Resident Registration Number Exposed on Google... Information Submitted to Public Institutions Leaked for 4 Years

Information Including Resident Registration Number and Address Left As Is
"It Was Strange to Receive So Many Spam Texts"

Personal information submitted to public institutions was exposed on Google for four years due to inadequate management, sparking controversy.

According to a report by Yonhap News on the 8th, Mr. A, who lives in Naju City, Jeollanam-do, discovered an internet address containing his personal information while searching his email on Google on the 14th of last month. The URL was for the ‘Jeonnam Youth Naeillo’ online application homepage, where a screen displaying some of Mr. A’s personal information appeared. Additionally, a PDF file containing detailed personal information of Mr. A could be downloaded.

This file is known to be documents Mr. A submitted in June 2019 when applying for the ‘VR·AR Expert Training Course’ at the Jeonnam Information & Culture Industry Promotion Agency. The education participation application form in the file exposed Mr. A’s personal information such as his photo, resident registration number, address, and mobile phone number. It even included a resident registration certificate containing the names and addresses of Mr. A’s family members. The file could be easily found by searching Google using Mr. A’s name combined with specific keywords like ‘Jeonnam’ and ‘Youth’.

PDF file containing personal information of Mr. A exposed on Google Photo by Yonhap News

Mr. A said, “The personal information, which should have been destroyed after the three-year retention period by the personal information storage institution, was publicly available on Google for four years,” adding, “I was puzzled by the unusually high number of spam calls and messages, but after discovering the cause, my entire family suffered significant psychological damage.”

In response, the Promotion Agency deleted the URL after being contacted by the Personal Information Infringement Reporting Center. The agency was unaware of the personal information leak, so Mr. A had to request deletion directly from Google and the reporting center. The agency determined that the URL of the Jeonnam Youth Naeillo online application homepage, where Mr. A’s personal information file was registered, had been externally shared without the agency’s knowledge. The agency apologized to Mr. A and promised to establish measures to prevent recurrence.

Meanwhile, the government has announced a plan to strengthen personal information safety measures for centralized management systems in the public sector to prevent leaks of sensitive personal information processed on a large scale. Based on the amount of personal information held, the number of handlers, and the processing of sensitive or resident registration information, 1,515 centralized management systems have been selected for enhanced safety measures. Institutions holding the selected centralized management systems must implement 10 tasks across four areas: ▲ system management framework ▲ granting and managing access rights ▲ checking access logs ▲ expanding responsible personnel and systems.