북한 개혁개방을 표방하는 비영리단체가 북한이탈주민의 개인정보가 담긴 SD카드를 대북 풍선에 실어 보냈다가 개인정보보호법 위반으로 과태료 처분을 받았다.
On October 18, Yonhap News reported that the North Korea Development Institute conducted a survey on the status and distribution of North Korea's energy industry from July to September 2019 at the request of the Korea Energy Economics Institute.
During this process, the institute collected personal information from 131 North Korean defectors, including names, resident registration numbers, addresses, contact details, years of defection, previous residences, and occupations.
The institute stored this information in an Excel file on an SD card. In May 2022, the SD card was sent along with a balloon aimed at North Korea. The balloon landed in a mountainous area in Gapyeong, Gyeonggi Province, before reaching North Korea. Police recovered the balloon and confirmed the personal data of the survey participants from the SD card.
On September 15, 2023, police notified the institute's representative that the SD card containing personal information had been leaked. However, the institute did not inform the affected individuals or report the incident to the relevant authorities until July 8 of this year.
Under current personal information protection laws, data handlers must notify affected individuals of any data breaches within 72 hours, including details about the leaked data, the timing and circumstances of the breach, and procedures for remedying the situation.
In August, the Personal Information Commission's second subcommittee determined that the institute violated the previous personal information protection law by failing to encrypt the data stored on the SD card using secure algorithms.
The commission also imposed a fine of 7.2 million won for the delay in notifying and reporting the breach, which occurred nearly three years after being informed by the police.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.