Korean ministry rules elementary school principals are data protection officers

The government legislation ministry said Tuesday that an elementary school principal, not its administrative office chief, must serve as the school's personal information protection officer.

The ministry issued the interpretation in response to a question over who should be designated under Article 31(1) of the Personal Information Protection Act and Article 32(2)1(sa) of its enforcement decree, which assigns the role at each level of school to "the person who oversees the administrative affairs of the school."

The ministry reasoned that "oversee" means to take charge of all matters together with supervisory responsibility, not merely to handle administrative work. Under the Elementary and Secondary Education Act, the principal oversees school affairs and supervises staff, while administrative staff handle the school's administrative and other duties. Since school affairs include administrative work, the principal oversees the school's administration, while the administrative office chief handles that work under the principal's direction.

The ministry also pointed to the duties the law assigns to the protection officer, including handling complaints and remedying damages related to personal information processing, and said it would be unreasonable for an administrative office chief, who has no authority to supervise teachers, to manage the processing of teachers' personal information.

The education act requires schools and their heads to take the necessary measures so that teachers' personal information, including telephone numbers and resident registration numbers, is protected under privacy and information disclosure laws. In light of those provisions, the ministry concluded that the principal of the elementary school is the person who oversees its administrative affairs.