Osaka University ELSI Center x Privacy Tech Launch Joint Research on 'VPIA Process' for Objective Evaluation of AI and Data Utilization Values and Risks

Privacy Tech (Headquarters: Shibuya-ku, Tokyo; CEO: Daisuke Yamashita), in collaboration with the Osaka University Center for Social Solutions and Innovation (hereinafter 'Osaka University ELSI Center'), will begin joint research on June 4, 2026, aimed at developing a social acceptability review system for AI and data utilization initiatives.

During the 2025 Osaka-Kansai Expo, a 'Value and Privacy Impact Assessment' (VPIA) process was employed for multiple initiatives linking vast amounts of visitor personal data. This process thoroughly examined the value for individuals and society (Value) and risks (Impact) beforehand, enabling multifaceted evaluation. As a result, it contributed to the success of the Expo while advancing sophisticated data utilization without triggering major privacy issues.

In this joint research, we aim to apply this Expo legacy to the promotion of AI and data utilization in society by verifying mechanisms to sustainably embed the VPIA process within companies.

1. Background of the Joint Research

As AI and personal data utilization in corporate activities rapidly advance, dealing with risks that trigger 'flame wars' or business suspensions due to unintended lack of consideration for user anxiety or uncomfortable feelings—despite being legally compliant—has become a practical challenge.

Last year, the 2025 Osaka-Kansai Expo featured the sub-theme 'Connecting Lives' and established 'Data Utilization Guidelines' as a common philosophy for promoting value co-creation centered on data. Based on the 'Five Principles of Data Utilization,' this guideline formulated the 'VPIA Process' to check the validity of data initiatives individually. For initiatives where participating Expo exhibitors requested it, the value (Value) and risk (Impact) to individuals and society were articulated, and evaluation was conducted by both the businesses and third parties from the perspective of ELSI, which includes Ethical, Legal, and Social aspects. Results were publicly released on the Expo's communication site.

Through this process, businesses were able to objectively recognize the validity of their data initiatives and implement appropriate measures. Furthermore, positive responses were received from general participants visiting the Expo.

We believe that by introducing this successful model as a risk confirmation process for current corporate AI and data utilization, we can objectively recognize social impacts and the validity of countermeasures, which are difficult to address through legal compliance alone.

Therefore, this joint research aims to further improve the VPIA process proven at the Expo, verify the requirements for implementing it as a mechanism for sustainable embedding within companies, and establish a 'standard for risk confirmation processes' in the era of AI and data utilization.

2. Overview of the VPIA Process (Conventional)

The conventional VPIA is a process for evaluating data and AI utilization initiatives in the following three stages:

- Step 1: Self-evaluation by the business (creation of a PIA report)
- Step 2: Evaluation by third parties
- Step 3: Disclosure of evaluation results (part of the PIA report and third-party evaluation results)

When businesses introduce this process, the selection of projects to conduct self-evaluation in Step 1 (deciding which projects to include or exclude) has become a challenge.

3. What we will work on in the joint research

In this joint research, we will address the following themes:

- Formulation of criteria for 'Step 0' and verification of the reproducibility (mechanization) of the four-stage process itself within companies.