Ministry of Land, KEPCO, and NTS Public Systems Selected as Exemplary Cases for 'Safety Measures Obligation' Compliance

Inspection of 38 Organizations and 57 Systems This Year
"Personal Information Management Improved Over Three Years"

Three public systems, including the Ministry of Land, Infrastructure and Transport's Housing Ownership Verification System, have been selected as exemplary cases for fulfilling the 'enhanced safety measures obligation.'

Song Kyunghee, Chairperson of the Personal Information Protection Commission, is striking the gavel at the 23rd plenary meeting held on the afternoon of the 20th at the Government Seoul Office. Photo by Personal Information Protection Commission

The Personal Information Protection Commission announced on the 21st that it had presented the results of its inspection of 38 organizations and 57 public systems for compliance with obligations at the 23rd plenary meeting held the previous day.

The commission has been conducting inspections over three years since 2023, selecting targets based on criteria such as the volume of personal information held (over 1 million records), the number of personal information handlers (over 200), and the presence of special types of personal information (such as resident registration numbers).

Among the public system operators inspected this year, only the National Tax Service and Korea Real Estate Board fully complied with their obligations. The commission stated that it would recommend corrective action to the remaining 36 organizations with insufficient compliance and publicly announce the disposition on their websites for one year.

The Ministry of Land, Infrastructure and Transport's Housing Ownership Verification System, Korea Electric Power Corporation's Transmission and Substation Compensation Support System, and the National Tax Service's Tax Administration Portal were cited as exemplary cases.

The Ministry of Land, Infrastructure and Transport was praised for specifically setting criteria for abnormal activities in its internal management plan (such as between 2 a.m. and 5 a.m., 50,000 inquiries, 50 downloads, and 50 logins), and for clearly specifying the participating organizations in the council, including entrusted and user institutions, reflecting the system's characteristics.

Korea Electric Power Corporation was recognized for clearly specifying the need for non-government employee accounts in the system and implementing procedures to collect standard personal information behavior guidelines and security pledges via pop-up windows. The National Tax Service's Tax Administration Portal was effective in requiring an initial explanation for negatively assessed access records and linking final negative determinations to disciplinary action or prosecution.

According to the commission, the implementation rate of special safety measures has generally improved over the past three years. In particular, the 'establishment and operation of a personal information protection council' task in the system management area improved from 34% (first round) to 91% (third round).

In the area of access rights management, the 'integration with personnel information' task saw its implementation rate rise from 34% to 72%, while in the access record inspection area, 'abnormal activity detection' improved from 52% to 70%. In addition, for the 'dedicated personnel expansion' task-one of the human resources and system expansion areas-the average number of dedicated personnel per organization increased from 1.7 to 2.7.

The commission plans to conduct ongoing inspections starting next year through the 'public institution protection level assessment.' In response to the recent increase in public sector data leaks, the commission will strengthen obligations for vulnerability assessments, such as simulated hacking, and improve the special safety measures system for public systems accordingly. Proactive preventive measures, such as establishing security measures for major vulnerabilities, will also be expanded.

Additionally, the commission is currently accepting consulting requests from relevant organizations following the fire at the National Information Resources Service (Daejeon Center). Consulting is underway for the Korea Funeral Culture Promotion Agency (e-Haneul Funeral Information System) and the Korea Social Security Information Service (three systems including the Digital Care System), focusing on system backup and recovery plans and countermeasures against illegal external access.

This content was produced with the assistance of AI translation services.