Unauthorized Collection and Unencrypted Storage of Resident Registration Numbers... PIPC Sanctions 8 MVNOs

A total of 171.3 million won in fines and penalties imposed

The Personal Information Protection Commission (PIPC) has imposed a total of 170 million won in administrative fines and penalties on eight mobile virtual network operators for violating the Personal Information Protection Act.

Lee Jeongryeol, vice chairperson of the Personal Information Protection Commission, delivers opening remarks at the commission's 22nd plenary meeting at the Government Complex Seoul on the 11th. Photo provided by the Personal Information Protection Commission.

The PIPC said on November 12 that it had decided at its plenary meeting the previous day to impose administrative fines of 60.9 million won and penalties of 110.4 million won on eight companies, including KT M Mobile and MediaLog, and to order them to take corrective measures and publicly disclose the violations.

Specifically, MediaLog was fined 47.2 million won and penalized 14.4 million won; KT M Mobile was fined 13.7 million won and penalized 23.4 million won; LG HelloVision was penalized 15.3 million won; SK Telink, 14.4 million won; KB Kookmin Bank, 13.8 million won; Unicoms, 12.9 million won; S-1, 10.8 million won; and KT Skylife, 5.4 million won.

The PIPC said it launched the investigation after concerns were raised that privacy protections in the mobile virtual network operator industry were inadequate, as companies focused on competing to attract subscribers and expanding the market.

The investigation found that MediaLog collected resident registration numbers without a legal basis when changing the person responsible for paying fees to a third party during online activation. KT M Mobile and Unicoms did so while selling SIM cards through their websites. It also found that four companies—SK Telink, LG HelloVision, KT M Mobile and MediaLog—stored resident registration numbers, credit card numbers and account numbers without encryption. KT Skylife and other companies were found not to have kept records of access-rights management for personnel handling personal information systems for at least three years.

In addition, most of the companies treated “optional consent” for third-party provision of information for supplementary services as “mandatory consent,” making activation impossible without consent. The investigation also found cases in which personal information was not destroyed after its retention period had expired.

The PIPC recommended that companies that allowed customers to cancel service only by visiting a retail outlet or speaking with a customer service representative, unlike their remote activation process, improve their procedures. It also called on them to establish a minimum retention period for applications to cancel or defer activation, which were being kept for periods ranging from five days to one year. “Mobile services involve the handling of important personal information, such as unique identification information and payment information, during sign-up and activation. If this information is leaked, it could lead to secondary harm, including identity theft,” a PIPC official said, urging companies to “strictly fulfill their obligations to implement security measures.”

This content was produced with the assistance of AI translation services.