[2020 National Audit] "Mandatory Disclosure of Information Security Status for Google, Naver, and Kakao"

Kim Sang-hee, Deputy Speaker of the National Assembly

[Asia Economy Reporter Buaeri] A bill is being promoted to require major domestic and international platform companies such as Google, Facebook, Naver, and Kakao to mandatorily disclose their information security status.

Kim Sang-hee, Deputy Speaker of the National Assembly and member of the Science, Technology, Information and Broadcasting and Communications Committee, announced on the 13th that she has proposed a partial amendment to the "Act on the Promotion of the Information Security Industry" containing such provisions.

The amendment supplements the current system, which allows service providers through information and communication networks to voluntarily disclose their investments and personnel status for information security, by stipulating that it be determined by Presidential Decree. According to the amendment, major ICT businesses with a certain revenue scale or more must mandatorily disclose their information security status.

According to data received by Deputy Speaker Kim from the Korea Internet & Security Agency (KISA), since the information security status disclosure system was first introduced in 2016, only 37 companies have voluntarily complied with the disclosure.

Platform companies with many domestic users such as Google, Netflix, Facebook, Naver, and Kakao were found not to have complied with the disclosure.

Among the 37 companies that voluntarily complied with the information security status disclosure at least once in the past five years, those with sales exceeding 1 trillion won last year include the three major telecom companies SK Telecom, KT, LG Uplus, as well as SK Broadband, Krafton, PUBG Studio, NHN, and CJ E&M.

At the National Assembly audit of the Science, Technology, Information and Communications Committee on the day, in response to Deputy Speaker Kim's related inquiry, Jang Seok-young, 2nd Vice Minister of the Ministry of Science and ICT, stated, "I think we should actively consider mandating it for companies that meet certain criteria."