TOKYO -- Japan's messaging app Line has stopped its Chinese affiliates and contractors from accessing the personal information of Japanese users, the company said Tuesday, in response to growing scrutiny over its data management practices.
Line also said it would transfer some information stored in data centers in South Korea, such as such as images and videos posted by users in Japan and payment histories from its LinePay service, to Japan by September.
Japanese media reported last week that four employees of Line's Chinese affiliate had access to information about users in Japan, including names, IDs and phone numbers. Line used Chinese affiliates and contractors to develop services, as well as a local subsidiary of its parent company, South Korea's Naver.
It is not unusual for technology companies to outsource part of their operations overseas. But China's National Intelligence Law allows authorities there to potentially access users' personal data managed by private-sector companies.
Using overseas contractors is not a violation of Japanese privacy rules. Still, Idezawa said the company needed to respond to regain user trust.
"It's not a question of legality. There was a lack of consideration for users," he said.
"Thankfully, there has been no major change in the number of users," Idezawa said.
Line launched its instant messaging service in June 2011 and now counts roughly 86 million users in Japan. The company has since expanded into e-payments, advertisements and other services, and is used by Japan's national and municipal governments as a way to communicate with the public and allow electronic filings.
"Line is becoming part of the social infrastructure," said University of Tokyo professor George Shishido, citing the company's unrivaled market share in instant messaging in Japan. The company has only expanded its footprint at home with a merger with SoftBank-controlled Z Holdings, formerly known as Yahoo Japan, completed this month.
Line said there had been no unauthorized access or leak of user information. But it has apologized for inadequately explaining to its users and changing its practices, as the company eyes global expansion amid growing scrutiny worldwide over data management.
Japan's updated data privacy law, which takes effect in next year, requires companies to ask for user consent when providing their personal data to a foreign party unless they meet certain standards. The law is modeled after the European Union's General Data Protection Regulation, which requires free and informed consent from users regarding the use of their personal data.
The Japanese government's Personal Information Protection Commission has asked Line to provide information to determine whether the company's practices were in accordance with the law.
Some Japanese government bodies and municipalities have begun scaling back their use of Line while the investigation is ongoing.
The backlash is the first major test for Z Holdings post-merger.
Z Holdings revealed on Tuesday that it had investigated Line's data management policies in China and questioned Line about them in February, before the merger was completed.
Z Holdings set up a special committee of experts to investigate Line's data governance, including the involvement of the Chinese affiliates in February. On Tuesday, Z Holdings' stock price fell to its lowest level since July.
The scrutiny over the company's data management practices is raising questions over how Japanese organizations, many of which are grappling with a shortage of software engineers, are outsourcing the management of sensitive user information to foreign companies. The PIPC is planning to survey other Japanese tech companies regarding this matter.