Major domestic MVNO operators were found to have stored personal information such as resident registration numbers and credit card numbers without encryption, or to have retained unnecessary personal information for extended periods.
The Personal Information Protection Commission announced that it held a plenary session on the 11th and imposed a total of 60.9 million won in administrative fines and 110.4 million won in penalties on eight MVNO operators that violated the Personal Information Protection Act.
The targets are KT M Mobile, Media Log, S1, LG Hello Vision, SK Tellink, Unicomz, KB Kookmin Bank, and KT Skylife.
Investigation results showed that KT M Mobile and Unicomz collected resident registration numbers without legal basis while selling USIM products on their websites. It was also confirmed that Media Log collected resident registration numbers during the process of changing the payer of communication fees to a third party.
Cases where sensitive information was not encrypted were also identified. SK Tellink, LG Hello Vision, KT M Mobile, and Media Log stored resident registration numbers, credit card numbers, and account numbers in plain text.
KT Skylife and Unicomz failed to retain access permission management records for their personal information processing systems for the statutory period of three years. LG Hello Vision had inadequate management of access logs for its personal information processing system.
Most operators were found not to have disposed of personal information in a timely manner after the retention period expired or the purpose of processing was completed. Cases where optional consent items were structured as mandatory consent, making registration or use impossible without agreement, were also identified.
The Personal Information Protection Commission imposed an administrative fine of 13.7 million won on KT M Mobile and 47.2 million won on Media Log for processing resident registration numbers without legal basis. Unicomz was eligible for exemption from administrative fines but was subject to a penalty of 3.9 million won for the same violation.
Recommendations for procedural improvements were also made for operators where MVNO subscription can be done online, but cancellation requires visiting an agency or consulting with a customer center.
The Personal Information Protection Commission stated, "Since MVNO services process unique identification information and payment information during the subscription and activation process, leakage could lead to secondary damages such as identity theft," and urged compliance with safety measure obligations.
Meanwhile, MVNO subscriptions numbered approximately 10.5 million lines as of August, accounting for about 18% of all mobile communication phone lines.
in TECH
