Amagasaki City: a contractor employee lost a USB memory holding the resident register of all citizens, for a benefit program

1. 2022-06-21

   An employee of the contractor BIPROGY's Kansai branch took a USB memory holding the data out of a city facility in a bag, for a data transfer at a call center. After the work the employee stopped at a restaurant and noticed on the way home that the bag was lost. [1]

2. 2022-06-22

   The employee searched likely places without success and filed a lost property report with the police. At about 3:45 p.m. the company called the city with a first report. [1]

3. 2022-06-23

   The city announced the case. The USB memory was password-protected and its content encrypted, and no leak to outside was confirmed. [1]

4. 2022-06-24

   The city announced that the lost USB memory had been found. [2]

5. 2022-09-21

   The Personal Information Protection Commission gave BIPROGY guidance under the Act on the Protection of Personal Information. [3]

6. 2022-12-12

   BIPROGY received the report of the third-party committee and announced the disciplinary measures for its officers. [4] [5]

The USB memory held the resident register of all citizens, 460,517 people (name, address, date of birth, sex and more), 360,573 resident tax records, information on households eligible for the special benefit, and account details of households receiving public assistance and child allowance (16,765 and 69,261). The causes included no permission for how the data was carried, carrying it personally, and not deleting the data after the work. [1]

After an on-site inspection, the Personal Information Protection Commission pointed out these problems in BIPROGY's management. An employee saved the data on a USB memory without permission, carried it in a bag without a lock and lost it while eating and drinking. There was no organizational system to analyze and approve risks. Entry and exit control and the storage of media in lockable places were insufficient. It did not know how its subcontractors handled the data. [3]

The guidance asks BIPROGY to set up a risk-based safety management system for all the businesses it is entrusted with and check compliance with its rules, to carry out the recurrence prevention measures already decided, and to strengthen monitoring so that it can grasp how subcontractors handle the data. The Commission said it would keep considering whether further action is needed after seeing the results of the surveys of Amagasaki City and others. [3]

The report pointed to structural problems, including normalized non-compliance with information security rules and unapproved subcontracting that was not unusual. BIPROGY said its president will return 20% of monthly pay for three months, and the executive in charge of business services and the CISO 10% for one month each. [4] [5]