Murata, Kiyoshi; Orito, Yohko; Fukuta, Yasunori --- "Social Attitudes of Young People in Japan towards Online Privacy" [2014] JlLawInfoSci 6; (2014) 23(1) Journal of Law, Information and Science 137

Social Attitudes of Young People in Japan towards Online Privacy

KIYOSHI MURATA^[*], YOHKO ORITO AND YASUNORI FUKUTA

Abstract

This study attempts to explore the attitudes of young Japanese people towards online privacy as customers of online shopping sites in the Japanese socio-cultural context through questionnaire surveys and follow-up interviews. Although it is reputed that Japanese people have recently become sensitive to the importance of protecting personal information and privacy, the survey outcomes, which contained seemingly contradictory responses, showed that this was not necessarily the case. Analysis of the survey results and subsequent discussions led to useful suggestions for businesses developing appropriate personal information and privacy protection policies and schemes. Those discussions also provided helpful suggestions to governments for making and implementing related policies including the enforcement of legal regulations for successful B to C e-commerce and personal information and privacy protection and the development of proper educational programmes concerning personal information and privacy protection in the Japanese socio-cultural environment.

Introduction

Since its early stages, business to consumer (B to C) e-commerce has been accompanied by the concerns not only of privacy advocates but also of a wide range of individual users over the possible misuse of their personal information and invasions of the right to information privacy. However, these drawbacks are potentially offset by the convenience afforded to consumers by B to C e-commerce. Despite tremendous advancements and widespread availability of security technologies to protect online privacy, such as public-key cryptography, the significant efforts to develop privacy enhancing technologies and the enactment and/or revision of relevant legislation for the protection of personal information, concerns remain in the minds of a broad range of people.

As a way of addressing these concerns, a large majority of B to C e-commerce sites post their privacy policies online. It is argued that an online privacy policy functions as a tool to engender consumers’ trust in online businesses.^[1] The Next Generation Electronic Commerce Promotion Council of Japan^[2] agrees with this proposition, insisting that in order to gain consumers’ trust each online shopping company should create a link to its online privacy policy on the front page of its website so that visitors to the website can have one-click access to the policy. The Council also points out that an online privacy policy should contain a detailed description of the nature of the privacy protection afforded to consumers including the purposes for which personal information is used; the manner in which it is collected; how personal information is shared and disclosed; any security measures; and how the site uses cookies.

It may intuitively be plausible that cultivating customers’ trust in B to C e-commerce businesses through publicising well-organised privacy policies on their websites is critical because of the necessity of the collection, storage and use of personal information for such businesses and their limited opportunities for face-to-face interaction with customers. Simultaneously, if online privacy policies provide individual customers with enough information to correctly evaluate the trustworthiness of B to C e-commerce sites, individuals can enjoy online shopping without any privacy concerns.

On the other hand, however, there have been some studies of online privacy policies which point out interesting contradictions concerning the effectiveness of these policies. For instance, Pollach^[3] suggests that online privacy policies have been drafted with the threat of privacy litigation in mind, rather than as a commitment to the appropriate handling of personal information or to the cultivation of customers’ trust. In addition, whereas information and communication technology (ICT) is global in nature, awareness of the importance of protecting personal information and the right to information privacy is inevitably affected by socio-cultural circumstances. Very few studies have attempted to analyse the effectiveness of online privacy policies while taking into account local socio-cultural factors.

Faced with this lack of research, McRobb et al^[4] launched a project to explore the cross-cultural factors in privacy online and provided an overall framework for the research project in March 2007. As part of the project, and also as exploratory research to describe the Japanese circumstances surrounding online privacy, questionnaire surveys and follow-up interviews were conducted in April 2008 at Meiji and Ehime Universities and in May 2011 at Meiji, Ehime and Matsuyama Universities in Japan. The research methodology was adopted because there was no reliable quantitative data or qualitative analysis of Japanese attitudes towards online privacy. Based on the survey results, this paper attempts to examine how young people in Japan recognise information privacy and what attitudes they hold towards it as customers of online shopping or B to C e-commerce sites. Through the examination, this study sets out to provide useful suggestions for:

(a) businesses developing appropriate personal information and privacy protection policies and schemes; and

(b) governments making and implementing related policies including –

(i) the enforcement of legal regulations effective for successful B to C e-commerce and personal information and privacy protection; and

(ii) the development of proper educational programmes to learn about personal information and privacy protection in the Japanese socio-cultural environment.

1 Overview of the Surveys

1.1 The 2008 Surveys

A survey was conducted in April 2008 to investigate the behaviour of Japanese youths with respect to online privacy. Respondents to the survey were third- and fourth-year students at the School of Commerce of Meiji University in Tokyo, the capital city of Japan, and at the Faculty of Law and Letters of Ehime University in the traditional local city of Matsuyama. Of the 431 survey responses (235 at Meiji University and 196 at Ehime University), 416 were valid (234 and 182, respectively).

There are several reasons why university students were selected as respondents to this survey. One of the most important reasons was their background knowledge of technology. In Japan, 1995 was called the ‘First Year of the Internet’ — which was when personal computers with Microsoft Windows 95 and Internet Explorer were first marketed in the country and the concentrated development of the broadband network began. Since that time, the use of computers has increased, and regular Internet connectivity at a fixed low access fee has become common. It was expected that third- and fourth-year university students aged 19-24 years would have a level of Internet experience much greater than that of their parents’ generation. Another reason is that young Japanese people were reputed to be no less sensitive to privacy issues than older people were.^[5]

In addition, the two universities from which the survey respondents were chosen have maintained above-average levels of research and teaching compared to other Japanese universities, and it was expected that the respondents would be better able to understand the survey contents. Moreover, because this survey was used as part of the coursework at each university, the students could be expected to take it seriously, and the response validity would be better than a Web-based questionnaire to which anyone could respond. The valid response rate of 96.5 per cent was very high.

The survey questionnaire, which was the very first survey for the authors’ study of online privacy and culture, was developed carefully to examine the recognition and knowledge of online privacy. The title of the questionnaire was ‘Online Shopping Survey’, and there was an explicit statement at the start of the questionnaire that ‘the aim of this survey is to analyse the relationship between online shopping behaviour and local culture’. The complete questionnaire is provided in Appendix 1.

The personal attributes of the survey respondents are shown in Table 1. The tendencies of and relationships between responses to the questionnaire were examined through statistical tests including Pearson’s chi-square test and Fisher’s exact test. However, these tests gave results that seemed irrational or counterintuitive, as described in detail below. For example, more than half of the respondents who acknowledged the importance of online privacy policies when they purchased something online did not actually read the policies frequently and were not sure if B to C e-commerce companies complied with their own online privacy policies. Even though more than 70 per cent of the respondents answered that they did not know what the right to privacy was, almost all the respondents believed that the protection of the right to privacy was ‘very important’ or ‘important’, and the respondents’ evaluation of the importance of protecting the right to privacy was independent of their understanding of the concept. Hence, two additional interview surveys were conducted, with 16 students the first time and 15 students the second time, to investigate why they provided such contradictory responses. The interesting results of the initial survey, which remained to be fully elucidated, reminded the authors of the necessity and importance of conducting follow-up research.

Table 1: Respondents’ attributes in the 2008 survey (number of respondents (%))

1.2 The 2011 Surveys

To conduct an in-depth examination of Japanese youths’ social attitudes towards privacy, a revised questionnaire was developed in May 2011 following a pilot study which was undertaken in April 2011. Based on the outcomes of the 2008 survey, the 2011 questionnaire was simplified by eliminating those questions which were found not to have a statistically significant influence on the respondents’ attitudes towards online privacy. However, several new questions were added to investigate young peoples’ beliefs about their online security. The complete questionnaire is provided in Appendix 2. In May 2011, a web-based survey using the revised questionnaire was conducted among students at Meiji, Ehime and Matsuyama Universities and 427 valid responses out of a total 444 responses were collected; the valid response rate was 96.4%. The survey was onymous so that follow-up interviews could be conducted. Table 2 shows the attributes of the survey respondents.

Table 2: Respondents’ attributes in the 2011 survey (number of respondents (%))

2 Survey Results and Discussion

2.1 Results of the 2008 Surveys and Discussion

The results of the surveys conducted in 2008 provided some interesting findings. First, it was statistically significant that those respondents who accepted the importance of online privacy policies for their online shopping tended to read the policies more than those who did not. However, more than half of the respondents who acknowledged the importance of the policies did not actually read them very frequently (99 out of 187 respondents, see Table 3) and were not sure if online shopping companies complied with their own online privacy policies (115 out of 180 respondents, see Table 4).

Table 3: Important, but Unread Privacy Policies (number of respondents)

Table 4: Unsure Compliance with Privacy Policies (number of respondents)

These results can be interpreted literally as; ‘although an online privacy policy is important for my online shopping, I don’t need to read it and I’m not sure if it has efficacy for the protection of my personal information and privacy’. The follow-up interviews were conducted to ask the 31 respondents who provided the contradictory responses why they didn’t read privacy policies when they shopped online, and whether or not it was a problem for them that they were not sure if online businesses complied with their own privacy policies. Several of the interviewees said that almost no online privacy policies were designed to facilitate consumers’ understanding of them and thus they were not easy to understand. In addition, these interviewees related that many of the policies were similar and therefore they were not particularly motivated to read and/or understand the policies. One of the interviewees answered that while privacy policies posted online were better than none at all, he gave more weight to the overall reputation and/or name of a company when purchasing something online. Another interviewee stated that it was the presence, rather than the contents, of online privacy policies that was important. He believed that the existence of online privacy policies would allow him to file a damage suit against companies when they failed to abide by their privacy policy and misused his personal information and, as a result, he suffered an invasion of privacy.

These results and answers may imply that an online privacy policy is just a kind of a ‘hygiene factor’^[6] from the point of view of an individual consumer. In other words, posting online privacy policies may not serve as an active motivator for promoting online shopping, whereas the absence of them would make online consumer satisfaction lower. Meanwhile, it seems plausible that online privacy policies are recognised as ‘Tatemae’ (something that is described for the sake of courteousness or respectability, or a ‘beautiful fiction’), by both Japanese consumers and companies that post privacy policies on their websites. Japan has a linguistic tradition of never writing or speaking of something that is very important.^[7] Therefore, written documents, such as contractual agreements, are often, in practice, considered to be ineffective.^[8]

Secondly, 72.6 per cent of the respondents (207 out of 285) answered that they did not know what the right to privacy was. Nevertheless, almost all the respondents (268 out of 270), except 16 whose answers to Q15 were ‘I don’t know (about the importance of privacy protection)’, believed that the protection of the right to privacy was ‘very important’ or ‘important’. As shown in Table 5, the respondents’ evaluation of the importance of protecting the right to privacy was independent of their understanding of the concept of the right.

Table 5: Incomprehensible, but Important Privacy Rights (number of respondents)

Why did many respondents accept the importance of protecting the right to privacy even though they didn’t know what it was? Many of the interviewees explained that they had heard the words ‘the right to privacy’ and/or ‘privacy’ and the importance of protecting that right in, say, TV news and newspaper reports, which gave warnings about misuse of personal information and invasions of privacy. In fact, the enforcement of the Act on Protection of Personal Information^[9] (‘APPI’), the first law enacted (in April 2005) for the protection of personal information held by both public and private sector entities in Japan, had set the stage for increasing mass media reports of personal information leakage and misuse. Several interviewees recognised that privacy was related to personal information and explained that ‘I don't know what the right to privacy is’ meant they were not sure if they completely understood the right. Their perception of the importance of protecting the right was based on the fear of personal information disclosure and subsequent problems such as stalking and identity theft that had been repeatedly reported by the mass media. It can be concluded that their awareness of the importance of protecting the right to privacy had been developed by hearsay.

Moreover, when asked ‘Have you ever studied the right to privacy?’, all of the interviewees answered ‘no’. Additionally, many of them considered that their rights, including the right to privacy, were to be preserved by relevant authorities and that they did not need to claim responsibility for the protection of their rights. This reflected a tendency of Japanese people toward having little awareness of the necessity for taking responsibility for the protection of their human rights and their dependence on the relevant authorities for such protection; this tendency is referred to as ‘Okami Ishiki’^[10] (a sense of total dependence on governments and/or bureaucrats for important and difficult issues) or ‘Amae’^[11] (a sense of assuming others’ goodwill or generosity). The assertion that an online privacy policy is just a ‘hygiene factor’ seems reasonable in light of these observations.

Third, although almost all of the respondents were aware of the importance of privacy protection, they seemed not to have sufficient knowledge to protect their privacy online. For example, 63.0 per cent of the respondents (155 out of 246) did not understand the concept of ‘opting out’. Cookies, which can be a technological threat to online privacy, were understood by only 19.8 per cent (56 out of 283). In contrast, more than half of the respondents had a certain level of knowledge of a Secure Sockets Layer padlock icon (56.4 per cent; 162 out of 287) and phishing (55.4 per cent; 158 out of 285).

Privacy and security seals were not well recognised by the respondents. The authors had expected a significant number of the respondents to know the PrivacyMark seal which is a privacy seal authorised by the Japan Information Processing Development Corporation, an affiliated organisation of the Ministry of Economy, Trade and Industry. The Next Generation Electronic Commerce Promotion Council of Japan^[12] strongly recommended that Japanese B to C e-commerce companies display the seal on the front page of their websites to gain consumers’ trust, and accordingly it was displayed on many Japanese online shopping sites. However, just 1.9 per cent of the respondents (5 out of 267) were aware of the seal, 15.4 per cent (41 out of 267) had seen it, but didn’t know what it represented, and 82.8 per cent (221 out of 267) didn’t know of it at all. Other seals, such as those of TRUSTe, thawte, and BBB online, were known to few respondents. On the other hand, 37.6 per cent of the respondents (100 out of 266) had at least seen the VeriSign seal (Table 6).

Q21: Do you recognise the following seals?
	Q12-1	Q12-2	Q12-3	Q12-4	Q12-5
1. Yes, I know what this seal represents	5 (1.9%)	0 (0.0%)	1 (0.4%)	1 (0.4%)	3 (1.1%)
2. I have seen this seal, but I don’t know what it represents	41 (15.4%)	12 (4.5%)	21 (8.0%)	30 (11.2%)	97 (36.5%)
3. I don’t know this seal at all	221 (82.8%)	255 (95.5%)	241 (91.6%)	236 (88.4%)	116 (62.4%)

Table 6: Awareness of Privacy and Security Seals (number of respondents, (%))

2.2 Results of the 2011 Surveys and Discussion

The most notable differences between the results of the surveys conducted in 2008 and in 2011 were that (a) the proportion of those respondents who acknowledged the importance of online privacy policies for their online shopping behaviour significantly increased from 74.2 per cent (187 out of 252) in 2008 to 96.8 per cent (303 out of 313) in 2011, and (b) the proportion of those who knew about the idea of the right to privacy also increased from 27.4 per cent (78 out of 285) in 2008 to 41.4 per cent (176 out of 425) in 2011 — although more than half of the respondents still didn’t know about the concept. This may be due to the fact that ICT education in high schools in Japan began in 2003, with a focus on the social impacts of ICT.

On the other hand, however, more than half of the respondents to the survey in 2011 who acknowledged the importance of the online privacy policies seldom read or had not read a privacy policy (180 out of 294), showing the same tendency as the respondents to the survey in 2008 (Table 7). Similarly, more than half of those respondents who considered it important to protect the right to privacy seldom read or had not read privacy policies (190 out of 305; Table 8), although the responses to Q4 and Q11 were so biased that chi-squared tests could not be applied to this data. It was again observed that the respondents’ evaluation of the importance of protecting the right to privacy was independent of their understanding of the concept of the right (Table 9). In addition, just 16.5 per cent of the respondents (70 out of 425) recognised the PrivacyMark seal.

Table 7: Important, but Unread Privacy Policies (number of respondents)

Table 8: Important Privacy Protection, but Unread Privacy Policies (number of respondents)

Table 9: Incomprehensible, but Important Privacy Rights (number of respondents)

The semi-structured interviews with the 10 students (9 from Meiji and 1 from Ehime University), who acknowledged the importance of privacy policies and privacy protection and seldom or had not read privacy policies, were conducted in July and August 2011. The objective of these interviews was to analyse the reasons behind their seemingly contradictory responses. Many of them related that the privacy policies were too long to read, and were just ‘Tatemae’ and thus not worth reading. While several of the interviewees pointed out that they didn’t need to read privacy policies because they had no way of knowing if companies complied with their privacy policies, others showed their confidence in companies’ personal information handling stating that it was unsurprising that private companies abided by their commitments. Two of the interviewees insisted that while no one understood exactly what was meant by the ‘right to privacy’, everyone knew the importance of protecting it; therefore, the relevant authorities and laws should protect privacy, even though no one understood and had no intention of trying to understand the notion.

How, then, do young people in Japan decide which online shopping site is safe for them to provide their personal information to? Indeed, 78.1 per cent of the respondents (242 out of 310) considered that many online shopping companies complied with their online privacy policies and 10.3 per cent (32 out of 310) believed every company did. Simultaneously, however, nearly half of the respondents (147 out of 312) had at least sometimes worried about whether online shopping companies abided by their online privacy policies.

Tentative answers to the question posed above were obtained through examining responses to Q15 and Q16 of the questionnaire survey in 2011. These two questions required respondents to describe everything they could about the characteristics of websites that made them feel either wary or safe when asked to provide their personal information to the sites. The outcomes of the examination demonstrated that a major source of trustworthiness of B to C e-commerce sites among individual consumers in terms of personal information use and protection was name recognition of the site or of the operators of the site, rather than privacy policies posted on their websites. Out of 427 respondents, 127 (29.7 per cent) indicated that they did not want to provide their personal information to websites which had a low profile or were operated by low-profile companies, whereas 42 (9.8 per cent) pointed out they hesitated to provide their details to websites which failed to show well-organised privacy policies and personal information protection schemes. However, 242 (56.7 per cent) felt safe to provide high-profile and high-traffic websites with their personal information, while 52 (12.2 per cent) considered it was safe for them to provide their personal information to websites on which well-organised privacy policies and personal information protection schemes were displayed. These outcomes are consistent with the results of a study undertaken by the Japan Productivity Centre in February 2011, which found that 42.0 per cent of respondents evaluated the trustworthiness of websites, in terms of personal information handling, based on name recognition of their operators.^[13]

On the other hand, the respondents tended to estimate that the public had a higher probability of suffering some kind of damage by misuse of their personal information in the current Internet environment (Q17; mean value = 42.6 per cent) than the probability of the respondents’ own chances of suffering the same fate (Q18; mean value = 34.2 per cent), and the difference between these two mean values was statistically significant (t(425) = 10.356, p < .01). This indicates that the respondents had unfounded confidence in their own online security. It was also demonstrated that those respondents who believed that online shopping companies complied with their privacy policies tended to estimate that the public had a lower probability of suffering some kind of damage through the misuse of their personal information in the current Internet environment (Q17; t(307) = -3.517, p < .01). These respondents also believed this to be true for themselves (Q18; t(308) = -3.707, p < .01) and attributed less responsibility to online shopping companies for damage caused by the misuse of their personal information (Q19; t(308) = -2.058, p < .05) than those who didn’t believe that such companies complied with their own privacy policies.

3 Implications for Online Businesses and Policy Makers

The Japanese B to C e-commerce market amounted to approximately 8.5 trillion yen in the FY 2011.^[14] Online shopping has already taken root in Japanese society, and the increase in online transactions is expected to continue. This means that secure personal information handling, as well as the implementation of appropriate privacy protection policies in the Japanese e-business industry, has become an urgent issue. However, the indifference of Japanese consumers to online privacy protection and the lack of knowledge concerning personal information and privacy protection are obstacles to the successful development of Japanese online businesses, including free-of-charge services, and the information society in Japan.

The results of the surveys conducted in 2011 demonstrated that when judging whether an online shopping site and/or its operator was trustworthy in terms of personal information handling and protection, the decisive factor for Japanese respondents was neither privacy policies nor privacy seals posted on its website, despite the frequent response that these were key factors for cultivating consumers’ trust in online businesses. Instead, name recognition and reputation of websites and/or website operators were critical. This may suggest that Japanese Internet users’ determination of which websites they visit in order to shop online is made based on the reputation of sites and thus they don’t feel the necessity to read online privacy policies and check privacy and/or security seals. The tendency of Japanese people to regard written documents as ‘Tatemae’ (a ‘beautiful fiction’) combined with their low sense of entitlement can strengthen their belief that they don’t need to read online privacy policies, and, further, ‘word-of-mouse’ sites, weblogs and social networking sites may function as important sources of such reputation.

Acquiring the PrivacyMark seal has become an effective measure for business-to-business (B to B) e-commerce companies to do business with other organisations in Japan, where APPI regulates the collection, use, and sharing of personal information in organisations. Business and governmental organisations that wish to outsource personal information handling tend to require that their outsourcees obtain the PrivacyMark seal. On the other hand, however, if a B to C company’s efforts to protect the privacy of its clients is not appreciated by those clients due to their indifference, then the company may consider such efforts to be costly and unnecessary and may be discouraged from continuing or extending its efforts in this regard. That would certainly be reasonable, given the results of this study. If the situation remains as it is, the Japanese B to C e-commerce market may become similar to Akerlof’s^[15] ‘market for lemons’ in terms of fair personal information handling. Here, the asymmetry in information with respect to B to C e-commerce company behaviour would be caused and/or increased by the indifference of individual consumers to companies’ efforts to protect privacy and handle personal information responsibly. To avoid such outcomes, B to C e-commerce companies should disclose their online privacy policies and privacy protection schemes presuming that individual consumers don’t read written privacy policies and don’t have sufficient knowledge about technology and systems with respect to personal information and privacy protection. Companies which operate high-profile and high-traffic B to C e-commerce sites should take the lead in engaging such disclosure as their social responsibility. Setting up legal regulations to force or encourage B to C businesses to do this may be necessary.

Simultaneously, accurate information about the right to privacy and the importance of protecting it, as well as information about technology and systems related to privacy protection, should be widely shared in Japan in order to prevent asymmetries concerning such information. The disclosure of company information including track records of personal information handling is another effective means of prevention. ‘Word-of-mouse’ websites or social networking sites would allow consumers to share information on which companies are dependable.

Developing and providing well-organised school educational programmes to teach the importance of the right to privacy, proper awareness of one’s rights and basic knowledge about online privacy protection technology and systems are also important. Given the fact that in Japan, on average, access to the Internet using mobile/smart phones begins when students are in their first year of junior high school (12-13-year olds), educational programmes should be developed for primary and secondary school students. At higher education levels, students may have to be encouraged to read privacy policies as privacy invasion policies; ie as declarations of ways that a company may invade — rather than protect — their customers’ privacy, to engage their interest in online privacy protection in a well-designed active learning system. The indifference of young people in Japan to online privacy protection, which was the most significant finding of the surveys, is a problem that should be dealt with immediately.

Conclusions

This study was conducted to explore the attitude of young people in Japan towards online privacy as customers of online shopping sites in the Japanese socio-cultural context. Although it is claimed that Japanese people have recently become sensitive to the importance of protecting personal information and privacy, the survey results demonstrated that this was not necessarily the case. The survey outcomes also demonstrated the seemingly contradictory, but interesting attitude of young people in Japan towards online privacy as follows:

(a) Although an online privacy policy was important for their online shopping, they did not actually read it very frequently.

(b) They were not sure if a B to C e-commerce company abided by its online privacy policy, and vaguely felt that many online shopping companies complied with their online privacy policies.

(c) Even though they didn’t understand the notion of the right to privacy, they accepted the importance of protecting it.

(d) Although they were aware of the importance of privacy protection, they did not have sufficient knowledge to protect their privacy online.

(e) They have unfounded confidence in their online security, estimating that the public had a higher probability of suffering some kind of damage due to the misuse of personal information than they estimated the probability of their own risk of suffering similar damage.

The discussion of the survey results led to suggestions for developing effective measures to protect personal information and the right to privacy in the Japanese socio-cultural environment. In particular, the indifference of Japanese youths to online privacy protection was recognised as an urgent issue that must be addressed by the national government.

The authors suggest that similar behavioural tendencies of individual consumers can be observed in other socio-cultural environments. Considering the global nature of ICT and e-commerce, cross-cultural studies using the same questionnaire would be useful for promoting the development of personal information and privacy protection schemes, which should be locally effective and globally acceptable.

Acknowledgement

This study was supported by the MEXT (Ministry of Education, Culture, Sports, Science and Technology, Japan) Programme for Strategic Research Bases at Private Universities (2012-16) project “Organisational Information Ethics” S1291006, the MEXT Grant-in-Aid for Scientific Research (B) 25285124, and the MEXT Research Grant-in-Aid for Young Scientists (B) 24730320.

Appendix 1: Questionnaire in 2008

Online Shopping Survey

This questionnaire investigates the characteristics of the online shopping behaviour of young people as part of an international comparative study. Many people enjoy online shopping using personal computers and/or mobile phones. A variety of services are provided online, including booking train/bus/airplane tickets, booking theatre tickets, and buying books and food. The aim of this survey is to analyse the relationship between online shopping behaviour and local culture. Responding to this questionnaire will not result in the specific identification of any individual, and the results of the survey will not be used for any purposes other than those described here.

Cover sheet	Age group, gender
Questions
Q1: Have you ever accessed the Internet?	1.Yes 2. No à End of the questionnaire
Q2: How long have you used the Internet?	1. Less than one year 2. 1-5 years 3. 6-10 years 4. More than 10 years
Q3: What device do you mainly use to access the Internet, a personal computer or a mobile phone?	1. Personal computer 2. Mobile phone
Q4: Have you ever purchased anything from online shopping sites?	1.Yes 2. No à Q4-1 à End of the questionnaire
Q4-1: If ‘no’, why haven't you purchased anything online?	1. It is technologically difficult for me to shop online. 2. I don't understand shopping online. 3. There is nothing I want to purchase online. 4. I don’t like to take risks with online payment and/or receipt of goods. 5. I don’t like to take risks with unauthorised access to and misuse of my personal data. 6. Other à Please specify:
Q5: What device do you mainly use to do online shopping, a personal computer or a mobile phone?	1. Personal computer 2. Mobile phone
Q6: How often do you purchase something online, on average?	1. Every day 2. Three times per week 3. Once per week 4. Twice per month 5. Once per month 6. Once every three months 7. Ones per half year 8. Once per year 9. Other à Please specify:
Q7: Please provide the average price range of goods that you purchase online.	1. Less than JPY 10,000 2. JPY 10,000–20,000 3. More than JPY 20,000
Q8: Do you know that almost every online shopping site posts its online privacy policy?	1. Yes 2. No à Skip to Q14
Q9: Is a privacy policy an important element for your online shopping?	1. Yes 2. No
Q10: Do you read a privacy policy when you purchase something online?	1. Always 2. Almost always 3. Sometimes 4. Almost never 5. Never
Q11: Are the privacy policies easy to understand?	1. All of them 2. Almost all of them 3. Some of them 4. A few of them 5. None of them 6. I have not read any privacy policy 7. I don’t know
Q12: Do you believe that companies comply with their privacy policies?	1. All of them 2. Some of them 3. None of them 4. I don’t know
Q13: When the opportunity of opting out is provided in a privacy policy, do you require not providing your personal information to third-party organisations?	1. Always 2. Sometimes 3. Never 4. I don’t know
Q14: Do you know what the right to privacy is?	1. Yes, I know à Q14-1: Please specify: 2. No, I don't know
Q15: Is the protection of the right to privacy important?	1. Very important 2. Important 3. Not so important 4. Not important 5. I don’t know
Q15-1: Why do you think so?	Please specify:
Q16: Have you ever felt that online shopping sites require compulsory input of too much personal information?	1. Yes 2. No
Q61-1: If ‘yes’, what did you do?	1. Provided information 2. Provided false information 3. Went elsewhere 4. Cancelled the shopping
Q17: Have you ever felt that online shopping sites require optional input of too much personal information?	1. Yes 2. No
Q17-1: If ‘yes’, what did you do?	1. Provided information 2. Provided false information 3. Left it blank 4. Went elsewhere 5. Cancelled the shopping
Q18: Do you understand about cookies?	1. Yes 2. No
Q18-1: If ‘yes’, have you ever changed the default settings of the browser for handling cookies?	1. Yes 2. No
Q19: Do you understand the meaning of the padlock icon often shown on your browser when you visit online shopping sites?	1. Yes 2. No
Q20: Do you understand what phishing is?	1. Yes 2. No
Q21: Do you recognise the following seals? If ‘yes’, what do they represent? Q21-1: Q21-2: Q21-3: Q21-4: Q21-5:	1. Yes, I know what this seal represents à Please describe what it represents: 2. I have seen this seal, but I don’t know what it represents 3. I don’t know this seal at all

Appendix 2: Questionnaire in 2011

Online Shopping Survey

This questionnaire investigates the characteristics of the online shopping behaviour of young people as part of an international comparative study. Many people enjoy online shopping using personal computers and/or mobile phones. A variety of services are provided online, including booking train/bus/airplane tickets, booking theatre tickets, and buying books and food. The aim of this survey is to analyse the relationship between online shopping behaviour and local culture. Responding to this questionnaire will not result in the specific identification of any individual, and the results of the survey will not be used for any purposes other than those described here.

^[*] Centre for Business Information Ethics, School of Commerce, Meiji University, Tokyo, Japan.

^[1] S Doherty, ‘Keeping Data Private’ (25 March 2013)

<http://www.networkcomputing.com/1213/1213ws1.html> .

^[2] The Next Generation Electronic Commerce Promotion Council of Japan, Survey on Privacy Policy and Other Similar Statements on Websites (2008)

<http://www.jipdec.or.jp/archives/ecom/report/guideline_20080826.pdf> (in Japanese).

^[3] I Pollach, ‘What's Wrong with Online Privacy Policies?’ 2007 50(9) Communications of the ACM 103.

^[4] S McRobb, Y Orito, K Murata and A A Adams, ‘Towards an Exploration of Cross-Cultural Factors in Privacy Online’ (Paper presented at The Ninth ETHICOMP International Conference on the Social and Ethical Impacts of Information and Communication Technology, Meiji University Tokyo Japan, 27-29 March 2007) 380.

^[5] Cabinet Office, A Survey on Personal Data Protection

(2006)<www8.cao.go.jp/survey/h18/h18-hogo/index.html> (in Japanese).

^[6] F Herzberg, Work and the Nature of Man (Crosby Lockwood Staples, 1974). In his study on job satisfaction, Herzberg proposed the ‘two factor theory’; that there are ‘motivators’ in the workplace which enhance job satisfaction whereas there are another set of ‘hygiene factors’ which don’t motivate workers, but cause dissatisfaction if they are not in the workplace.

^[7] H Kindaichi, Japanese Linguistic Expression (Kodansha, 1975 (in Japanese)).

^[8] T Uchida, The Age of Contracts: The Japanese Society and Contract Law (Iwanami Shoten, 2000 (in Japanese)).

^[9] Act No 57 of 2003.

^[10] T Kawashima, Japanese Legal Consciousness (Iwanami Shoten, 1967 (in Japanese)).

^[11] T Doi, The Anatomy of Dependence (Kodansha International, 1978).

^[12] Ibid 2.

^[13] The Japan Productivity Centre, The Questionnaire Survey on Information Distribution and Use in the Internet Society (2011) <http://activity.jpc-

net.jp/detail/isd/activity001031/attached.pdf> (in Japanese).

^[14] Ministry of Economy, Trade and Industry, The Infrastructure Development for Information Economy Society: A Market Survey of Electronic Commerce (2012) <http://www.meti.go.jp/policy/it_policy/statistics/outlook/bessi3H23EChoukokusho.pdf> (in Japanese).

^[15] G A Akerlof, ‘The Market for “Lemons”: Quality Uncertainty and the Market Mechanism’ (1970) 84(3) Quarterly Journal of Economics 488.