Docomo: 16,000 number-porting contracts lacked consent for Google data
In short
NTT Docomo said about 16,000 new contracts made through mobile number portability in September did not get consent for the third-party provision of customer data, because of an error in its store procedure system. In 225 of those cases users sent or received RCS messages, and information such as phone numbers and sending times was provided to Google, though Docomo says message bodies were encrypted. Docomo suspended RCS use for the affected users from September 30 and began contacting them individually on October 4.
Read the full story 2 min read
NTT Docomo said on October 4 that it had failed to obtain customer consent for the third-party provision of personal data covering about 16,000 new phone contracts, according to Sankei Shimbun and Nikkei. The contracts were made through Japan's mobile number portability system at Docomo shops and electronics retailers between September 17 and 25, and the company attributed the failure to a setting error in a revamped store procedure system. [ 1 , 3 , 4 ]
The service concerned is RCS, a successor to SMS that handles photos, videos and stickers as well as text. Docomo launched it on August 24 and it had about 1.26 million users at the end of September, according to Nikkei and ITmedia. Normally, with consent, the carrier sends Google information including the user's phone number, subscriber identification, sending and receiving times and the counterparty's phone number, ITmedia reported. Sankei said the recipient was Google in the United States, while ITmedia named Google Asia Pacific; the documents do not reconcile the two. [ 1 , 3 , 4 ]
In the affected cases the store terminal did not display the important-matters explanation or the consent confirmation screen for third-party provision, the outlets reported. In 225 of the roughly 16,000 cases, users actually sent or received RCS messages, and information about those exchanges was provided to Google, Docomo said. The company said message content is encrypted and that Google cannot view it. Livedoor News reported that information was sent externally without any explanation at the time of contract. [ 1 , 3 , 4 , 5 ]
Docomo began suspending the affected users' RCS use from 8 p.m. on September 30 and started contacting them individually from 10 a.m. on October 4, according to Nikkei and ITmedia. ITmedia said users who want to use RCS again must lift an RCS usage refusal setting through online or store procedures. [ 1 , 3 , 4 ]
The disclosure follows a separate announcement on September 16, in which Docomo said it had provided the phone numbers and rate-plan details of about 340,000 users to Amazon's Japan unit without consent. [ 1 , 3 , 5 ]
Why it matters
The disclosure puts a second data-handling failure by NTT Docomo within a month into public view, after the company said on September 16 that the phone numbers and rate-plan details of about 340,000 users were provided to Amazon's Japan unit without consent. The service at issue, RCS, is a messaging standard operated with Google that Docomo launched only in August. The documents do not say what regulatory or financial consequences may follow.
Key facts
- NTT Docomo said it did not obtain consent for third-party provision of customer information covering about 16,000 new contracts made through mobile number portability. [ 1 , 2 , 3 , 4 ]
- The affected contracts were made at Docomo shops and retailers between September 17 and 25; Docomo attributed the failure to a setting error in a revamped store procedure system. [ 1 , 3 , 4 , 5 ]
- In 225 of the roughly 16,000 cases, users sent or received RCS messages and information about those exchanges was sent to Google. [ 1 , 3 , 4 ]
- According to Docomo, the data involved includes sending and receiving times and phone numbers, while message content is encrypted so that Google cannot view it. [ 1 , 3 , 4 ]
- Docomo began suspending the affected users' RCS use from 8 p.m. on September 30 and started contacting them individually from 10 a.m. on October 4. [ 1 , 3 , 4 ]
- RCS, a successor to SMS that also handles photos, videos and stickers, was launched by Docomo on August 24 and had about 1.26 million users at the end of September. [ 3 , 4 ]
- Docomo said on September 16 that the phone numbers and rate-plan details of about 340,000 users had been provided to Amazon's Japan unit without consent. [ 1 , 3 , 5 ]
Confirmed by several sources
- Docomo announced that it had not obtained consent for third-party provision of customer information for about 16,000 new mobile number portability contracts. [ 1 , 3 , 4 ]
- The number of affected contracts was about 16,000. [ 1 , 2 , 3 , 4 ]
- Information related to message exchanges was provided to Google in 225 of those cases. [ 1 , 3 , 4 ]
- The consent screen and important-matters explanation were not displayed at stores between September 17 and 25 because of a fault in the store procedure system. [ 1 , 3 , 4 , 5 ]
- Docomo suspended RCS use for affected users from September 30. [ 1 , 3 , 4 ]
- Docomo said message content is encrypted and cannot be viewed by third parties. [ 1 , 3 , 4 ]
- On September 16 Docomo disclosed that information on about 340,000 users had been provided to Amazon's Japan unit without consent. [ 1 , 3 , 5 ]
Still unclear
- Which Google entity received the information. Sankei Shimbun says the data went to Google in the United States, while ITmedia names Google Asia Pacific; the documents do not reconcile the two.
- Whether the information already provided to Google can be recovered or deleted, and whether affected users will receive compensation. None of the documents address deletion, recovery or compensation.
- What response, if any, regulators or government bodies will take. The documents report only the company's announcement and do not mention any regulatory action.
What local media are saying
Timeline, local time
- Docomo launches its RCS messaging service on August 24. [ 3 , 4 ]
- Between September 17 and 25, store terminals for mobile number portability contracts do not display the important-matters explanation or the consent screen for third-party data provision. [ 1 , 3 , 4 ]
- On September 30 at 8 p.m., Docomo begins suspending RCS use for affected users. [ 1 , 3 , 4 ]
- On October 4 at 10 a.m., Docomo begins contacting affected users individually. [ 3 , 4 ]