What Management Must Decide First in an Information-Leak Emergency

This article discusses what management should decide and by when in an “information-leak emergency,” not limited to AI-related incidents. While the Personal Information Protection Law requires reporting to the commission (preliminary and final reports) and notifying affected individuals, it does not specify the scope of public disclosure or concrete measures for compensation and support, so companies need to prepare the order and criteria for making those judgments.

The author compared the public statements of five major domestic incidents (Benesse, Omiai, 快活CLUB, タイムズカー, 第一興商) and showed that the speed of the initial announcement and the timing of presenting compensation/support policies can proceed on different timelines. For example, Benesse first announced that it would secure a fund of 20 billion yen, 快活CLUB explicitly stated it would not provide individual compensation, and タイムズカー said it would decide its policy after conducting an external investigation.

Because users often take actions such as reissuing cards or starting procedures before a company makes its final decision, companies should provide practicable guidance early even while investigations are ongoing, including “recommended countermeasures and their limits,” “whether and for whom cost support will be provided,” “what information should be kept as records,” and “when the next explanation will be given.” The cases of Fujifilm and Sourcenext are introduced as examples that concretized policies on who would bear card reissue costs and provided concrete procedural guidance.

Finally, the article lists matters that should be determined in peacetime: (1) decision subjects and criteria, (2) decision-makers and authorities, and (3) conditions for review and reporting. It especially recommends separating the “decision to stop” from the “decision to resume,” and setting deadlines for explanation updates, timing for reconsideration of unresolved decisions, and where to report if a decision cannot be reached. The piece concludes that the board of directors should confirm in peacetime who has the authority to stop operations and the conditions for resuming, the structure for compensation decisions, and data retention periods.