314 VIEWS
Pinterest LinkedIn LINE

I suddenly came across something incredibly nostalgic. These include minutes and other materials from meetings of the Working Group on Information-Linkage Infrastructure Technology, which had been meeting since the beginning of 2011. You can access them here.

　To examine matters concerning mechanisms for protecting personal information under the Numbering System for Social Security and Taxation and the National ID System (hereinafter, “the two systems”), the Working Group on Personal Information Protection was established, while the Working Group on Information-Linkage Infrastructure Technology was established to examine technical matters common to both systems.
　 In addition, to consider in detail the implementation framework for privacy impact assessments under both systems, the Working Group on Personal Information Protection established the Privacy Impact Assessment Sub-Working Group.

□ Working Group on Information-Linkage Infrastructure Technology

○Members

○Meeting status

MeetingDate and timeAgenda and distributed materialsSummary of proceedings
No. 1February 4, 2011Agenda and distributed materials Summary of proceedings 
No. 2March 4, 2011Agenda and distributed materials Summary of proceedings 
No. 3March 23, 2011Agenda and distributed materials Summary of proceedings 
No. 4April 12, 2011Agenda and distributed materials Summary of proceedings 
No. 5June 7, 2011Agenda and distributed materials Summary of proceedings 
No. 6June 30, 2011Agenda and distributed materials Summary of proceedings 
MeetingDate and timeMeeting noticeAgenda and distributed materialsMinutes
No. 7July 28, 2011Meeting noticeAgenda and distributed materials Minutes 

○Working Group on Information-Linkage Infrastructure Technology Interim Report

MeetingDate and timeMeeting noticeAgenda and distributed materialsMinutes
No. 8March 23, 2012Meeting noticeAgenda and distributed materials Minutes 

The members at the time were as follows. Professor Tezuka eventually became Chair of the Personal Information Protection Commission.

siryou2_2

Back then, I remember Professor Yamaguchi saying something like, “Shall we take up our mats and go stand in front of the Ministry of Internal Affairs and Communications?”

#IfYouDoNotRecordItItDisappears

Briefing on the “Interim Report of the Working Group on Information-Linkage Infrastructure Technology”

1. Introduction

This briefing summarizes the status of technical deliberations and the main issues concerning the information-linkage infrastructure for the Numbering System for Social Security and Taxation (the My Number System), based on the “Interim Report” (hereinafter, “the Report”) compiled by the Working Group on Information-Linkage Infrastructure Technology (hereinafter, “the WG”) on July 28, Heisei 23.

2. Background to the Establishment and Positioning of the WG

  • Purpose: To conduct technical deliberations on building an electronic information processing system (information-linkage infrastructure) for exchanging personal information associated with the “Number” in inter-agency information linkage, with a view to establishing a numbering system for social security and taxation.
  • Background:January 31, Heisei 23, the Government and Ruling Parties Headquarters for Social Security Reform adopted the “Basic Policy on the Numbering System for Social Security and Taxation.”
  • Based on this basic policy, the Working Group on Personal Information Protection and the Working Group on Information-Linkage Infrastructure Technology were established under the Planning Committee of the IT Strategic Headquarters.
  • Since the meeting held on February 4, Heisei 23 as its No. 1 meeting, the WG has held a total of 7 rounds of deliberations.
  • The “Outline of the Social Security and Tax Number System” (April 28) and the “Framework for the Social Security and Tax Number System” (June 30) were formulated, and the Number Act bill and related bills were scheduled to be submitted to the Diet in or after the autumn.
  • The nickname “My Number” was chosen for the “Number.”
  • Positioning of the Report: The WG’s deliberations are at the conceptual-design stage, and further study is required for detailed system design. Nevertheless, the current findings are published as an “Interim Report” for purposes including budget requests.

3. Role and Basic Principles of the Information-Linkage Infrastructure

  • Role: It is social infrastructure for confirming information about the same individual held by multiple institutions and provides the foundational functions for using the “Number” in social security and taxation.
  • Key considerations: Security measures, protection of personal information, operational stability, cost-effectiveness, and the adaptability, extensibility, and flexibility of institutional and business requirements.
  • Future outlook: In the future, broad information linkage with administrative fields outside social security and taxation and with private-sector institutions will also be considered.
  • Definition of information linkage: A mechanism that links information about the same person managed by multiple institutions under their respective “Numbers” or other identifiers, enabling mutual use.
  • Mandatory use: Use of the information-linkage infrastructure must be mandatory under the system so that the types of personal information linked and the reasons for linkage are clear.
  • Ensuring transparency: Only authorized procedures should be able to access the information-linkage infrastructure, and logs of linked procedures should be managed appropriately to ensure transparency.

4. Assigning Numbers to Individuals, Number Linkage, and Information Linkage

4.1. Basic Principles (Reflecting the Supreme Court’s Constitutional Ruling)

The Framework states that the following requirements must be met in light of the Supreme Court ruling upholding the constitutionality of the Basic Resident Registration Network System (Juki Net) (March 6, Heisei 20).

  • ① Privacy protection: “Every person has the freedom not to have information about themselves disclosed or made public to third parties without due cause.”
  • Measures: The law should prohibit disclosing personal information associated with the “Number” to others without due cause and establish penalties for provision without legitimate reason and similar acts.
  • ② Avoiding centralized management of information: “No institution or entity exists that can centrally manage personal information.”
  • Measures: Personal information subject to linkage is to be managed in a distributed manner. The information-linkage infrastructure must not directly use the “Number”, which is broadly used among private-sector entities and government. Instead, it should use a code used only by the information-linkage infrastructure and information-holding institutions, and the code must not be inferable from the “Number.”
  • ③ Specifying purposes of use under laws and regulations: “Management, use, and other handling are based on laws and regulations and conducted within the scope of legitimate administrative purposes.”
  • Measures: The types of operations for which the “Number” may be used, the types of operations for which the information-linkage infrastructure may be used, the types of personal information provided, and the providers and recipients should be specified in laws, cabinet orders, or ministerial ordinances, thereby defining the scope and purposes of use.
  • Review of access records through the My Portal: Users should be able to review through the My Portal access records for personal information associated with the “Number” via the information-linkage infrastructure.
  • ④ Ensuring system security: “There is no concrete risk that information can easily leak from the system.”
  • Measures: Sufficient system security measures, including encryption during information linkage, should be implemented.
  • ⑤ Strengthening penalties: “Use for unauthorized purposes, disclosure of secrets, and similar acts are prohibited through disciplinary action or criminal penalties.”
  • Measures: Penalties for unauthorized use or collection by public officials and others should be strengthened, and provisions imposing direct penalties should be created for unauthorized use or acquisition by private businesses and others. Penalties for breaches of confidentiality obligations should also be strengthened.
  • ⑥ Establishing a third-party body: “Institutional measures are in place to ensure the appropriate handling of personal information through the establishment of a third-party body or similar entity.”
  • Measures: An independent third-party body should be established to oversee national administrative agencies and other bodies.

4.2. Basic Mechanisms for Number Assignment and Information Linkage

  • Number generation: A new number should be generated in a one-to-one relationship with the resident record code, while preventing logical derivation of that code. To prevent duplicate assignment, a single entity should generate the numbers.
  • Provision of the Number: After matching the basic 4 information they hold (name, address, date of birth, and sex) against the basic 4 information in Juki Net, information-holding institutions receive the “Number” from the number-generating institution and link it to their databases.
  • Identifier for information linkage: To eliminate concerns about state control and the tracking or aggregation of personal information, the visible “Number” is not used directly as the identifier during information linkage. Instead, a code used only by the information-linkage infrastructure and information-holding institutions is used as the identifier.
  • Code assignment: After the information-holding institution conducting the linkage matches its basic 4 information against the basic 4 information in Juki Net, the information-linkage infrastructure assigns the code to that institution.
  • Synchronization of the basic 4 information: To verify the authenticity of the basic 4 information associated with the “Number” and code, information-holding institutions should synchronize it as often as necessary with the basic 4 information in Juki Net.

4.3. Information Linkage

  • Relationship between the “Number” and codes:The information-linkage infrastructure requires a system consistent with the ruling’s principles, including that no institution can centrally manage personal information and that individuals are free from unwarranted disclosure of their personal information.
  • The methods considered for generating codes used in information linkage were the reversible encryption method and the code-conversion table method, 2 methods in all.
  • The following 5 proposals were presented for identifiers of persons whose information would be linked by the information-linkage infrastructure and information-holding institutions, but the proposal to use the “Number” directly1 was criticized as having an extremely large security and privacy impact, and the Framework also states a policy of not using it directly.
  • Information linkage based on laws and regulations: The Number Act or its cabinet orders and ministerial ordinances prescribe the types of operations for which information-holding institutions may request information through the information-linkage infrastructure, the types of information provided, and the providers and recipients.
  • Exceptional measures during extreme disasters: “When special reasons exist, such as responding to an exceptionally severe and devastating disaster, information may be linked through the information-linkage infrastructure with the permission of the third-party body,” but the specific method requires further study.
  • Data transmission and reception method: Two methods of transmitting data between requesting and responding information-holding institutions were discussed: a gateway method through the information-linkage infrastructure, and an access-token method involving direct transmission between information-holding institutions. A decision was deferred because the use-case analysis was insufficient.
  • No individual consent required in principle: Under the Framework, the Number System is not premised on individual consent as a rule. Instead, the scope of use is prescribed by law to prevent arbitrary use and inform the public in advance of the operations for which it will be used. Where individual consent is required, such as for exchanges of highly sensitive personal information, that requirement is to be stated in law.

5. Access Records

  • Control over one’s own information: A mechanism should allow individuals to review at any time, through the My Portal, access records relating to exchanges of their personal information through the information-linkage infrastructure.
  • Recorded content: Records must include the date and time, the parties involved, the type of information, the legal basis, and other relevant details.
  • Division of roles: Because access records are also personal information, responsibilities should be appropriately divided between the information-linkage infrastructure and information-holding institutions. Processing logs for information linkage are managed in a distributed manner.
  • Review and analysis by the third-party body: The third-party body (a commission established to protect personal information under the Number System and for related purposes) has the authority to investigate and review, as necessary, access records retained by the information-linkage infrastructure and information-holding institutions.

6. My Portal, IC Cards, and Related Matters

6.1. My Portal

  • Role: A website serving as the gateway to information provided to the public. It helps realize a society in which people can control their own information.
  • Functions:① A function for reviewing access records for personal information associated with one’s own “Number”
  • ② A function for reviewing personal information associated with one’s own “Number” held by each information-holding institution
  • ③ A function for routing electronic applications (one-stop service)
  • ④ A function for displaying notices from administrative agencies and other bodies (push service)
  • Information management: Strict operational arrangements and security measures are required. The mechanism should minimize the accumulation of users’ personal information in user folders.
  • Login authentication: An authentication certificate or similar credential provided by the Japanese Public Key Infrastructure is used. A digital-signature certificate is also used for initial registration.
  • Information retention: Two approaches are under consideration: collecting and storing information in advance, or collecting it from information-holding institutions after login. A decision will be made later. A function for downloading information before logout also requires consideration.
  • One-stop service: For typical services, consideration should be given to a mechanism under which a single electronic application is sent to and processed by all necessary information-holding institutions.
  • Use by a representative: Consideration is being given to allowing use by legal representatives and voluntary representatives where individuals have difficulty making disclosure requests themselves.
  • Use away from home: Various means of access should be considered for people who do not have a computer at home or have difficulty connecting.

6.2. IC Cards

  • Purpose of issuance: Used to log in to the My Portal and to verify identity both in person and online.
  • Information printed on the card: The “Number,” name, address, date of birth, sex, and facial photograph are under consideration.
  • Information stored electronically: The “Number,” private keys and electronic certificates for the Japanese Public Key Infrastructure (for digital signatures and authentication), Juki Net-related information, and functions supporting local ordinances are under consideration.
  • Improvements indicated in the Framework:Add authentication use to the Japanese Public Key Infrastructure.
  • Extend the validity period of electronic certificates from 3 years to 5 years.
  • Expand the system so that private businesses, acting as signature verifiers, can verify identity electronically.
  • To ensure the authenticity of the “Number,” print it on the face of the IC card and store it in the IC chip.
  • Issuance: Cards are issued at municipal service counters following strict identity verification. Improvements should be made while utilizing the existing Basic Resident Registration Card and Japanese Public Key Infrastructure.

7. Number Assignment to Corporations and Related Matters

  • Entities assigned a number: National government institutions, local governments, corporations and other entities recorded in registry-office registers, unregistered corporations established under laws and regulations, and persons deemed to be corporations with obligations to file and pay national or local taxes.
  • Assignment method: For registered corporations and other entities, the number is based on the Corporate Number; entities without one are assigned a unique number.
  • Changes to Corporate Numbers: A Corporate Number is not changed when the Corporate Number system changes. A number once used is not reused.
  • Notification: The Corporate Number is notified to the relevant corporation or entity in writing.
  • Search and inspection: Corporate Numbers should be made widely available to the public and used by both the public and private sectors. The assigning institution should provide, through a website or similar means, a service for searching and viewing the basic 3 information of corporations and other entities (trade name or name, location of the head office or principal office, and Corporate Number).
  • Relationship to enterprise codes: Position the Corporate Number as a foundation for developing and using enterprise codes (enterprise identifiers), and promote measures such as reducing official attachments in administrative procedures. Desirable characteristics of enterprise codes include comprehensive coverage, uniqueness, consistency, non-reuse, openness, referencability, and non-transferability.

8. Handling in the Social Security Field

  • Characteristics of the medical and long-term care fields: There are a very large number of information-holding institutions in the medical and long-term care fields (approximately 180,000 medical facilities and approximately 260,000 long-term care facilities and providers), and the volume of information exchanged is enormous. Because private medical institutions and others are also included, consideration should be given to special legislative measures together with a specialized technical design that makes the system efficient in terms of load and cost.
  • Protection of highly sensitive information: For the handling of particularly sensitive medical information, legislation should be developed alongside the Number Act as a special law under the Act on the Protection of Personal Information or the Number Act, prescribing special measures that account for the sensitivity and characteristics of the information.

9. Considerations and Schedule for Future Development

  • Time constraints and prudent action: Although the overall schedule is tight, prudent action is necessary because this is a new system connecting a wide range of institutions.
  • A small start and prototype development: Total costs should be reduced through a small-start approach of “starting where possible” and by using prototype development and demonstration testing to avoid rework in design and development.
  • Cost-effectiveness: Technical design and development of the system and related components must give full consideration to cost-effectiveness.
  • Future schedule (targets indicated in the Framework): From autumn of Heisei 23 (2011): Submit the Number Act bill and related bills to the Diet as soon as possible.
  • After the bills are enacted: Establish the third-party body and begin its operations as soon as possible.
  • Heisei 26 (2014), June: Issue the “Number” to individuals and the “Corporate Number” to corporations and other entities.
  • From Heisei 27 (2015), January onward: Begin use of the “Number” to the extent possible in the social security and taxation fields among the fields in which it is to be used.
  • By around Heisei 30 (2018): Review the Number Act, including possible expansion of its scope of use, in light of its implementation up to that point.
  • Future tasks:Urgently advance use-case analysis and identify the necessary functions and performance requirements.
  • Consider construction of the information-linkage infrastructure in light of the types of information-holding institutions (national government, local governments, and private institutions) and the types and volume of information handled.
  • Consider performance targets for the information-linkage infrastructure and related systems, and ensure processing performance adequate for practical use.
  • Identify the main system components and define an IT system architecture that satisfies the functional requirements.
  • Consider security measures as non-functional requirements and business-continuity measures such as backups.

10. Conclusion

Drawing on the experience and knowledge of information-technology experts, the WG has continued its deliberations toward building the information-linkage infrastructure. At present, analysis of the scope of information linkage and specific use cases remains insufficient, and the requirements for the necessary functions and performance of the infrastructure have not yet been identified. Going forward, there is a strong need to advance use-case analysis promptly and for the government to vigorously consider how best to build the system.

Related posts