Preventing Another Coupang Incident in Advance... Preemptive Management of Personal Information Leaks According to Risk Level (Comprehensive)

Personal Information Protection Commission Announces Transition to Prevention-Centered Management System
Differentiated Management Based on Volume and Sensitivity of Personal Data
Expansion of Information Security Disclosure... Incentives Such a

Starting in the second half of the year, tailored preemptive inspections will be actively conducted according to the level of personal information leakage risk. Disclosure of information security activities will also be expanded to encourage increased investment in information security by companies.

The Personal Information Protection Commission announced the “Transition Plan for a Prevention-Centered Personal Information Management System” on the 22nd. This is a follow-up to the plan reported by the Commission at the Cabinet meeting on the 12th.

Gonakjun Ko, Prevention and Coordination Deliberation Officer at the Personal Information Protection Commission, is announcing the "Detailed Implementation Plan for Transitioning to a Prevention-Centered Personal Information Management System" on the morning of the 22nd at the Government Seoul Office Building. Personal Information Protection Commission

First, a risk-based prevention management system will be implemented. The fields of personal information processing will be divided into high, medium, and low-risk groups, considering the scale and sensitivity of personal information handled and the characteristics of each industry. Inspections and management will be differentiated accordingly. For high-risk groups, regular and ad-hoc inspections will be conducted to examine the status of internal control operations. This year, platforms, financial institutions, public agencies, edutech companies, and nursing hospitals that store a large amount of unique identification or sensitive information will be subject to these inspections.

Gon Nakjoon, Prevention and Coordination Deliberation Officer of the Personal Information Protection Commission, explained, “Problems identified during the preemptive on-site inspections will be addressed through recommendations to encourage improvements. If improvements are not made, corrective orders or investigative procedures may be initiated.”

For areas outside the high-risk group, the Commission plans to encourage conducting personal information impact assessments and complying with the Privacy by Design (PbD) principle. Tools and consulting for voluntary self-inspection will be provided to help personal information handlers achieve a basic level of protection. Where necessary, joint inspections will be conducted by relevant ministries and the Commission. Through an inter-ministerial policy council involving major related ministries, the state of personal information management and risk mitigation measures in each ministry's area of responsibility will be shared and coordinated.

In addition, by analyzing the current status of personal information processing and risk factors, a basic risk map will be created and used to select inspection targets. An early warning network for personal information threats between the public and private sectors will also be operated. With the introduction of the mandatory designation and reporting system for Chief Privacy Officers (CPOs) starting in September, the Commission will strengthen cooperation with associations and councils such as the CPO Council, operate a hotline for sharing the latest threat information, and enable early response to similar incidents.

Reduced Fines for Additional Protection Measures... Privacy Safeguards from the Design Stage

To encourage companies to invest in information security, disclosure of information security activities will be expanded. Among the existing security disclosure items, companies will be encouraged to publicly disclose the details of additional protection measures and CPO internal control processes within their security activities. If disclosure confirms that additional protection measures are in operation, incentives such as reduced fines will be provided. For minor legal violations by small and micro businesses, penalties will be reduced if corrections are made with technical support.

Officer Gon added, “Incentives like reduced fines are based on indicators such as effective security investment or safety management systems compared to industry peers. The specific details will be announced soon in a legislative report.”

Proactive inspections will also be carried out in new technology fields such as Internet of Things (IoT) devices and AI agents. Standards for safety measures will be revised mid- to long-term based on risk analysis, allowing processors to determine both the application and level of safety measures themselves.

The PbD principle will also be institutionalized. PbD means incorporating privacy protection as the default setting from the service planning, design, and development stages. Up to now, the PbD certification system has only been operated for certain products such as IP cameras and robot vacuum cleaners. To spread the PbD principle, the Personal Information Protection Act will be amended, and the Commission will distribute PbD guidelines and best practices. The PbD principle will also be reflected in existing evaluation and certification standards, such as the Information Security Management System and Personal Information Protection (ISMS-P) certification.

Furthermore, management across the supply chain—including Software as a Service (SaaS) platforms, cloud services, and specialized contractors that handle large volumes of personal information—will be strengthened. The Commission will also promote research and development (R&D) of preventive personal information protection enhancement technologies (PETs) and foster professionals to prevent information leakage and misuse. Additionally, the Commission plans to expand education for children, teenagers, and vulnerable groups so that privacy protection becomes part of daily life, and will inspect practices such as dark patterns to ensure this goal is achieved.

Song Kyunghee, Chairperson of the Personal Information Protection Commission, stated, “We will continuously inspect the status of personal information processing and vulnerabilities in key sectors in cooperation with relevant ministries and establish a prevention-centered management system proportional to risk.”

This content was produced with the assistance of AI translation services.