The operator of T Card, one of the most popular reward cards in Japan, has been providing personal information of cardholders to investigation authorities upon their request. Though the data was supposedly used for criminal investigations, the practice raises important questions about privacy protection. Since 2012, the personal information, including the names and addresses of cardholders, and records of their purchases and use of services at shops using the cards, has been released without court warrants, and the operator failed to inform the roughly 67 million cardholders in the terms of its service that their information could be supplied to investigators.
In fact, Culture Convenience Club (CCC), which manages the card and runs the Tsutaya rental video and bookstore chain, is just one of many companies that cooperate with police and prosecutors' investigations by voluntarily providing such information — which can offer clues on what specific individuals were doing at a specific time and place. Investigators reportedly obtain such information on a routine basis without being vetted by third-party oversight, such as by getting a court warrant, on how the information will be used in their investigations, as well as how they manage (or destroy, when appropriate) such data.
The Criminal Procedure Law allows investigators to request public and private organizations to provide information relevant to criminal investigations, and the data on T Card holders have been supplied upon such requests from police and prosecutors. Unlike when they are mandated to do so by a court warrant, parties called on to supply the information won't be punished if they refuse to comply with the requests, but most businesses reportedly comply voluntarily.