[Data Sovereignty Under Threat] Remember Hit by Repeated Personal Data Breaches... Firms Sold Overseas Left in a Blind Spot

Remember, Which Holds Data on 5 Million Workers, Hit by Breaches

Probe Into Overseas Transfer of Personal Data Drags On

Current Law Only Requires Notice of Transfer

Institutional Reforms, Including Prior Reviews, Stall

Concerns are growing that the personal information of Korean companies sold to foreign investors could be left in a regulatory blind spot, as personal data breaches continue to occur at Remember, Korea's largest business card management service provider. Remember was sold to Swedish private equity firm EQT Partners in August last year for approximately 500 billion won. Concerns about the transfer and use of personal information arose at the time as well, when a company handling sensitive information about Korean users was acquired by a global private equity firm. However, more than a year later, the government has yet to develop any clear countermeasures.

In January this year, the Personal Information Protection Commission launched a preliminary fact-finding inspection of Remember, which was acquired by EQT, focusing on the cross-border transfer of personal information. The Commission is also investigating a hacking incident at SK Shieldus, a security company acquired by EQT in 2023. It has emerged that the investigation is still ongoing, nearly a year later. A Commission official said on Oct. 21, "Investigations into personal information breaches are not easy, as it takes time to determine the cause and scale of the breach," adding, "We are investigating how internal materials, including personal information, were leaked, and no final disposition has been made yet."

At last year's parliamentary audit, the Commission also acknowledged the risk of data breaches stemming from foreign private equity firms' acquisitions of data companies and pledged to prepare follow-up measures. Song Kyung-hee, chair of the Personal Information Protection Commission, said, "As the economic value of personal information increases, we need to closely examine the transfer of personal information in cases of business transfers or mergers and acquisitions. We will actively consider introducing institutional safeguards such as a prior review system and impact assessments." However, no related measures have been taken to date.

Remember sent apology emails to affected members, saying a system error around 4:09 p.m. on the 12th exposed members' personal information to others. Reporter Seo Sojeong.

Under Article 27 of the Personal Information Protection Act, titled "Restrictions on the Transfer of Personal Information in Connection with Business Transfers, etc.," when a personal information processor transfers personal information to another person as a result of a transfer of all or part of a business, a merger, or similar circumstances, it must notify the relevant data subjects of the planned transfer and provide the name, address, telephone number, and other contact details of the recipient. It must also inform them of the methods and procedures they can use if they do not wish their personal information to be transferred. Violating the notification requirement can result in an administrative fine of up to 10 million won and administrative sanctions.

Remember has experienced repeated personal information breaches, including incidents in 2023 and 2024 that exposed the personal information of 365 and 267 members, respectively. However, the problem has not been addressed, as related Korean laws and regulations, including penalties, remain inadequate. Remember started out as a business card management service and then aggressively sought to grow its membership. Building on a database of millions of working professionals, it expanded into human resources and recruitment services. It currently holds more than 500 million business card records and handles information on 5 million users. Its core business is business-to-business (B2B) services, through which corporate recruiters and headhunters send candidates job offers based on their job functions, career histories, and company information. Given that the company holds large amounts of sensitive personal information, careful management is especially important.

An information security industry official said, "It is true that regulations on the handling and protection of personal information are inadequate when foreign investors acquire companies that hold large amounts of sensitive personal information." The official added, "Companies like Remember that handle sensitive information continue to experience personal data breaches and could become prime targets for hackers, making more rigorous personal information protection essential." In connection with this, an official from the Ministry of Science and ICT said, "We are looking into the personal information breach involving Remember."

Meanwhile, responding to concerns that the personal information of Korean companies sold to foreign investors could be left in a regulatory blind spot, a Remember official said, "Even as a shareholder, [EQT] has no legal authority to handle or process personal information for business purposes and cannot use it directly."

This content was produced with the assistance of AI translation services.