‘실종아동·입양인 개인정보 유출’ 국가아동권리보장원에 과징금 8억8천만원

A South Korean government agency responsible for protecting the rights of missing children and adopted individuals has been fined 88 million won for failing to report and notify the loss of personal information of over 1.17 million individuals. This is the highest amount of its kind among public institutions in the country. Last Friday, the Personal Information Protection Committee decided to impose a fine of 8,630 million won and additional fines totaling 2,200 million won on the National Child Welfare Rights Office (the agency) after finding it guilty of violating the Personal Information Protection Act in three separate data breach incidents.

The agency's management board urged the Ministry of Health and Welfare to strengthen oversight and improve the agency's data management system. According to the investigation, the agency processed adoption records and missing child registration cards from 2013 to 2022, sending the digitized data to supplementary storage media such as external hard drives and CDs.

However, the agency did not create an inventory or designate a dedicated manager for these storage media, which led to the loss of one CD containing adoption information and one external hard drive containing information about missing children. The personal information of around 114,000 adoptive individuals and 3,000 missing children was exposed through these two storage devices, which were not encrypted.

Furthermore, the agency did not report the data breach to affected individuals and related institutions within the legally mandated 72-hour timeframe, and it negligently shared database access credentials with the private contractor. Consequently, the Ministry of Health and Welfare warned the agency of its failure to comply with safety measures and manage the contractor's oversight, imposing a fine of 8,105 million won and an additional 2,200 million won in administrative fines.