Privacy watchdog tightens data protection assessments for public agencies

The Personal Information Protection Commission has decided to double the penalty points for personal data breach incidents and separately disclose the grades of institutional investors that have repeatedly received low evaluations, in order to enhance the effectiveness of its assessments on the level of personal information protection among public institutional investors.

On the 12th, the Personal Information Protection Commission announced that it is progressively strengthening the assessment methods and systems for the level of personal information protection among public institutional investors. The assessment of the level of personal information protection among public institutional investors is a statutory evaluation implemented since 2024 under the Personal Information Protection Act. It annually reviews the management systems of institutional investors, including compliance with legal obligations and the securing of dedicated personnel and budgets for personal information protection. Currently, there are approximately 1,450 institutional investors subject to the assessment.

The Personal Information Protection Commission explained that the protection level assessment is a preventive system designed to check whether an appropriate personal information protection management framework is in place, rather than a mechanism that directly predicts the likelihood of actual infringement incidents at individual institutional investors.

However, to reduce the gap between actual breach incidents and assessment results, penalties will be strengthened starting this year. First, the maximum penalty points applied when a personal data breach incident occurs will be increased from the existing 10 points to 20 points. An additional deduction of up to 5 points will also be applied if post-incident response is inadequate.

A new indicator for "efforts in accident prevention and response" will also be created. The results of mock hacking exercises and vulnerability checks will be directly reflected in the assessment, and "insider security" has been selected as a thematic indicator for focused review. The weighting for institutional leaders' preventive efforts toward personal information protection will also be expanded.

Management of institutional investors that have repeatedly received low evaluations will also be strengthened. The Personal Information Protection Commission is pushing to notify superior institutions and supervisory ministries of the assessment results for underperforming institutional investors. In cases of repeated issues, such as receiving a D-rating for three consecutive years or experiencing a grade decline every year over three years, the grades from the most recent three years will be separately disclosed when the results are announced.

Underperforming institutional investors will be required to submit corrective action plans, and their improvement efforts will be reflected in the following year's assessment. For institutional investors that receive underperforming ratings consecutively, improvement recommendations will be issued, and measures to publish the lists of such institutional investors are also being pursued. In addition, the Commission plans to simultaneously pursue support for expanding personnel and budgets for personal information protection in the public sector, as well as strengthening protection systems through professional Chief Privacy Officers (CPOs).

A source from the Personal Information Protection Commission stated, "The protection level assessment is a system that encourages institutional investors to independently review safety measures and improve their awareness of personal information protection during the preparation process for the evaluation," adding, "We will continue to improve the assessment methods so that they lead to a substantive enhancement in the level of personal information protection among public institutional investors."