Five disciplines for using a subscriber's records

Our newer set-top boxes can report which channel was on and for how long. That record reveals habits and working hours, and programme choices can hint at beliefs, so I treat it more carefully than a billing record. For our own service uses, such as diagnosing a channel that keeps dropping, our terms describe the purpose plainly. For any use by an outside party, we ask separately, on screen and by post, in large type, with a menu option to withdraw at any time. I test the wording with subscribers in community halls before it goes out, because a notice that lawyers approve can still confuse an eighty-year-old account holder. The consent sits in the billing system beside the contract, so a withdrawal reaches every downstream use within one working day.

We sell advertising on our community channel and, increasingly, spots delivered only to consenting households' set-top boxes. Local advertisers want to know who saw them. I report reach from consented boxes only, with at least fifty households behind any published figure, and I state what share of our subscriber base the consented pool represents. We do not add those counts to broadcast ratings or to catch-up plays as if they were one audience; each appears with its own definition. When a supermarket chain asked us to match exposure to its loyalty-card purchases, we offered an aggregate comparison run by our own team, with no household-level records leaving either company. The measurement is less precise than the advertiser hoped. It is also one we can defend to the households inside it.

A broadband subscriber who leaves after six slow evenings is not the same as one who leaves for a cheaper mobile-only plan, yet a single risk score treats them alike. Our model now separates households whose risk is driven by repeated faults from those whose risk is driven by price or contract timing. The first group goes to network operations for inspection; the second may receive a retention offer. I judge success by whether an action changed the outcome, not by whether the score ranked customers correctly. Field technicians and contact-centre supervisors review the model's main inputs each year, because they recognise a misleading signal faster than an analyst. I also check that older subscribers, who telephone us more often, are not scored as risky simply for asking for help.

We share some data with outside parties: the mobile network operator that carries our resold mobile service, an electricity retailer that sells a bundle with our broadband, the municipalities that ask for outage areas during storms, and advertising partners. Each arrangement began separately. I am replacing them with one register that records the purpose, the fields, the legal basis, how long the partner may keep the data and the date on which we must decide again. Municipal outage reports, for example, need street-level areas and times, not subscriber names. Where Japan's personal-information law requires records of data provided to another business, the register holds them. A partner that cannot explain why it needs a field does not receive it, even when providing it would be lawful.

We use AI to draft call summaries, to suggest answers for agents and to forecast contact-centre demand. Each use appears in a register with an owner, the data it touches, the decision a person still makes and the evidence we review every month. Japan's national guidelines for businesses using AI are voluntary, so the discipline has to come from inside the company. My rule is simple to state and harder to follow: a model may draft, rank or forecast, but a person decides anything that changes what a subscriber pays, receives or is told about a complaint. Vendor contracts must say whether our recordings may train the vendor's models; ours say they may not. When a model's errors cluster in one group of subscribers, that use pauses until we understand why.