I’ll be honest: I often abandon my shopping cart on Japanese websites.
Not because I changed my mind about the product, and not because the shipping was too high. I walk away the moment a simple e-commerce checkout asks me for my birthday and my marital status.
Why do you need to know if I’m married to sell me a coffee mug? Why do you need my exact date of birth to ship a pair of headphones?
In Japan, we’ve developed a culture of "just in case" data collection. We treat personal information (PII) like a commodity to be hoarded, but as recent massive data leaks have shown us, PII isn’t an asset, it’s a massive glowing liability.
The High Cost of "Just in Case"
Companies often talk about data as "the new oil," but in the era of AI, it’s more like digital plutonium. If you store it, you have to protect it forever. And the reality is, most companies just aren't equipped to do that.
Every time a company asks for an unnecessary data point, they are creating a friction point for the user and a target for a hacker. When I see a form asking for my life story, I don’t see a "personalized experience", I see a company that doesn't respect my privacy enough to realize they’re putting me at risk.
The best way to prevent a data breach isn't a better firewall. It’s simply not having the data in the first place.
The Recruitment Trap
This issue hits home for me in the HR tech space. In Japan, the traditional recruitment process is a privacy nightmare.
Think about the standard rirekisho (resume). Before a candidate even speaks to a human being, they are expected to hand over their photo, their age, their gender, and often their family details. They give this sensitive data to dozens of companies before they’ve even decided they want to work there.
This is fundamentally backwards.
In my view, we should prohibit the collection of sensitive PII during the initial stages of recruitment. A company needs to know your skills and your experience to decide if you’re a fit. They do not need your birthday or your home address until they are actually writing your employment contract.
By demanding this info upfront, companies are building massive databases of "rejected" people who don't even work there, just sitting on a server waiting to be leaked. It’s a ticking time bomb.
"But we need the data for marketing!"
Whenever I bring this up with business leaders, the pushback is always the same: "Mehdi, we need that data for customer insights and culture fit."
Respectfully, I disagree.
If your marketing strategy relies on knowing whether I’m married, your strategy is outdated. Modern business intelligence should be built on behavioral data, what people do, rather than demographic PII, who people are.
And "culture fit"? Using age or gender as a metric for fit isn't recruiting; it’s bias disguised as tradition. The most innovative companies in the world are moving toward "blind" recruitment because it works better and carries zero security risk.
The Path Forward: Privacy by Default
Japan needs a radical shift in how we handle information. We need stricter regulations that force companies to prove a legitimate, functional need for every single piece of data they collect.
- If it’s not essential to the transaction, don't ask for it.
- In recruitment, delay PII collection until the offer stage.
- Start treating data minimization as a competitive advantage.
We have to stop equating "thoroughness" with "safety". As business leaders and as consumers, we need to demand a digital Japan where our personal lives aren't the entry price for a simple transaction.