In Japan a meibo-ya, or list broker, gathers personal details - names, addresses, phone numbers, ages, occupations - and sells them as lists. Legitimate brokers supply lists to companies for direct mail and marketing; illegal ones sell data obtained from the dark web and other underground channels to phone fraud groups.
Lists are assembled from many sources: databases exposed in corporate data breaches, files recovered from discarded documents and hard drives, entries collected through surveys and prize draws, resold alumni and membership directories, and profiles scraped from social media. Lists of older people fetch the highest prices of all.
The 2015 amendment to the Personal Information Protection Act, fully in force from May 2017, tightened the rules that apply to list brokers. Providing personal data to third parties on an opt-out basis, without obtaining consent, now requires notification to the Personal Information Protection Commission, and the businesses that file such notifications are published on the Commission's website. The amendment also imposed record-keeping duties on the provider and verification duties on the recipient. The 2020 amendment, effective April 2022, expressly prohibited improper use that risks encouraging illegal or unjust conduct, and removed unlawfully obtained data from the categories that may be shared under the opt-out route. Illegal brokers still operate without filing anything, so they slip past these rules, and the trade only becomes partly visible when the breach behind a list comes to light.
To reduce the chance of ending up on a list, avoid registering personal information with services you do not need, think twice before entering prize draws and surveys, keep your phone number off social media, and never give personal details to a suspicious caller. Bear in mind, too, that a list cannot be recalled once it is circulating. You can ask a business that has filed an opt-out notification to stop sharing your data, but copies already resold are beyond reach. Lists of fraud victims get recycled, so be especially wary of calls that follow a loss and promise to "get your money back." See why strangers have your number for a fuller account of how data leaks out.