The Personal Information Protection Commission resolved to issue a 'recommendation for improvement' to operator Woowa Brothers regarding the 'Baemin revenge terror incident.' This decision was based on the judgment that it is difficult to find that Woowa Brothers violated the Personal Information Protection Act, including its obligation to take safety measures.
According to the Personal Information Protection Commission on the 1st, at a plenary meeting held on the 9th, the commission resolved to issue a recommendation for improvement to Woowa Brothers regarding the 'Baemin revenge terror incident' and recently delivered the content of the disposition. The Personal Information Protection Commission determined that the personal information of one Baemin user was leaked to a third-party private revenge agency organization, and that there were circumstances indicating that the personal information of 467 users had been accessed without authorization.
The 'Baemin revenge terror incident' refers to a case in which a revenge agency organization placed an employee at an outsourced partner company of Baemin's customer service center under the guise of being a consultant, where they accessed and leaked customer information such as names and addresses without authorization. Using the secured information, the perpetrators committed acts of revenge terror, including smearing feces and other filth on the victims' front doors and writing abusive language with spray paint.
The Personal Information Protection Commission recommended measures to prevent recurrence, such as conducting thorough inspections of access logs regarding incidents caused by unauthorized access to customer information by personal information processors unrelated to user requests; implementing regular training for personal information handlers, including subcontractors, to ensure the safe handling and management/oversight of personal information; and submitting a report on the implementation results within 90 days from the date of receiving notification of the improvement measures taken in accordance with the recommendation.
In addition to recommendations for improvement, the Personal Information Protection Commission can impose sanctions such as recommendations for correction, orders for corrective action, imposition of administrative fines or surcharges, and recommendations for prosecution or disciplinary action. A recommendation for improvement is a lower-level sanction among these options. It appears that the finding of no actual legal violation was reflected in the decision-making process.
Woowa Brothers stated its position that it will strengthen the personal information protection system of its subcontractors and make efforts to prevent recurrence.
in TECH
