The Personal Information Protection Commission (PIPC)'s enforcement principles have been put to the test. Critics point out that reviewing each case with different criteria undermines predictability and poses other problems. Experts have suggested that the Personal Information Protection Act needs to be strengthened, given the increasing trend in personal data breach incidents.
The recent issue involves a hacking incident at an outsourced vendor that led to the leakage of personal information from three institutional investors: the Rural Development Administration (RDA), the National Institute of Agricultural Science (NIAS), and the National Institute of Animal Science (NIAS).
In April last year, the network-attached storage (NAS) of SI company Misotech was hacked, resulting in the leakage of personal information from the three institutional investors that had outsourced tasks such as operating their personal information processing systems to the company.
Although the breaches resulted from the same hacking incident, the sanctions varied significantly. The RDA received a fine of 168 million won and a recommendation for corrective action, while NIAS was fined 23.1 million won and ordered to make corrections. In contrast, the National Institute of Animal Science received only an order for corrective action without any fine.
The imposition of fines differed based on "whether the amended law applies." The PIPC, which took effect on September 15, 2023, stipulates that a principal can be fined if they neglect their duties of management, supervision, and education, leading the agent to violate the Personal Information Protection Act. While the duty of management and supervision existed prior to the amendment, the legal basis for imposing fines was added during the revision.
According to the PIPC's decision document, all three institutional investors argued that the pre-amendment Personal Information Protection Act should apply. The RDA and NIAS explained that their outsourcing contracts ended in December 2022, while the National Institute of Animal Science's contract ended in September 2020, meaning their duties of management and supervision had also ceased to exist.
Through its decision document, the PIPC rebutted the claims made by the RDA and NIAS, stating, "Based on the legal principle that an unlawful state resulting from the failure to fulfill a duty of action continues until that duty is fulfilled, the violation of the duty to manage and supervise the agent continued at least until May 2025, when the 'Information Technology Service Project Security Strengthening Plan' was established."
This implies that the application of the post-amendment law is justified because the failure to properly inspect and verify personal information processing practices persists until it is resolved.
Conversely, the duty of management and supervision for the National Institute of Animal Science was deemed to have ceased along with the termination of its outsourcing contract.
The institute did not recognize that Misotech had built and operated the NAS until the breach occurred, nor did it conduct on-site inspections during the outsourcing period. This contrasts with the judgment regarding the RDA's on-site security inspections, which were deemed "difficult to consider effective" because they were conducted with a focus on information security and covered an average of 3.6 projects per day.
The PIPC maintains that it applied the law based on continuity. The RDA and NIAS had entered into other IT project contracts with Misotech after the termination of the relevant contract, meaning their duties of management and supervision were maintained, whereas this was not the case for the National Institute of Animal Science.
However, continuity is a concept introduced by the Personal Information Protection Commission while reviewing this specific case, rather than a previously established criterion.
Given that the Personal Information Protection Act is not strict and sufficient precedents have not yet been accumulated, it is an unavoidable situation where judgments are made on a case-by-case basis. Consequently, the need to strengthen the Personal Information Protection Act has been raised.
Hwang Seok-jin, a professor at the Graduate School of International Information Security at Dongguk University, said, "If the contract is considered substantively continuous, it is appropriate to impose a fine. However, from the RDA's perspective, receiving different sanctions for the same hacking incident could feel unfair."
He added, "As personal data breach incidents are occurring frequently, the National Assembly needs to comprehensively amend the Personal Information Protection Act."
in TECH
