Ward governments operating My Number card self-service kiosks must stop caching Wi-Fi MAC address logs beyond seven days, because elderly applicants who linger in municipal lobbies for card photos should not leave permanent device fingerprints in a database that was built for identity documents, not surveillance. Convenience is a public duty; indefinite MAC retention is not.
What kiosks collect without asking
Digital Agency guidance pushes kiosks into ward offices so residents can update My Number cards without booking counter time. Many installations pair the kiosk with guest Wi-Fi so phones can download confirmation PDFs. Access points routinely log probe requests and associated MAC addresses for troubleshooting—data that can be stable enough to track handsets across visits.
Several Tokyo wards disclosed in summer privacy policies that guest Wi-Fi logs are kept for 90 to 180 days for “security analysis.” InfoHandle reviewed ward PDFs; the language mirrors corporate hotel policies, not the minimization standard the Personal Information Protection Commission expects for municipal services.
Why seven days is enough
Seven days covers incident response: if someone reports kiosk tampering on Monday, IT can still correlate access-point entries through the following Sunday. Beyond that, MAC logs rarely help card issuance—they do help vendors sell analytics modules. Wards are not ISPs; they should not hoard handset identifiers because a contractor’s dashboard defaults to six-month retention.
APPI treats MAC addresses as personal information when they can be linked to individuals. Even without names, repeated visits to a My Number kiosk narrow the field to residents updating cards—a sensitive event.
Strongest objection
IT vendors will argue longer retention catches rogue staff photographing screens. Screen monitoring belongs on camera footage directed at the kiosk bezel, not on Wi-Fi probes from purses in the queue. If security needs more, wards should publish a DPIA and narrow collection to the kiosk VLAN, not the entire lobby SSID.
Another objection: seven-day rotation increases storage costs. Municipal Wi-Fi contracts already cost millions of yen; deleting rows is cheaper than defending a leak of MAC histories tied to My Number visits.
What we are not saying
We are not urging wards to remove guest Wi-Fi—connectivity helps applicants download forms. We are not claiming every ward misconfigured logging; some already purge weekly. We are not asking the Digital Agency to slow kiosk rollout.
Concrete steps
The Digital Agency should add a seven-day MAC retention ceiling to kiosk deployment checklists, with annual PPC spot checks. Ward councils should require contractors to certify automatic deletion in RFP scoring. Residents should ask ward privacy officers, in writing, how long lobby Wi-Fi retains probes before using kiosks for address changes.
My Number exists to simplify lawful identity services, not to grow passive tracking datasets in buildings voters fund. Seven days balances incident response with dignity; anything longer treats applicants as telemetry.
Kicker
When ward assemblies vote on Wi-Fi renewals this fall, the question is not bandwidth—it is whether MAC logs outlive the card transaction they were never meant to document. PPC guidance on minimization already exists; kiosks simply force the issue into lobbies where democracy is supposed to feel closest.
