Inspection of Personal Information Processing Practices for 'Thermal Imaging Cameras'

[Asia Economy Reporter Seulgina Jo] The Ministry of Science and ICT and the Personal Information Protection Commission announced on the 23rd that, as the use of facial recognition thermal cameras has expanded due to the ongoing COVID-19 pandemic, they plan to inspect security vulnerabilities and check the personal information processing practices of device installers and operators to ensure that the public can use the devices with confidence.

Recently, facial recognition thermal cameras are widely used not only for user temperature checks but also connected to the internet for attendance management. This raises concerns that unnecessary communication functions may be activated or that personal information such as facial images and voice data could be stored without consent, potentially leading to cyberattacks and personal information leaks.

Accordingly, the Ministry of Science and ICT conducted an urgent preliminary inspection focusing on security vulnerabilities of three major network-connected devices distributed domestically, examining whether personal information such as facial (image) and voice data could be leaked externally. The inspection revealed that some devices had additional communication functions, vulnerable to security risks, activated by default beyond the temperature measurement function.

Based on this urgent inspection, the Ministry of Science and ICT and the Personal Information Protection Commission will conduct further security vulnerability checks to ensure safer device use by the public, and by December, they will inspect usage practices targeting installers and operators. The Ministry of Science and ICT will additionally select major devices widely used domestically to examine whether they have functions that leak personal information externally. The Personal Information Protection Commission plans to inspect compliance with the Personal Information Protection Act among installers and operators of devices in major public institutions and private companies.

To safely use devices against the security vulnerabilities identified in this urgent inspection, the government urged users to ▲ use products without network functions or avoid connecting devices to the internet ▲ carefully check for unnecessary communication functions through manuals or security departments (experts) ▲ take security measures such as deleting vulnerabilities before use.

According to the Ministry of Science and ICT, currently two domestic thermal camera manufacturers have applied for Information and Communication Network Connection Device Information Protection Certification and are in the testing phase. The Ministry has been providing this certification to device importers and manufacturers to alleviate public concerns about personal information or critical information leaks.

A government official recommended, "To prevent leaks of personal or critical information, if there are IoT devices such as IP cameras, digital door locks, or insulin injectors that have obtained information protection certification, please use certified products."