In this blog post, we’ll examine whether cutting-edge information technologies—such as iris recognition, CCTV, location data, and personal information databases—pose a risk of infringing on privacy and personal information, even as they enhance crime prevention and convenience.
In the movie ‘Minority Report’, people do not carry ID cards to verify their identities. Nor do they need to carry separate access cards to enter their workplaces. All they have to do is look into the iris scanners installed in various locations. Their identities are verified through the iris recognition system. As long as a person’s iris remains unchanged, their identity can be verified anytime, anywhere. And it’s not just limited to identity verification. Billboards installed throughout busy downtown areas scan people’s irises as they pass by, mentioning their names while advertising products. Furthermore, scanners and CCTV cameras installed on public transportation and other locations track people’s locations and transmit the data in real time to a central control system. This technology appears incredibly appealing. In fact, biometric technologies using irises, faces, and fingerprints are already being developed and utilized in various fields, and video analysis technology—which combines cameras and artificial intelligence—is also advancing rapidly. At the current level of technology, real-time tracking of every person through a single system—as depicted in movies—has not yet become commonplace; however, given that the scope of what is technically possible is gradually expanding, it is difficult to view the movie’s premise as mere fiction. If such technology were to be widely utilized under appropriate legal and technical controls, it could aid in tracking down criminals or locating missing persons. Furthermore, if small robots—such as the tiny spider robot used in the movie—become more advanced and widespread, police officers could use them to search multiple locations and locate suspects, even when facing staffing shortages. Even when there are few clues about a suspect after a crime occurs, if the victim’s testimony allows for a relatively accurate determination of the location and time, this information can be used to analyze relevant video footage or movement records to narrow down the list of suspects. In short, this is a technology that could bring significant benefits to society as a whole. So, are there any problems with a technology that seems so perfect? Technical flaws are simply another challenge that must be addressed and resolved as the technology advances. The more important issue arises from the fact that technology can infringe upon human rights and freedoms. Due to iris scanners, CCTV cameras, various sensors, and video analysis systems installed throughout the city, information regarding a person’s activities and movements may be recorded regardless of their individual wishes. These records of personal activities can be stored on an individual’s own devices or storage media, or on a larger scale, in the personal information processing systems and servers of corporations or public institutions. This means that information about one’s appearance or behavior could end up in the hands of an unknown third party against one’s will. If recognized iris or facial data is combined with other personal information, various agencies or businesses may be able to ascertain information regarding a specific person’s location and behavior. As the information age advances and technologies seen in movies become more sophisticated, the potential for privacy violations and infringements on the right to self-determination regarding personal information may also increase. When information can be easily collected and cross-referenced, the likelihood of problems arising during the process of administrators using personal information for other purposes or disclosing it to third parties also rises. In particular, under the current personal information protection framework, biometric data and biometric recognition information are protected separately from general personal information, and biometric recognition information processed to authenticate or identify a specific individual must be handled with even greater care. Even if the future does not unfold exactly as depicted in the movie, issues regarding personal information protection and privacy infringement remain critical social concerns due to the advancement of information technology today. In the past, various controversies and incidents arose surrounding the collection and protection of personal information, including location data. However, under current technology and regulations, features that allow users to set and manage access permissions for location data have been strengthened, and companies must also process personal information by considering the purpose of collection and use, the retention period, and users’ rights. For example, Apple currently allows users to directly manage location services and has safeguards in place, such as sharing location data with third parties only with the user’s consent. Furthermore, Apple states that it deletes location data once the purpose of collection has been fulfilled and there is no longer a need to retain it. Google also informs users that enabling the location history feature may result in the storage of precise device locations, while explaining that the Timeline feature is turned off by default and must be activated manually by the user. Additionally, it allows users to set an automatic deletion period or delete stored location data directly. As seen in past data breaches, the risk that personal information collected by major internet sites or credit card companies could be leaked through hacking or misused by internal personnel cannot be considered completely eliminated. Therefore, when it comes to personal information protection, it is necessary to examine not only whether information can be collected, but also who is collecting it, for what purpose, how long it is retained, to whom it is provided, and how it is deleted.
Consider a scenario, as seen in movies, where central intelligence agencies or investigative bodies establish various databases to apprehend criminals. They link people’s iris or facial data to their names, addresses, tax payment records, driver’s license information, and other details for use when necessary. Additionally, information regarding an individual’s preferences or interests can also be collected. This enables the provision of information tailored to each person, and—as seen in movies—it is technically possible for billboards to recognize a passerby’s biometric data and display personalized advertisements suited to that individual. However, in reality, such information cannot be collected and combined without any restrictions. When processing personal information, one must consider the requirements, purposes, and security measures stipulated by law; in particular, information used to identify or authenticate individuals—such as biometric data—must be managed even more strictly. If the personal information of people worldwide were collected via iris recognition systems and stored on a single central server, and if law enforcement agencies in each country could jointly access this information, it would at least reduce the need for authorities to travel to multiple locations just to determine which country a criminal is in—a situation that currently arises when their whereabouts are unknown. However, collecting and storing the personal information of all ordinary citizens in order to catch criminals could lead to the serious problems mentioned earlier—such as data breaches, misuse of information, and excessive surveillance. No matter how important the goal of crime prevention may be, treating everyone as a potential criminal and accumulating a vast amount of personal data in this manner could create another social risk.
Collecting diverse information for use in emergencies and, otherwise, providing only the information people want based on their preferences is convenient and useful. However, the problem lies in the possibility that the collected information may not be managed properly. It is not the act of collecting information itself that is the problem; rather, significant errors can occur during the management and use of the information after it has been collected. While the collection of information is facilitated by various systems created by advanced technology, it is ultimately people who operate and use those systems. Even if one prides oneself on operating the system objectively, humans are beings capable of making emotional judgments; therefore, there is a possibility that a momentary mistake or intentional action could lead to the infringement of another person’s privacy. In the movie ‘Minority Report’, former PreCrime Director Burgess exploits a loophole in the system to commit murder in order to achieve his own goals. Furthermore, to conceal this murder, he attempts to use the system again to eliminate anyone who comes close to uncovering the truth. As this example shows, no matter how sophisticated a technology is designed, it can become a dangerous tool if the person using it harbors malicious intent or misuses the system’s privileges. As technology continues to advance and more information becomes centralized within a single system, the authority of central administrators may grow; if a specific administrator or agency abuses that authority, the damage caused by personal information breaches can become even more severe. In fact, current security measures for personal information protection place significant emphasis on access control for personal information processing systems, management of access logs, and technical, administrative, and physical safeguards. While centralizing systems to facilitate management offers advantages in terms of efficiency, concentrating the management of collected information in the hands of a specific individual or a small group of administrators can also increase the risk of personal information being extracted and misused. Therefore, it is necessary to design stricter protocols for accessing personal information to prevent any single individual from exerting complete control over the entire system. For example, one approach is to decentralize access rights so that critical personal information cannot be accessed, or the entire system viewed and used, without approval from multiple individuals. Additionally, personal information can be stored with strong encryption to prevent it from being easily extracted in a short period of time. It is also necessary to establish separate control procedures to ensure that systems required for decrypting or accessing critical personal information do not operate without specific commands or authorization. Furthermore, I believe we must establish robust measures to enhance the reliability of system operations by conducting more thorough training and audits for central administrators regarding security duties, continuously managing access permissions, and ensuring that unnecessary personal information is securely deleted. Ultimately, what matters is not how advanced the technology is, but rather the principles by which it is used, who manages it, and the extent to which individuals—as the subjects of their personal information—are empowered to control their own data. Even if technology capable of placing the world’s information at one person’s fingertips—as depicted in movies—were to become a reality, that information must never be entrusted to a single individual.
