Personal Information Protection Commission fines National Center over data leak

The Personal Information Protection Commission said Thursday it fined the National Center for Children's Rights and Welfare 885 million won for leaking personal data of more than 1.17 million missing children and adoptees through negligent management of storage devices.

The sanctions follow an investigation where external hard drives, USB sticks and CDs containing unencrypted resident registration numbers were lost during a digitization effort running from 2013 to 2022. The commission said the center failed to report the loss within the mandatory 72-hour window.

"The National Center for Children's Rights and Welfare neglected necessary physical safety measures required under the Personal Information Protection Act, such as designating managers and maintaining entry logs," the commission said in its decision.

In addition to the fine, the regulator issued corrective orders, recommended disciplinary action against responsible staff, and ordered the public disclosure of the violation. It also advised the Ministry of Health and Welfare to strengthen its overall supervision of the center's personal information management system.