The 86 million users of the Line free messaging app likely never realized their personal data might have been accessed by Chinese engineers working for an affiliated company.

Four Chinese engineers at a Shanghai-based affiliate that Line subcontracted to develop artificial intelligence for its services accessed the messages stored in the Japanese computer system and personal information of Line users, such as name, phone number, email address and Line ID.

The engineers accessed the Japanese computers at least 32 times, beginning in August 2018.

Noboru Nakatani, group chief trust and safety officer at Z Holdings Corp., Line’s parent company, apologized to Line users.

“We are aware of the need to take aggressive measures related to the overseas transfer of data,” he said. 

Line officials said they had not detected any inappropriate accessing of the data and on Feb. 24 took steps to prevent further access of the information from abroad.

Line also turned to other companies for help in monitoring its Timeline service, which began in January 2020. A Japanese company was contracted to monitor any inappropriate postings to the service, but that company, in turn, subcontracted the work to a Chinese company based in Dalian.

Whenever the Chinese company received notices from Japanese Line users about inappropriate postings to the service, staff at the Chinese company accessed Line’s Japanese computers to monitor the suspected messages, photos and videos.

Line Corp. has acknowledged a shortcoming in its privacy policy and set up a third-party committee to look into its operations.

The company also reported the matter to the government’s Personal Information Protection Commission.

The Personal Information Protection Law limits the transfer of personal information to other nations as well as accessing that data from abroad. Provisions spell out that the consent of the individual is required before such information can be transferred abroad or allowed access by those in foreign nations.

Line’s privacy policy states “we may transfer Personal Data to a third country without any data protection laws which are equivalent to those of the country or region where you live.”

However, under the revised Personal Information Protection Law, which passed the Diet in June 2020, the commission has asked companies to clearly state which nations the data might be transferred to.

The Line messaging app was developed in the months following the 2011 Great East Japan Earthquake and tsunami when family members and friends faced problems contacting each other because phone lines were down.

It is now used by the central and many local governments to notify residents about developments in dealing with the novel coronavirus pandemic and, as such, has become a vital component of the social infrastructure.

Line has "begun considering a more accurate and detailed expression” in its privacy policy, said Jun Masuda, a director and chief strategic marketing officer for the company.

Line will also revise its privacy policy because of the current vagueness of the wording.

Masuda explained that the company subcontracted the monitoring because of a lack of Japanese personnel with the required skills and added, “There was the concern that our services would lose to those offered by other Japanese companies and companies in other nations if we did not cooperate with members from a wide range of nations.”

A scholar said a thorough investigation was needed regarding the information actually accessed by those in China.

“There will be a need to clarify in detail what kind of people accessed what types of data as well as the extent of the accessing,” said Harumichi Yuasa, a professor of cybersecurity law and vice president at the Institute of Information Security.

He added that with the central and local governments using Line for dealing with the COVID-19 pandemic as well as consulting services related to suicide prevention there was a need for officials at those governments to reconfirm their use of the company’s services.

(This article was written by Kenji Minemura, a senior staff writer, and Toshiya Obu.)