I’m not familiar with Japanese law, but frankly leaking information about a _single_ person should be cause for a breach notification everywhere. The fact that it isn’t is indicative of the fact that profit is placed over privacy so often.