CDs and external hard drives containing personal information of adoptees and missing children lost... 1.17 million records leaked

National Center for Child Rights Imposed with Record-Breaking Fine of 860 Million Won on Single Public Institution;
Personal Information of 47 Adoptees and Prospective Adoptive Parents Leaked from Adoption Information Disclosure Request System

 

Personal Information Protection Commission Nameplate
[Provided by Personal Information Protection Commission]

(Seoul = Yonhap News) Reporter Cha Min-ji = A penalty fine approaching 900 million won has been imposed on the National Institute of Child Rights for failing to properly notify or report the leakage of over 1.17 million pieces of personal information, including that of missing children and adoptees.

This is the largest penalty fine ever imposed on a public institution.

The Personal Information Protection Commission imposes a fixed penalty fine on public institutions that have no revenue or for which revenue calculation is difficult.

The Commission announced on the 27th that it held a plenary meeting on the 26th and resolved to impose a penalty fine of 863 million won and an administrative fine of 22.2 million won on the National Institute of Child Rights for violating the Personal Information Protection Act in connection with three incidents of personal information leakage involving missing children and adoptees.

While ordering corrective orders, disciplinary recommendations, and recommendations for improvement, as well as mandating the public disclosure of the disposition results, the Commission also recommended that the Ministry of Health and Welfare, the supervising agency, strengthen guidance and supervision over the Institute's overall personal information management system.

 

[Provided by the Personal Information Protection Commission]

From 2013 to 2022, the Agency carried out a digitization project to convert adoption records and admission cards for missing children into Excel data and scanned files.

During this process, the contractor delivered the digitized data to the Agency on auxiliary storage media, such as external hard drives, USB memory sticks, and CDs

. The Agency belatedly discovered that these auxiliary storage media had disappeared while conducting an internal inspection regarding allegations of mismanagement in the adoption record digitization project.

The investigation revealed that the Agency stored these media in office cabinets or drawers without properly implementing safety measures, such as designating a manager or maintaining entry and exit logs. Furthermore, the auxiliary storage media containing Resident Registration Numbers were not encrypted.

Consequently, the agency was unable to even identify the specific timing and route of the personal information leak. Due to this mismanagement, a single CD

containing digitized adoption records was leaked between 2013 and 2018, resulting in the leakage of approximately 1.14 million pieces of personal information, including the names, addresses, and contact details of adoptees, as well as about 300,000 Resident Registration Numbers. One external hard drive containing the results of the 2020 computerization of admission cards for missing children was also leaked, resulting in the leakage of approximately 30,000 pieces of personal information, including the names, dates, times, and locations of incidents involving missing children, as well as about 15,000 resident registration numbers. Consequently, the total scale of the leak exceeded 1.17 million records. It was found that the Agency failed to notify or report the incident within 72 hours of becoming aware of it. The Personal Information Protection Commission confirmed that during the computerization process, the Agency shared its employees' system access accounts with a contractor and neglected its management and supervision of the contractor. Accordingly, the Commission decided to impose a fine of 810.5 million won and a penalty of 22.2 million won on the Agency in connection with the leak, as well as issue a corrective order, a recommendation for disciplinary action, and the public announcement of the disposition results.











 

National Center for the Protection of Children's Rights
[Filmed by Lee Chung-won]

Separately, a personal information leak also occurred at the adoption information disclosure request system operated by the Adoption Guarantee Agency.

The Agency established the system and sequentially launched four application menus for adoptees and prospective adoptive parents last March and April.

During this process, the agency failed to properly conduct safety and consistency tests; instead, it stored the documents submitted for adoptee applications for adoption confirmation certificates and prospective adoptive parent applications in the same database table and assigned application numbers sequentially starting from '1' to each menu.

Consequently, adoptees and prospective adoptive parents with the same serial number were able to view each other's submitted documents, resulting in the leakage of personal information—including names, dates of birth, and gender—of 47 individuals, including 37 adoptees and 10 prospective adoptive parents.

Regarding this incident as well, the Personal Information Protection Commission decided to impose a fine of 52.5 million won on the Agency for violating safety obligations and to publicly announce the disposition results. The

Commission emphasized, "Public institutions face higher public interest and expectations regarding personal information protection, and the significance and value of the personal information they process are greater; therefore, they must do their utmost to protect personal information."

It also announced that it would take strict measures, such as recommending disciplinary action, against institutions that delay or fail to comply with notification of the leak.