On April 20, 2012, the Korean government announced a new plan to limiting public organizations and private companies from collecting and using resident registration numbers which was originally intended to be applied only to the online sectors.
The Korea Communications Commission, the Ministry of Public Administration and Security and the Financial Services Commission announced their joint plan titled "Comprehensive Plan for Minimizing the Collection and Use of Resident Registration Numbers" (the "Plan") on April 20, 2012. This Plan is aimed to restrict the collection and use of resident registration numbers and manage personal identity data more safely. According to this Plan, public organizations and private companies in phases, following the online sector, will be restricted from newly collecting resident registration numbers. The companies which have been collecting resident registration numbers will need to prepare for such change by adjusting their online and offline systems to new standard. The major contents of this new Plan are as follows:
- Minimization of the Collection and Use of Resident Registration Numbers
Unless otherwise set forth by the relevant laws and regulations or except in unavoidable cases, public organizations and private companies can no longer newly collect or use resident registration numbers. According to the proposed amendments to the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc., which is expected to take effect in August 2012, the online sector will be first banned from newly collecting resident registration numbers, followed by public organizations and the offline sector in phases in the second half of 2012. For this purpose, the government plans to modify the relevant laws, regulations and government forms using the resident registration numbers. Moreover, the government will operate an ombudsman service to address a citizen's report on illegal Internet sites in violation of this regulation.
- Strengthened Duty of Management of Data
Under this comprehensive Plan, the entities which are exceptionally permitted to collect and use resident registration numbers will be subject to more strict control. For example, (i) a computer of personnel in charge of managing such data will be separated from internet networks; (ii) entities will be required to mandatorily adopt software automatically blocking the resident registration numbers posted on the message board of theirwebsites; (iii) online service providers will be legally obligated to make regular reports on the statement of data utilization to the data subjects; (iv) reentrustment with the management of resident registration numbers will be subject to tight control, while penalties against violation of the foregoing measures will be newly established.
- ProActive Measures for Preventing Infringement against Identity Theft and Increase in Penalties against Data Leakage and Illegal Management of Resident Registration Numbers
Under the Plan, the government will launch proactive measures against various types of identity theft, including conducting a field survey of illegal use, sale or falsification of other persons' identities (name and/or resident registration numbers included), and constant monitoring of data leakage on the internet sites in overseas such as China. Furthermore, increased penalties will be introduced against service providers who had data leakage and who managed such data illegally. To be specific, relevant laws and regulations will be amended so that the service provider who leaked data will be subject to a maximum fine equivalent to 1% of their turnover. Moreover, the CEOs ultimately responsible for such unlawful acts may be subject to suspension or dismissal. At the same time, the government plans to invigorate education and publicity programs for relevant service providers.