some exceptions, this functions adequately as an identifier. (However, using it as an identifier is undesirable from a privacy standpoint because it unnecessarily discloses other information.)

Basic 4 information is often thought of as contact information and, in most cases, is probably not consciously regarded as an identifier. But when using it, one really needs to be aware of whether it is currently being used as contact information or as an identifier.

It is also important to recognize that My Number will not function as an identifier unless it is used together with the information that the number is a My Number, and unless the population is limited to those to whom My Numbers have been issued at that point in time.

Desirable Properties of Identifiers

Different properties are desirable for identifiers depending on their purpose.

For example, identifiers used by people should:

be strings that are easy to remember
be capable of being read aloud

and so on. Many email addresses meet these requirements.

These requirements span a wide range. Examples might include the following.

Requirement 1: Be stable over a certain period of time
Requirement 2: Be stable among handlers sharing a particular purpose of use
Requirement 3: Not cause unwanted extraction of personal information through such use

And so on. Requirements 1 and 2 are necessary for carrying out the relevant operations. Requirement 3, by contrast, is a privacy requirement. The appropriate balance among them varies according to the purpose of use. For pensions, for example, the “certain period” in Requirement 1 might exceed a person’s lifetime. By contrast, a message board that accepts political opinions needs anonymity, so the “certain period” would be extremely short—for example, only until the browser is closed.

Thus, clearly defining the purpose for which an identifier will be used is indispensable to its design.

The Privacy Perspective: The Principle of Data Minimization

From the standpoint of privacy protection, the “certain period” and the “handlers sharing a particular purpose” should generally be kept as small as possible. This corresponds to applying to identifiers the “data minimization” requirement found in the US FIPPs and the European Data Protection Directive. It is such a widely accepted principle that the only people likely to object to it would be those who reject liberalism. (That said, there are quite a few people in Japan who reject it. Perhaps this is because liberalism was not won through their own efforts but was simply bestowed upon them.)

Requirements for Various “Numbers”

Now that the groundwork is in place, let us consider the requirements for various numbers.

Bank Account Numbers

Bank account numbers exist to accurately manage balances through deposits to and withdrawals from bank accounts. Here, the “period” runs from the opening of the account to its closure. The “people and institutions sharing the purpose of use” would be “those who deposit money into or withdraw money from the account.” It follows that making this scope unnecessarily broad is not advisable.

Basic Pension Numbers

A basic pension number is used to manage a person’s pension contributions and pension. It must therefore remain stable throughout that person’s life. In other words, the period is a “lifetime.” Those who handle it, meanwhile, are limited to the pension organization and employers who maintain an employment relationship with the person beyond a certain period.

Taxpayer Identification Numbers

A taxpayer identification number is used to accurately determine a person’s income and impose the appropriate tax. It also serves to reduce the administrative burden on tax authorities. Given a progressive tax system, it must be possible to match records across a broad range of assets, such as balances held by financial institutions and real estate, as well as wages and other sources of income. Therefore, in a straightforward implementation, the scope of sharing would include everyone who makes a payment to that person. Determining income also requires determining costs, so recipients of business-related expenditures would also be among those sharing the number. In other words, the scope of sharing becomes quite broad.

On the other hand, taxation is assessed annually, so a period of a few years before and after the tax year should suffice. The period can therefore be relatively short.

A Common Number for Tax and Social Security (Including Pensions) Is a Bad Idea

Next, as a hypothetical example, let us consider a common number for tax and social security (including pensions). It would have to satisfy the requirements of both a basic pension number and a taxpayer identification number. In other words, it would need to combine the “long period” required for pension administration with the “broad scope” required for taxation. That means an identifier that is “stable over a broad scope for a long period” would be necessary. Because this does not satisfy Requirement 3, it can be described as a poor combination. Representative examples are the US Social Security Number (SSN) and South Korea’s resident registration number, both of which have caused many problems. They ended up this way because they were designed when only the world of paper existed. Today, however, computers make it possible to avoid this problem. Austria’s sectoral model is a representative example.

So What About My Number?

With that, I have offered a brief introduction to some of the requirements for identifiers. I hope readers will keep the above in mind as they carefully read each provision of the bill commonly known as the My Number Bill (the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures ), consider whether the current text is satisfactory or what and how it should be amended, and voice their views[2].

For reference, links to the materials submitted to the Diet are provided below.

Bill on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (My Number Bill)	H24.02.14	Office for Social Security Reform	Overview Summary Bill and Reasons Referenced Provisions
Bill on the Arrangement and Other Matters of Related Acts Accompanying the Enforcement of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures	H24.02.14	Office for Social Security Reform	Overview Summary Bill and Reasons Old-and-New Comparison Table Referenced Provisions

(Source) Bills Submitted to the Diet http://www.cas.go.jp/jp/houan/index.html 2012/8/9

[1] Example: The Expanding My Number System: The “Folly” of Adding Unnecessary Functions — Norio Murakami’s Global Compass (44)　2012/7/31 7:00Nikkei

[2] Me? I do not have the time. Besides, it appears that many experts are addressing this issue, so I would like to focus on more fundamental areas (for example, international standards for identity proofing and the development of technical international standard protocols). Incidentally, if a common number is introduced, and if permitted, I would like to change my number roughly every 5 years. I will recommend that my acquaintances do the same. That is the minimum needed for self-protection. The national and local governments will also need to estimate the costs on the assumption that such behavior becomes widespread.