Times Car Explains Why It Retained Former Members Data for Seven Years After Data Breach

In the wake of a data breach exposing approximately 6.6 million accounts, Park24 has confirmed that it retained driver’s license images of former “Times Car” members for seven years after their withdrawal. The company cited the Corporate Tax Act’s transaction record preservation rules for personal data, though admitting those tax laws provide no legal basis for keeping driver’s license images.

The Bottom Line

• The Exposure: Approximately 6.6 million accounts were compromised in the Times Car data breach, encompassing both active and withdrawn users as well as incomplete registration applicants.
• The Statutory Justification: Park24 defended retaining basic data (name, address, date of birth) for seven years by pointing to Article 126 of the Japanese Corporate Tax Act.
• The Compliance Gap: The company acknowledged that the Corporate Tax Act contains no legal provisions mandating the retention of driver’s license images or uncompleted signup files, which were instead stored for “identity verification and inquiry handling.”

Corporate Tax Compliance and the Seven-Year Retention Rule

When the security architecture of the Times Car platform failed, it exposed far more than active subscriber files. According to disclosures reported by ITmedia and written about by Yuka Okada, the breach caught files belonging to users who had already terminated their membership. For these former accounts, Park24 maintained records under the banner of statutory compliance.

Under Article 126 of the Corporate Tax Act and its accompanying enforcement regulations, corporations utilizing blue-form tax returns must maintain accounting books and transactional documents for a standard period of seven years. Park24 interpreted this statute to justify keeping basic member identifiers—specifically names, addresses, and dates of birth—locked in digital archives long after the contractual relationship ended.

Photo: ccnn.co

But the company maintained a different policy regarding identity documents. When pressed by reporters on the legal basis for keeping scanned driver’s licenses for the exact same seven-year duration, the company conceded that the Corporate Tax Act offers no such mandate. Instead, the company justified storing these identity verification images as a proactive measure for “identity-theft countermeasures and inquiry responses.”

The Extended Exposure of Incomplete Applications

The security failure reached beyond former customers into the pipeline of prospective users. Individuals who initiated the application process for Times Car but never finalized their membership also found their personal data exposed in the incident.

Because these applicants never completed a transaction with the car-sharing provider, no commercial exchange took place. Consequently, the Corporate Tax Act’s transaction record preservation rules do not apply to them. Park24 confirmed that the retention of these non-customer files relied entirely on internal operational policies designed to guard against fraudulent signups and field customer service inquiries.

Data Category	Exposed Volume / Status	Stated Retention Rationale	Legal Basis
Active & Former Members (Basic Info)	Part of ~6.6 million accounts	Transaction record keeping	Corporate Tax Act Article 126 (7-year rule)
Former Members (License Images)	Part of ~6.6 million accounts	Anti-fraud and customer inquiries	None (Internal policy)
Incomplete Applicants	Unspecified subset	Anti-fraud and customer inquiries	None (Internal policy)

Customer Compensation and Operational Fallout

When asked whether Park24 would issue compensation to users whose driver’s license images and identification records were leaked, company representatives stated only that if new facts or requirements emerge, they will notify affected individuals directly or publish updates via the official corporate website.