Agencies should work on our data, not keep copies of it

Most of Kotonami's business is sold and renewed by agencies. About 15,200 outlets carry our products: car dealers and repair shops that arrange motor cover when a car is sold or mended, estate agents who arrange fire cover with a lease or a mortgage, and family agencies, often run by a couple or by the second generation, that have looked after the same households for decades. Many of them also represent one or two other insurers. That is how the Japanese market has long worked, and it works well for customers who want a single person to call.

It also means that details of our policyholders sit, legally and practically, in thousands of small offices we do not run. When the sector's handling of customer information at shared agencies came under the regulator's scrutiny in 2024, most insurers, ours included, had to answer a question they had been avoiding. Where, exactly, are copies of our policyholders' details, and who can see them?

How a spreadsheet became our renewal system

For many years our agency portal offered a button that exported an agency's customer list to a spreadsheet: policy numbers, renewal dates, addresses, telephone numbers and often vehicle details. The button existed because agencies asked for it. Our renewal screens were slow and showed one policy at a time, and an agency with 1,400 households to renew each year needed a list it could sort, annotate and share among its staff. By 2023 agencies were downloading about 41,000 such files a month.

Nobody designed what followed. A file downloaded to renew motor policies at a dealer was saved to a shared drive used by staff who also sold another insurer's products. A family agency printed its list and kept it in a desk drawer. Staff photographed proposal forms on personal smartphones and sent them to colleagues through messaging apps. None of this was malicious. It was what busy people did when the tool we had given them could not do the job. In practice the spreadsheet had become our renewal system, and we controlled none of it.

We decided in 2023 to switch the export off, and the decision took four months because the arguments against it were good. Our executive officer for agency sales pointed out that the largest dealer groups ran their own customer systems and would see the change as an insurer reaching into their business. Two of them told us plainly that they would move business to insurers that still allowed downloads. Smaller agencies feared losing the working lists on which their year depended.

A device policy is a distribution policy

We concluded that a prohibition without a replacement would fail, so the decision became a programme. We rebuilt the renewal worklist inside the portal, so that an agency could sort, filter, assign and annotate its renewals without taking the data away. We issued about 6,000 managed tablets to agencies above a certain size, paid for by Kotonami, with remote wiping and no policyholder files stored on the device. For the smallest agencies we offered a smartphone app in which documents and photographs stay inside a protected container and cannot be forwarded. The programme cost about ¥2.3 billion over two years.

What I learnt is that decisions about devices are decisions about distribution. The tablet changed how an agency's staff spent the day, which screens they opened in front of a customer and how a proposal was signed. Agencies judged us on whether the new way was quicker than the spreadsheet, not on whether it was safer, and where it was slower they found workarounds within weeks. So we measured the time taken to complete a renewal visit before and after the change, and we rebuilt the worklist three times in the first year because the first version lost to paper.

One large dealer group moved about ¥1.1 billion of annual premium to another insurer during the change. Given its own systems, I do not think it was wrong to do so, and I think we were right to accept the loss. A year later we began offering large agencies a controlled connection between our systems and theirs, under a contract that defines what data they may hold, for how long and with what audit rights. We should have offered that from the start, and I suspect the dealer group would have stayed.

What we owe the small agency

The family agencies concern me most, because they look after our oldest customers and have the least technical support. An agency of two people cannot run its own security programme, and it should not have to. If we want them to protect our policyholders' details, the protection has to be built into the tools we give them, and the training has to happen in their offices rather than in a video. Our agency-support staff visited about 2,800 small agencies during the change, often more than once. Many of the improvements to the worklist came from those visits, including a printed renewal summary that holds no personal details beyond a name and a policy number.

Since March 2025 no agency has been able to export a bulk policyholder list from our systems. Agency-related incidents recorded in our data register fell from 63 in 2023 to 11 in 2025, though part of that fall reflects how incidents are now classified. Renewal rates moved by less than half a percentage point, and the average renewal visit is now slightly shorter than it was with the spreadsheet.

The Act on the Protection of Personal Information makes an insurer answerable for supervising those who handle personal data on its behalf. Insurers often read that as a duty to write rules for agencies and audit them against those rules. I read it as a duty to make the safe way the easiest way. An agency forced to choose between serving a customer quickly and following our data rules will choose the customer, and in its place so would I. The insurer's task is to remove that choice, and to accept that doing so costs money, some premium and a great deal of patience.