State agency fined for leaking personal info of adoptees, missing children

SEOUL, August 27 (Yonhap) -- South Korea's National Center for the Rights of the Child (NCRC) has been fined a record 863 million won (US$625,000) and a 22.2 million won penalty for leaking over 1.17 million personal details, including those of missing children and adoptees, and neglecting to report the data breach, the state data protection watchdog announced on Thursday.

The Personal Information Protection Commission (PIPC) levied the sternest penalty ever imposed on a public body during a board meeting on Wednesday for contravening the Personal Information Protection Act. The watchdog also urged the Ministry of Health and Welfare, which oversees the NCRC, to bolster oversight and guidance for the agency.

Between 2013 and 2022, the NCRC undertook a computerization initiative to transform adoption records and missing child intake forms into Excel files and scanned documents. Throughout the operation, the external contractor supplied the digitized information to the NCRC on removable storage media, such as external hard drives, USB flash drives, and CDs.

The NCRC only realized the storage media were missing during an internal audit into allegations of negligence in the adoption record computerization project. Consequently, 1.17 million personal data points were compromised, encompassing the resident registration numbers of approximately 300,000 adoptees and 15,000 missing children.

The PIPC disclosed an additional personal information compromise within the NCRC's adoption information disclosure request system, implicating the personal data of 47 individuals, including 37 adoptees and 10 prospective adoptive parents.