In recent years, with the development of digital technology, an increasing number of services make use of data concerning users. In utilising data, while providing valuable service to people and society is expected, there is a need for transparency in data use practices, including how data is handled and how privacy is considered.
In response to this situation, at the forthcoming Expo, in addition to complying with the relevant law, a VPIA (Value and Privacy Impact Assessment) will be conducted in utilising the data as a voluntary initiative to increase transparency.
What is VPIA?
What is VPIA?
A VPIA is a tool for service providers to assess the benefits of their services, their privacy impact and how privacy is considered, and to explain the results of their assessment to users in an easy-to-understand manner. In addition to the service providers’ own assessments, third party assessments will also be conducted from the users’ perspective in order to provide more user-friendly services.
*VPIA is an acronym for Value and Privacy Impact Assessment, independently defined by the Expo, and it’s conducted by participants involved in data utilisation initiatives that handle data about users.
Full Process of VPIA
Full Process of VPIA
①Self-Assessment by Participant
In accordance with the prescribed assessment items, the participant identifies possible risks after organising the values of the service and the data handling situation, examines the countermeasures against those risks and submits the assessment results as a VPIA report.
Assessment Items
Assessment Items
Points to be clarified by the VPIA
- What is the value of the service?
- What kind of data will be collected and what’s the purpose of its use?
- How is the data handled?
- What are the anticipated risks?
- How are privacy considerations addressed?
②Assessment by a third-party
The VPIA report is assessed on behalf of users by members of the VPIA community, who come from diverse age and professional backgrounds, to evaluate whether the report explains the value and privacy considerations of the service in an easy-to-understand manner, thereby boosting risk reduction and value enhancement of each service. The service provider will receive feedback on the results of the assessment and, if necessary, revise the VPIA report after reconsidering the services and other aspects of the assessment.
Members of the VPIA Community
（with the titles omitted and the names listed in Japanese syllabary order）
OKUHARA Sanae
Affiliation：
- Director, Research Institute for Consumer Affairs, Nippon Association of Consumer Specialists
- Director, Accredited Personal Information Protection Organization
Administrative Office, Foundation for Promotion of Digital Economy and Community
Category of Viewpoints：
Consumer
KATIRAI Amelia
Affiliation：
- Specially-Appointed Assistant Professor, Osaka University Research Centre on Ethical, Legal and Social Issues
Category of Viewpoints：
Society and Ethics
SAKUMA Hiroshi
Affiliation：
- Impact Officer at Global Shapers Community Osaka Hub, the World Economic Forum
- Specially Appointed Researcher at the Social Solution Initiative, Osaka University
Category of Viewpoints：
Youth
TSUNODA Mio
Affiliation：
- Global Shapers Community Osaka Hub, the World Economic Forum
- CEO, Darajapan Inc.
Category of Viewpoints：
International
NOBUTOMO Hiroyuki
Affiliation：
- Project Researcher, Tokyo University Interfaculty Initiative in Information Studies
Category of Viewpoints：
Data Linkage
The assessment by the members of the VPIA Community is to be conducted according to the following assessment items.
Details of Assessment Components
Details of Assessment Components
Assessment Items
General Comment
General comment on the content of VPIA report
① Service Values
② Data Handling
③ Risk Measures
Rate the ease of understanding of the VPIA report on a scale of 1-3
Rate the ease of
understanding of the VPIA
report on a scale of 1-3
Clearly understandable
Clearly understand-
able
Generally understandable
Generally understand-
able
Partially not understandable
Partially not understand-
able
Sample Page of Assessment Results
General Comment
The amount of the data to be collected is kept to a minimum. At the same time, a number of anticipated risks have been identified and the countermeasures against those risks have also been developed.
As improvements may arise during the operation of the service, the opinions of users should be actively considered.
① Service Values
Service outline
Is the overview of the service understandable?
Clearly understandable
Clearly understand-
able
Service benefits
Is the benefits provided by the service understandable?
Generally understandable
Generally understand-
able
② Data Handling
Status of data handling
Is the overall picture of the service’s data handling understandable?
Partially not understandable
Partially not understand-
able
Data to be acquired and purpose of use
Are acquired data items and purpose of use understandable?
Clearly understandable
Clearly understand-
able
③ Risk Measures
Anticipated risks
Is the risks anticipated from the user’s perspective understandable?
Generally understandable
Generally understand-
able
Risk measures
Are the countermeasures against anticipated risks understandable?
Clearly understandable
Clearly understand-
able
*Members of the VPIA community will assess the VPIA report from the perspective of whether it is explained in a way that users can understand. Also, this assessment is conducted for the services which acquire user-related data through the data utilisation initiative based on the user’s consent.
③Publication of Assessment Results
By publishing parts of the VPIA report and the results of the assessment by the VPIA community through this website, users are provided with information to help them better understand the service. The user can check this information before using the service by being directed to this website from the data linkage setting screen.
Sample operation screen for users to review assessment results
Sample operation screen for users to
review assessment results
*Note: Screens shown below are samples and differ from the actual screens.
①
Being directed to this website from the data linkage
setting screen before starting to use the service
②
Review parts of VPIA reports and the results of the
assessments for each of the services
③
Set up data linkage and start
using the service