MyData Conference 2026—Revisiting MyData: Opening Remarks

Nat Sakimura, Chair, MyData Japan Association

Time: 10:05–10:20

MyData Japan 2026—Revisiting MyData

On Yesterday’s Kumamoto Earthquake

Good morning, everyone.

Thank you for joining MyData Japan 2026.

Before turning to today’s main topic, I would like to say a few words about yesterday’s earthquake in Kumamoto.

At around 4:27 p.m. yesterday, a major earthquake struck with its epicenter in the Kumamoto region of Kumamoto Prefecture, registering an intensity of 7 in Uki City and Hikawa Town.

The full extent of the damage is not yet clear, and lifesaving, rescue, and safety-confirmation efforts are continuing.

My heartfelt sympathy goes to everyone who spent the night anxious about aftershocks and to all those affected by the disaster.

I pray that people’s safety will be confirmed, that those awaiting rescue will be reached as soon as possible, and that the affected areas will be kept safe.

I also express my profound respect for everyone engaged in rescue, medical care, recovery, and support under dangerous conditions.

Data Connects and Sustains Lives

In a disaster like this, digital identity and MyData are not abstract ideals.

• To tell others, “I am safe.”
• To ask for help.
• To find people who can no longer call for help themselves.
• To prove that someone is a disaster victim or is eligible for necessary assistance.
• And to deliver assistance quickly and reliably to those who need it.

Every one of these actions involves data about oneself.

• People must be able to use data about themselves for their own purposes.
• They must be able to communicate their circumstances without disclosing more information than necessary.
• They must be able to connect people with assistance even when communications are disrupted, devices are lost, and ordinary identity documents could not be brought along.

That is, quite literally, the power to sustain life.

And that is precisely where MyData begins.

Empowering People with Their Own Data

The MyData Declaration, revised this year, begins with these words:

MyData aims to build a world in which people are empowered by their own data.

The focus here is not data.

It is people.

• Being able to use our data for our own purposes.
• Being able to assert human rights and legal data rights effectively.
• Being protected from power imbalances and abuses involving data.
• Understanding who collects and uses data.
• And understanding how we can participate in that use.
• That empowerment does not benefit individuals alone.
• It also benefits communities and society, creating self-realization and new opportunities.

The Declaration envisions a fair, transparent, and human-centric data ecosystem.

One Entity, Many Identities

What, then, does it mean in concrete terms for people to be empowered by data?

A person is not a single profile.

As an entity, I am one person.

But I do not have only one identity.

• Myself in relation to my family.
• Myself at work.
• Myself as a patient.
• Myself as a citizen.
• Myself as a friend.
• Myself seeking support as a disaster victim.
• Myself acting as someone who provides support.

Identity is not a fixed number.

It is a set of recognized attributes presented within a particular relationship and context.

We use data about ourselves to represent ourselves to others.

• We show the attributes that are needed and withhold those that are not.
• If there is a misunderstanding, we add other information.

In this way, we build relationships and gradually adjust them in the direction we want.

Being able to use data about ourselves to represent ourselves better and build relationships.

This is an important aspect of the agency that MyData seeks to foster.

Contexts Overlap

Real-world contexts are not neatly separated.

• A colleague may also be a neighbor.
• A healthcare professional may also be an old acquaintance.
• A government official may also be a member of the local community.
• A disaster victim may simultaneously be an employee, a parent, and a caregiver.

This overlap is not a bad thing.

It means that human relationships are rich.

Problems arise when data is used outside the context a person intended.

• Information disclosed for healthcare is used to evaluate employment.
• Information disclosed to receive assistance is used for advertising or profiling.
• Behavior in one setting is used to infer a picture of the person in another.
• Multiple contexts are combined without the person’s knowledge and fixed into a single profile.

The same data can help a person in one relationship and harm them in another.

It is not the mere existence of data that diminishes a person’s well-being.

What matters is who used the data, in what context, and for what purpose.

Protect People. Data Protection Is the Means.

That is why what must be protected is not data itself.

What must be protected is people.

Their dignity.

Their potential to build relationships, express themselves, and live better lives.

Data protection is a means to that end.

• Minimize collection.
• Minimize the data processed.
• Limit purposes.
• Selectively disclose only the attributes required.
• Avoid identifiers that permit tracking across contexts.
• Make use transparent.
• Enable people to request explanations, object, and obtain correction of errors or adverse effects.
• And conduct a Privacy Impact Analysis.

A PIA is not an exercise in ticking boxes on a checklist.

• Who will experience what kinds of effects?
• Beyond average benefits, who will suffer the greatest disadvantage?
• Is there another design that could avoid or reduce those effects?

It is a process of asking these questions continually.

As project leader for ISO/IEC 29100, the principal author of OpenID Connect, and an author of JWT and JWS, I have written standards and protocols.

What I have confronted repeatedly in that work is that the subject, purpose, recipient, and context must never be left ambiguous.

Even correctly signed data can harm people if it is given to an unintended party for an unintended purpose.

Technical verifiability is not the same as legitimacy of use.

Able to Choose. Able to Delegate. Not Disadvantaged for Choosing Neither.

MyData Japan Vision 2026 defines the society we seek as follows:

A society that can achieve fair, sustainable, and diverse forms of well-being through human-centric data use.

This Vision does not treat people as isolated decision-makers.

It embraces relational autonomy.

Autonomy does not mean relying on no one and making every decision alone.

It means being able to decide and act as oneself within relationships with others and the social environment.

That requires three things.

• Being able to choose.
• Being able to delegate to trusted people or systems.
• And not being disadvantaged for choosing neither.

Increase transparency and accountability in data use.

Enable individuals to access data and participate.

Create mechanisms that let people manage and use data appropriately and easily.

Improve our lives and society by knowing and making use of our own data.

Connect.

Engage.

Act.

That is MyData Japan’s Vision.

In 2026, Context Is “Inferred” and “Acted Upon”

Why, then, are we revisiting MyData now?

Because AI has shifted the center of gravity of issues surrounding data.

AI does not deal only with attributes that have been presented.

It infers new attributes, tendencies, risks, and pictures of people from data.

It recommends, ranks, and decides.

AI agents go further and act on those decisions.

• Search.
• Select.
• Negotiate.
• Purchase.
• Apply.
• Enter into contracts.

The question is no longer only who holds the data.

• Who constructs an identity about whom?
• For what context?
• Whose purposes does it follow?
• On whose authority does it act?
• And who is accountable for the result?

The same is true of age assurance.

The purpose is not to verify age.

The purpose is to provide people, including young people, with a safe and inclusive digital space that does not deprive them of opportunities for expression, learning, and participation.

If the only proof required is that someone meets a specified age condition, there is no need to collect their complete identity.

But minimizing attributes is not enough.

• There must be no tracking.
• Alternatives must be available.
• People must be able to challenge and correct erroneous decisions.

We must always begin the design with its impact on people, not with the means.

Today’s Program Views One Question from Different Angles

Every part of today’s program connects to this issue.

AI ethics and data sovereignty from 10:20.

How should we govern impacts on people without leaving them either to individual ethics or merely to organizational checklists?

Digital identity in the age of AI agents from 13:

As whom does an agent act, for whose purpose, and on whose authority?

The EU Digital Omnibus from 14:25 and the amended Act on the Protection of Personal Information from 16:

How do we preserve the human-centric conditions of transparency, accountability, objection, and remedy while reducing overlap and inconsistency among legal regimes?

The realities of governance operations from 17:25.

Can principles and guidelines be turned into mechanisms for making decisions, keeping records, auditing, improving, and providing remedies in practice?

These are not separate questions.

Does the system empower people?

Or does it confine people within profiles in which they cannot participate?

Today we will consider this one question from the different perspectives of technology, institutions, business, and society.

Revisiting MyData

Revisiting MyData does not mean going back to the past.

It means returning to our purpose.

• The purpose is not to lock data away.
• Nor is the circulation of data an end in itself.
• The purpose is for people to be able to use data about themselves for their own purposes and for the purposes of their communities and society.
• To use that data to build relationships and contexts and represent themselves better.
• And, as a result, to improve their lives, their communities, and society.
• And to avoid harming people or diminishing their well-being through uses outside the intended context.

Throughout today’s sessions, please keep asking:

• Who is the person there?
• What relationships and contexts are they in?
• For whose purpose is the processing performed?
• What data is truly necessary?
• Can the person understand, participate, object, and recover?

Empowering people with their own data.

That is MyData.

I hope today’s dialogue will be the next step toward that goal.

I hereby declare MyData Japan 2026 open.

Thank you.

MyData-Japan-2026-開会宣言-ver.3