Delivered on October 19, 2026
"AI and Data Utilization Go Beyond 'Consent' – VPIA Starting from the World Expo and New Rules for Data Utilization Trusted by Society"
Speakers:
Daisuke Yamashita, PrivacyTech Inc.
Atsuo Kishimoto, The University of Osaka Research Center on Ethical, Legal and Social Issues
Kuniyuki Kawashima, LBMA Japan
Affiliation and position information is as of the time of distribution
This is an archived recording of a conference session held at CEATEC 2026 on October 13th.
While the use of data, including AI and location information, is rapidly advancing, simply complying with laws and obtaining "consent" is no longer sufficient to adequately address consumer anxieties and social acceptance. This session will focus on VPIA, a multifaceted evaluation of the "value" and "impact" of data utilization, as implemented at the Osaka-Kansai Expo. Combining research toward social implementation being advanced by the Osaka University ELSI Center and Privacy Tech, with the efforts of LBMA Japan, which has promoted the sound use of location data across industries, this session will discuss new governance models for "advancing" AI and data utilization in a way that is trusted by society, rather than "stopping" it, from the perspectives of companies, researchers, and industry associations.
＝＝＝＝
The Limitations of "Consent" in AI and Data Utilization and the Current State of Information Leakage Risks
While the utilization of AI and location data is accelerating, concerns about a series of information leaks and privacy issues are growing, pushing traditional data governance to its limits. Privacy policies presented when using services are becoming increasingly complex and lengthy, exceeding 30 pages when printed, and currently requiring approximately 76 hours per year to read thoroughly. As a result, the majority of users click the consent button without reading the content, creating a structure that forces consumers to give insincere consent while unilaterally shifting responsibility onto businesses.
The Mechanism of "Critical Firestorms" and Loss of Corporate Trust That Cannot Be Prevented by Legal Compliance
Even after many companies launch services after legal checks by legal departments and lawyers, there are frequent cases where services are forced to be suspended or withdrawn due to social criticism. Even if legal compliance (legal) is cleared, the gap between this and the psychological concerns and unease (social) that consumers feel cannot be bridged, and legal compliance alone cannot prevent crises. Especially in today's world, where advanced analysis and data integration by AI are advancing, even non-personal information carries the risk of harming individual dignity through inappropriate estimation or use.
Responsible Innovation Brought About by ELSI and Social Technology
In an era where legal reforms cannot keep pace with technological innovation, governance and rulemaking that address ethical, legal, and social issues (ELSI) are essential. Osaka University's ELSI Center and others are not merely developing cutting-edge technologies, but are also researching and developing "social technologies" to address challenges in social implementation. Companies are required to incorporate AI ethical principles, purpose, and ethical perspectives as guidelines when they are unsure, and pursue trustworthy and responsible innovation (RRI).
Evaluation Framework and Results of "VPIA" Demonstrated at the Osaka-Kansai Expo
At the Osaka-Kansai Expo, "VPIA," a multifaceted evaluation of the value provided by data and its impact on privacy, was developed and introduced. An innovative system was established in which third parties, such as citizens and young people, evaluate the ease of understanding of reports presented by businesses outlining value and risk countermeasures on a three-point scale. A system has been introduced that allows users to check third-party evaluations via a balance scale icon on the screen, demonstrating a new governance model that enhances credibility rather than relying on expert-led judgments of good or bad.
Risk Extraction through Data Flow Visualization and Involvement of Diverse Personnel
For practical risk assessment, creating a "data flow diagram" that organizes data acquisition, processing, and output from a stakeholder perspective is effective. By visualizing the flow of data, potential concerns and vague feelings of unease can be verbalized, allowing for high-resolution identification of risks. Involving personnel with diverse perspectives, such as not only engineers but also public relations staff, administrative staff, and external citizens, lays the foundation for fulfilling accountability in the event of a data breach.
Challenges of Introducing VPIA to Corporate Practices and Strategies to Avoid Excessive Workload
When deploying VPIA to the daily operations of private companies, the time and cost required for verification, and the increased burden on the field, are major obstacles. Applying a uniform, rigorous evaluation to all cases would lead to operational failure, so pre-screening and sorting of evaluation levels according to the risk level of the measures are crucial. Privacy tech companies, LBMA Japan, and academia are collaborating to explore customized solutions tailored to each company's philosophy and efficient evaluation support utilizing AI technology.
Summary
Data utilization in the AI era requires a shift to a new governance model that transcends relying solely on formal "consent" and legal compliance, and instead aims to gain social acceptance and trust. The VPIA, demonstrated at the World Expo, is a powerful framework that balances business accountability with social acceptance by visualizing value and impact and incorporating a citizen's perspective. Rather than halting data utilization due to excessive fear, it is expected that combining risk identification from diverse perspectives with AI-supported tools will enable data utilization that is trusted by society.