On 6 November 2026 Japan's Ministry of Internal Affairs and Communications (MIC) announced that it had issued written administrative guidance to NTT DOCOMO, INC. over a leak of "specified user information".
Specified user information is user information that the Telecommunications Business Act requires telecommunications carriers designated by the Minister to handle properly.
This page sets out what MIC published in its press release and guidance letter, and the wording of the relevant provisions.
Overview
| Item | Details |
|---|---|
| Date of release and guidance | 6 November 2026 |
| Contact | Telecommunications Business Department, Telecommunications Bureau, MIC |
| Type of measure | Written administrative guidance (MIC ref. No. 105) |
| Addressee | NTT DOCOMO, INC. |
| Recipient of the data | Amazon Japan G.K. |
| Data provided | Phone numbers and user identifiers of 344,213 people |
| Provision referred to | Article 27-5 and other provisions of the Telecommunications Business Act |
| Reporting deadline | Written report by the end of December 2026 |
Background
According to the press release and the guidance letter, the online application flow for DOCOMO's "docomo MAX" and other price plans was revised. In the process, the notice on third-party provision of user information to Amazon Japan G.K., which provides a benefit service for subscribers to those plans, was dropped from the important-matters explanation and other notes.
The responsible department did not notice this before the flow was finalised, and the phone numbers and user identifiers of 344,213 people were sent to Amazon Japan G.K. without valid consent from the subscribers concerned. MIC states that this came to light as a leak of specified user information.
The guidance letter records DOCOMO's report that the data was intended for notifying subscribers who had not yet used the benefit service, had not been used at the time of the report and has since been deleted, so there was no secondary harm.
Free Tool Related to This Article
Contract Risk Checker
Try our free simulator related to this topic.
Try for free →MIC's findings
The guidance letter states that the phone numbers and user identifiers were information the recipient would use to match against its own account information and identify individual users. It finds that continuing to provide the data without valid consent for about four months amounted to gross negligence that could harm users' interests.
The letter gives the following causes:
- No adequate process was in place, when revising the application flow, to confirm that the consent notice was missing
- Human error and weaknesses in the management system, such as insufficient checking by the responsible department and poor coordination between departments
- A possibility that the responsible and service departments did not have a sufficient sense of the norms on protecting specified user information
MIC states that DOCOMO, as a carrier designated under Article 27-5, is required to manage specified user information properly, and that the leak breached the Act and is regrettable.
FREE CONSULTATION
Corporate Law: your first 30 minutes are free
- ・Handled by Yusuke Abe, admitted in Japan and New York
- ・Online (Zoom etc.) or at our office in Otemachi, Tokyo
- ・In English or Japanese
Content of the guidance
| Item in the guidance letter | Details |
|---|---|
| Guidance | A strict warning to implement thorough measures to prevent leaks of specified user information caused by third-party provision without consent and inadequate legal compliance, not only for online procedures |
| Measures DOCOMO has taken and plans | Taken: correcting the application flow concerned and a full review of other application flows. Planned: appointing a person responsible for updating each set of terms, and informing and training the employees concerned |
| Action requested | Reliable implementation of the preventive measures, renewed emphasis among employees on legal compliance regarding the protection of specified user information, and review of the information handling rules where necessary |
| Report | A written report on the implementation of the preventive measures by the end of December 2026 |
Relevant provisions
Article 27-5 of the Telecommunications Business Act provides that the Minister for Internal Affairs and Communications may designate a carrier that provides a telecommunications service specified by ministerial ordinance as having a large impact on users' interests, in light of its content, the range of users and its usage, as a carrier that must properly handle specified user information.
The Article defines specified user information as information about users obtained in connection with that service that is either:
- Information falling under the secrecy of communications, or
- Information that can identify a user (limited to certain users) and is specified by ministerial ordinance (excluding the above)
A designated carrier must establish "information handling rules" covering matters such as the security management of specified user information and the supervision of contractors, and notify them to the Minister within three months of designation (Article 27-6). It must also establish and publish, within three months of designation, an "information handling policy" covering matters such as the content of the specified user information it obtains and the purposes and methods of its use (Article 27-8).
Sources
- MIC, press release on measures for the protection of specified user information addressed to NTT DOCOMO, INC. (6 November 2026, in Japanese) https://www.soumu.go.jp/menu_news/s-news/01kiban18_01000300.html
- MIC, guidance letter (attachment, MIC ref. No. 105, in Japanese) https://www.soumu.go.jp/main_content/001100062.pdf
- Telecommunications Business Act (e-Gov, in Japanese) https://laws.e-gov.go.jp/law/359AC0000000086
This page is based on what the government published and on the wording of the relevant laws. If you need advice on a specific matter, please consult a lawyer.