Personal Information Protection Commission Fines Kukagames 93.7 Million KRW for Unauthorized Collection of Resident Registration Numbers

Correction Order Issued for Employee Review Site 'Jobboss'
"Resident Registration Numbers Must Only Be Processed in Exceptional Cases"

Companies that collected users' resident registration numbers without authorization are set to face regulatory actions.

The Personal Information Protection Commission announced on the 23rd that it held its 16th plenary meeting and deliberated and resolved the results of the investigation and sanctions against Kukagames and Jobboss Co., Ltd., which violated personal information protection regulations.

Kukagames, a global gaming company, operates mobile game services in Korea. Jobboss was a website designed for employers to exchange employee information, but it ceased operations in January of this year.

First, the Personal Information Protection Commission imposed a fine of 93.7 million KRW on Kukagames and issued a corrective order to stop processing resident registration numbers without a legitimate basis. Kukagames, while operating the mobile game "Three Kingdoms Tactics," held an event and collected 41 resident registration numbers from event winners along with their names, addresses, and contact information.

The commission's investigation found that Kukagames provided alcoholic beverages as prizes to event winners, and in the process, collected resident registration numbers to verify the age of the prize recipients. The Personal Information Protection Act stipulates that resident registration numbers may only be processed in exceptional cases, such as when specifically required or permitted by presidential decree or higher-level laws.

The commission also issued a corrective order to Jobboss Co., Ltd. to comply with the law regarding the processing of resident registration numbers. Jobboss provided a feature on its website for employers to write employee reviews for the purpose of information exchange. When an employer wrote a review, entering the employee's resident registration number was mandatory, and to search for reviews written by other employers, the resident registration number of the relevant employee also had to be entered.

Upon investigation, the commission confirmed that Jobboss, like Kukagames, collected the resident registration numbers of 575 employees without a legitimate basis. Accordingly, a corrective order was issued to ensure compliance with the law regarding the processing of resident registration numbers.

However, considering that Jobboss is currently closed and in a state of complete capital erosion, the commission decided not to impose a fine. Separately, a penalty of 10 million KRW each was imposed on the company and its representative for violating Article 24, Paragraph 1 of the Personal Information Protection Act.

The commission stated, "If a resident registration number is leaked, the damage and social problems for the data subject can be much more serious compared to other personal information," and urged, "If there is no specific legal basis for processing resident registration numbers, businesses handling personal information must not collect or process them."