The sanctioning principles of the Personal Information Protection Commission (PIPC) have been put to the test. This is because different sanctions have been imposed for data breach incidents resulting from the same hacking attack. There are widespread criticisms that reviewing the criteria for judgment differently on a case-by-case basis undermines predictability and poses other issues. Experts have also suggested that the "Personal Information Protection Act" needs to be strengthened.
According to relevant government agencies on the 26th, the Rural Development Administration (RDA) has planned to file an administrative review against the PIPC's fine sanction issued in mid-this month. The rationale is that it is unfair to apply the amended law retroactively to a commissioned contract that had already been terminated. It is unusual for one government agency to file an administrative review against another government agency.
The issue originated when Miso Tech, an SI company that had commissioned contracts with three agencies—the RDA and its subordinate agencies, the National Institute of Agricultural Science (NIAS) and the National Institute of Animal Science (NIAS)—had personal information from these three agencies stored on a NAS (Network Attached Storage) stolen by an unidentified hacker in April last year. The RDA stated that approximately 571,000 pieces of personal information, including names, contact details, and addresses contained in six types of personal information files such as homepage member data, were leaked during this process.
Although the leaks resulted from the same hacking incident, the sanctions varied. The RDA was fined 168 million won and received a recommendation for corrective action, while NIAS was fined 23.1 million won and received an order for corrective action. The National Institute of Animal Science received only an order for corrective action without a fine.
The imposition of fines varied depending on "whether the amended law applies." The Personal Information Protection Act, which has been in effect since September 15, 2023, stipulates that a fine may be imposed on the principal if the contractor violates the Personal Information Protection Act due to the principal's negligence in management, supervision, and education. While the duty of management and supervision existed prior to the amendment, the basis for imposing fines was added during the revision.
According to the PIPC's decision document, all three agencies argued that the pre-amendment Personal Information Protection Act should apply. In response, the RDA and NIAS explained that their duties of management and supervision ceased when their commissioned contracts ended in December 2022. The National Institute of Animal Science stated that its contract ended in September 2020.
Through the decision document, the PIPC stated, "Based on the legal principle that an illegal state resulting from the failure to perform a duty of action continues until that duty is fulfilled, the contractor's violation of the duty of management and supervision continued at least until May 2025, when the 'Security Strengthening Plan for Informatization Service Projects' was established." This means that the fault of failing to properly inspect and verify personal information processing practices persists until resolved, so the post-amendment law is applied. Conversely, it presumed that the National Institute of Animal Science's duty of management and supervision ceased along with the termination of its commissioned contract.
The PIPC maintains that it applied the standard based on continuity. It stated that the RDA and NIAS had other informatization project contracts with Miso Tech after the relevant contracts ended, so their duties of management and supervision were maintained, whereas this was not the case for the National Institute of Animal Science. However, continuity is a concept introduced by the PIPC while reviewing this specific case, rather than a previously established standard.
Professor Hwang Seok-jin of the Graduate School of International Information Security at Dongguk University said, "If the contract is considered substantively continuous, I believe it is correct to impose a fine, but from the RDA's perspective, receiving different sanctions for the same hacking incident could feel unfair." He added, "As personal information leak incidents are occurring frequently, the National Assembly needs to thoroughly amend the Personal Information Protection Act."
in TECH
