‘Am I Also Suffering from Personal Information Protection Insensitivity?’ The Unnoticed Spread of Personal Information

Even if Vehicle Posting Phone Numbers Are Leaked, Punishment Is Difficult
Social Awareness of the Importance of Personal Information Must Improve

Around 10 a.m. on the 27th, in the parking lot of an apartment complex in Jongam-dong, Seongbuk-gu, Seoul. Pieces of paper with personal phone numbers were placed behind the front windshield of parked cars. A resident of the apartment, Mr. Han (56), said, “I have hung my number in front for a long time just in case I need to move my car,” but also added, “When I hear news about numbers being stolen, I feel uneasy that my number might be taken and misused by an unknown person.”

On the same day, phone numbers were also publicly displayed on every vehicle in the public parking lot of Gyeongdong Market in Dongdaemun-gu, Seoul. Mr. Hwang (68), who drove to Gyeongdong Market that day, said, “I am worried about my phone number being leaked, but since it is necessary in case someone needs to move my car or in an emergency, I have no choice but to keep my number displayed at all times.”

Around 5 p.m. on the 27th, through the front windshield of a car parked on a street in Jegi-dong, Dongdaemun-gu, Seoul, a paper with the vehicle owner's personal phone number and address (left) and a business card can be seen.
[Photo by Sim Seong-a]

'Not Applicable as a Personal Information Processor' Makes Punishment Difficult

It has become common for personal information to be indiscriminately exposed in daily life. However, there is a lack of proper regulations to sanction this, and urgent measures are needed.

According to the Personal Information Dispute Mediation Committee on the 28th, the number of dispute mediation cases has been increasing every year: 302 cases in 2019, 297 in 2020, 417 in 2021, 551 in 2022, and 666 in 2023. Among these, the largest proportion each year involved ‘collection of personal information without consent,’ accounting for 31.2% of disputes last year.

However, in reality, it is difficult to punish ordinary individuals who collect others’ personal information. The Personal Information Protection Act only regulates principles for personal information processed by ‘personal information processors.’ It does not apply to individuals who collect personal information without being public institutions, corporations, organizations, or individuals operating personal information files for business purposes.

In March, two men were caught by police while collecting personal phone numbers written on cars in an apartment parking lot in Seoul. They were found to be collecting contact information to promote a sales office, but were charged not with violating the Personal Information Protection Act but with violating the Act on Punishment of Violent Acts, etc. (trespassing on joint property). A police official explained, “It was difficult to apply the Personal Information Protection Act, so they were only sent for trespassing charges.” Cars parked in unmanaged open spaces or roadside areas are defenseless against similar crimes.

Because of this, experts believe that the officially recorded cases of personal information infringement are much fewer than the actual number. The National Police Agency recorded 2,331 cases of violations of the Personal Information Protection Act in 2022 (1,676 arrests). However, Attorney Yang Jin-young, head of the Minhu Law Firm, said, “Even when reports are made expecting personal information protection violations to apply, many cases do not lead to punishment,” adding, “It is difficult to estimate the exact scale of damage or compensation amounts, and it usually takes 3 to 4 months for dispute mediation decisions and over 6 months for prosecutions, making it hard for victims to receive proper compensation.”

Professor Hwang Seok-jin of Dongguk University’s Graduate School of International Information Security also pointed out, “Once personal information is leaked, it keeps circulating digitally through copy and paste functions, undergoing first and second processing, making it hard to find the original collector and seller of the information,” and “Victims often do not even know where their information was leaked from.”

39% Do Not Respond Even When Personal Information Is Exposed

Lack of awareness about personal information protection is also a problem. According to a 2022 survey by the Personal Information Protection Commission targeting those who experienced personal information infringement, 39.2% responded that they ‘did not take any action.’ Especially, the tendency to take no action increased with age. The main reasons for not responding were ‘the damage was not significant’ at 39.4%, followed by ‘reporting or consulting for damage relief is cumbersome and bothersome (29.4%),’ ‘lack of knowledge about damage relief agencies, methods, or procedures (21.4%),’ and ‘believing that reporting or consulting would be ineffective (9.4%).’

Experts advise that social awareness of the importance of personal information must improve. Professor Hwang said, “Information visible to an unspecified number of people can be considered as having been consented to by the individual, so there are limits to punishing third parties who collect it as violations of the Personal Information Protection Act,” and advised, “People should value their personal information and be vigilant.”

Attorney Yang also emphasized, “Awareness of the importance of personal information must first increase,” but criticized that the level of compensation or punishment is low compared to the costs and time victims endure to receive compensation. He pointed out, “The compensation victims usually receive is only about 200,000 to 400,000 KRW, which is too little considering the mental distress they suffer,” and added, “Punishment levels should be raised to prevent similar problems from recurring.”