Ministry of SMEs and Startups Weighs Revoking Selection of 'Startup for Everyone' Breach Firm... Forms 'Information Security TF'

Deliberation on revoking Amicus Lex's selection and restricting its participation
Emergency security inspections of 49 AI solution providers
Plan to form Information Security Management Task Force led by First Vice Minister

The Ministry of SMEs and Startups is considering sanctions, including revoking the selection, against a private artificial intelligence (AI) solution provider involved in a personal data breach affecting participants in “Startup for Everyone.” It will also establish an “Information Security Management Task Force” and strengthen personal data protection systems across government support programs.

On November 15, the ministry said it would pursue follow-up measures, victim protection, and emergency security inspections in response to the personal data breach at Amicus Lex, the operator of LawForm, an AI solution provided to participants in the second round of “Startup for Everyone.”

First, the ministry plans to convene a project operations committee to deliberate on whether to impose sanctions on Amicus Lex, including revoking its selection and restricting its participation in the program for up to one year. If sanctions are imposed, the company will be required to immediately destroy the personal data of “Startup for Everyone” participants in its possession, and the Korea Institute of Startup & Entrepreneurship Development will verify compliance.

The ministry will also take steps to protect and support those affected by the incident. If the AI solution is no longer provided, depending on the review results, participants currently using it will be offered an alternative AI solution with similar functions. In addition, the support period will be extended by one month to ensure that participants who advanced to the next stage and were unable to use the solution during the suspension and transition period can still use it. Victims of the personal data breach will receive information on remedies and application procedures through the legal advisory team of the “Startup One-Stop Support Center.”

The ministry will also conduct emergency security inspections of the remaining 49 AI solution providers. Together with private security specialists, it plans to inspect the 49 companies’ personal data holdings, access permissions, encryption, vulnerability management, and incident response systems by November 20. Any deficiencies will be addressed immediately, and the ministry will consider revoking the selection and restricting participation for companies that are unable to make the necessary improvements.

In addition, the ministry plans to establish an “Information Security Management Task Force,” led by the First Vice Minister, and strengthen personal data protection management across its support programs. This measure comes as the number of cases in which private-sector services are linked to government support programs has recently increased.

Accordingly, the ministry will assess the need to provide personal data from the planning and announcement stages of support programs, and specify in program announcements the obligations of service providers, including appointing a personal data protection officer and managing access permissions. Personal data security experts will be required to participate as evaluators in the company selection process, and information security will be reflected in evaluation scores.

The ministry will revise relevant guidelines to ensure that compliance with security obligations, including access permission and access log management, is checked both before services begin and during operations. It will establish a system for immediate incident reporting and strengthen measures to prevent the spread of harm.

This content was produced with the assistance of AI translation services.