Expansion of Personal Information Leakage Damage... "Mandatory Insurance Enrollment Scope Should Be Expanded"

Information and Communication Service Providers Required to Enroll in Insurance
Only 11,813 Cases of Personal Information Compensation Insurance Enrollment

[Image source=Yonhap News]

[Asia Economy Reporter Oh Hyung-gil] It has been revealed that at least 280 million pieces of personal information have been leaked from public institutions and private companies.

As the damage caused by personal information leaks becomes severe, there are calls to expand the mandatory subscription targets for personal information leakage liability insurance.

According to the national audit data submitted by the Personal Information Protection Commission to Kim Byung-wook, a member of the Democratic Party of Korea, on the 10th, the number of personal information leaks from public institutions, private businesses, and information and communication service providers has been approximately 280.44 million cases from 2012 to the end of August this year.

Public institutions experienced leaks of personal information such as names, resident registration numbers, mobile phone numbers, and addresses in 2.089 million cases across 38 institutions, while private businesses had 245 entities with 225.606 million cases of personal information leaks during the same period.

In particular, information and communication service providers were found to have leaked about 52.745 million cases from 199 institutions between 2016 and August of this year.

Under current law, information and communication service providers with annual sales exceeding 50 million KRW in the previous year and storing or managing personal information of more than 10 million users on average per day over the last three months of the previous year must mandatorily subscribe to insurance or mutual aid to guarantee liability compensation in case of personal information leakage.

About ten domestic non-life insurance companies have launched related products, operating special contracts such as crisis management consulting and crisis management execution costs that can reduce the risks of information leakage providers (companies, etc.) based on common terms and conditions.

These cover costs related to investigating and confirming causes of personal information leaks or theft for the first incident, attorney fees for related lawsuits, and consolation payments to victims.

However, as of the end of August this year, only 11,813 cases have subscribed to liability insurance for damages related to personal information leaks. Compensation for damages caused by personal information leaks is grossly insufficient.

Regarding the low insurance subscription rate, Representative Kim pointed out that public institutions and private businesses are excluded from the mandatory subscription targets for personal information leakage liability insurance, and it is difficult to identify the information and communication service providers who are subject to mandatory subscription.

Representative Kim said, "Although the mandatory subscription targets for personal information leakage liability insurance are stipulated by law, the Personal Information Protection Commission cannot identify the mandatory subscribers because the number of stored personal information is considered internal business information," adding, "Mandatory subscription should be extended to public institutions and private businesses that are not currently required to subscribe to strengthen compensation for damages caused by personal information leaks."