PIPC: "Excellent Management and Processing Status of Personal Data Collected via QR Codes and Safe Call"

Personal Information Commission's Inspection of Quarantine Sites and Major Personal Data Processing System Improvements Over the Past Year

[Asia Economy Reporter Eunmo Koo] The Personal Information Protection Commission (PIPC) held a plenary meeting at the Government Seoul Office on the 10th and approved the "Inspection and Improvement Results of COVID-19 Personal Information Processing Practices."

Since its launch in August last year, the PIPC has implemented personal information protection measures such as improving entry logs to address concerns about the leakage and misuse of the vast amount of personal information collected and processed during the COVID-19 response. It has also cooperated with quarantine authorities to inspect the personal information processing practices at frontline quarantine sites and the quarantine-related personal information processing systems.

The PIPC inspected ▲management of entry logs for multi-use facilities ▲disclosure of confirmed patients' movement routes ▲and eight quarantine-related personal information processing systems. The inspection results showed that electronic entry logs such as QR codes are automatically destroyed every four weeks, disclosure of confirmed patients' movement routes generally complies with guidelines, and violation cases are on a declining trend.

First, the use of electronic entry logs (QR codes and Safe Call) for multi-use facilities has increased, while handwritten logs have decreased. From June last year to August this year, 2.07 billion QR code entries were cumulatively collected, and according to the principle of automatic destruction after four weeks, 87% (1.808 billion) were destroyed, with only 4.86 million entries (0.26%) used for epidemiological investigations. Safe Call collected 180 million entries in September alone, with 91% (168 million) destroyed and only 44,000 entries (0.02%) used for epidemiological investigations.

The confirmed patients' movement routes disclosed on local government websites are inspected monthly, and the results are notified to the quarantine authorities and respective local governments for immediate improvement. This has significantly reduced violation cases. A total of 11,985 pieces of confirmed patients' movement route information shared on SNS and other platforms were detected, and 11,632 (97%) were deleted.

The quarantine authorities operate eight personal information processing systems to handle the vast amount of personal information collected at each stage of COVID-19 quarantine. The PIPC confirmed through inspections that personal information is lawfully processed with the consent of data subjects or based on legal grounds for COVID-19 quarantine purposes. However, even when legal grounds exist, the PIPC completed urgent improvements such as replacing unique identification information (resident registration numbers and foreigner registration numbers) with birth dates whenever operationally possible according to the principle of minimum personal information collection, and stopping unnecessary address verification.

The PIPC plans to promote institutional improvements identified during the inspection process. First, it plans to improve the system by requiring clear legal grounds when permanently preserving sensitive and vast personal information of confirmed and vaccinated individuals collected during the COVID-19 quarantine process. Additionally, to prepare for cases where personal information collection exceeds the minimum necessary scope under the Infectious Disease Control and Prevention Act, the law will be amended to ensure that the Personal Information Protection Act is not excluded and applies in urgent public health situations.

Yoon Jong-in, Chairperson of the Personal Information Protection Commission, said, "Until COVID-19 ends, we will continuously inspect to ensure that the public can trust the quarantine authorities and cooperate with quarantine efforts without worrying about their personal information, and we will report the results to the public." He added, "After the end of the pandemic, we will prepare comprehensive improvement measures to minimize personal information collection and ensure stricter protection even in future urgent infectious disease situations."

This content was produced with the assistance of AI translation services.