Too Much Information: Osaka Expo Website’s Excessive Personal Data Demands

Unreasonable Requirements

Before buying electronic tickets for Osaka Expo 2025, which is due to begin on April 13, visitors must obtain an Expo ID by agreeing to what is presented as a “personal information protection policy.” However, organizers have come under fire for the broad scope of personal information that they require.

In addition to details like their name, address, and credit card number—standard requirements when purchasing tickets online—prospective visitors are asked for their location information, biometric data like a face photo and fingerprints, employer and department name, social media accounts and passwords, and whether they have a disability, are married, or have children.

The organizers said that such comprehensive information was needed for managing a range of different events, but the approach drew an online backlash with people questioning what the purpose was and describing it as “frightening.” After Itō Yoshitaka, the minister in charge of the Expo, was pressed for an explanation in the Diet, some requirements were removed, including fingerprints and social media details, and limits were introduced on who received the information, such as pavilion exhibitors.

Sharing with Sponsors

There were reports that at the Expo’s Osaka Healthcare Pavilion run by the Osaka municipal and prefectural governments, health-related information would be collected from consenting visitors and then provided to some of the corporate sponsors.

The Expo departments at both local governments maintained that no problems would arise as the data would be altered to prevent identification of individuals. However, critics countered that it would be possible to identify individuals by comparing the altered data with the original and other data in the possession of the companies.

The pavilion’s personal information policy was later altered to state that information about participants would not be used for unnecessary purposes, except as permitted by the Act on the Protection of Personal Information and other laws. This change was surely the result of media scrutiny.

These examples lay bare how little awareness there is in Japan about handling of personal information and how lacking legal systems are. Such a blunder at an international event like the Expo might lead to feelings of profound distrust among visitors, and especially those from other countries where there is greater concern about personal information issues.

Legal Protection

The European Union’s General Data Protection Regulation seeks to protect personal data by establishing principles for its processing and transfer, and obligations for those who manage and process it. This affects all businesses that operate in the EU.

In 2019, the French data regulator imposed a fine of €50 million on Google for violation of the GDPR in the first such case involving a US tech giant. It was found that Google did not follow the law, even if there was no personal information leak.

Meanwhile the United States has laws like the Children’s Online Privacy Protection Act. In 2019, YouTube and its parent Google faced complaints from the Federal Trade Commission and the New York attorney general for illegally collecting personal information via channels for children without parental consent. The companies paid a settlement of $170 million.

Bearing in mind such cases, the Expo ID approach could be judged as almost criminal. The requirement to agree to a privacy policy is also included on the Expo website’s English-language page, but the legal basis for the demands for additional information is weak, and the way that the organizers narrowed down the scope of their demands in line with specified “legitimate interests of users” from the original broad attempt to suck up all sorts of data requiring broad protection is a clear indication that they realized they were falling afoul of the GDPR.

It is difficult to imagine EU or British data protection organizations identifying issues with ID registration and levying fines on a website operator halfway around the world. However, in the case of a project like the Expo, which targets international visitors, there should have been a globally acceptable policy in line with other countries’ laws.

Matching Global Standards

Following the 2015 amendment to Japan’s Act on the Protection of Personal Information, private companies have new obligations when providing user data to third parties, such as the requirement to note this in privacy policies and give prior notice to the Personal Information Protection Commission. There has been some progress in establishing laws for the online age, but there is still much to do.

In October 2023, stealth marketing was banned in an amendment to Japan’s legislation covering misleading representation. Until then, influencers’ undeclared promotion of products and services had been rampant, and social media and review sites were full of unreliable information. Japan’s move to regulate this issue was due to implementation of laws overseas. Of the nine OECD member economies with the highest GDP, only Japan had no regulations concerning stealth marketing. When everyone is connected online, it is clear that it will not work just to follow the way things are done in one’s own country.

Research shows that the new legislation on stealth marketing led to a reduction in such requests to influencers. Now that the Expo ID issue has exposed inadequacies concerning personal information, the time has come to bring Japanese laws in line with stricter Western legislation. At the same time, different kinds of education are needed to improve citizens’ information literacy and awareness of the issues involved. We should urgently look at Japan’s particular problems and challenges and consider how to match domestic regulation with laws overseas.

(Originally published in Japanese on April 2, 2025. Banner photo: The Osaka Expo venue, as viewed by drone on March 10, 2025. © Jiji.)