Legal Duties of Companies Amid Repeated Data Leaks via Vendors

As background, recent incidents have highlighted chain-like leaks via vendors and smartphone apps, and it has been pointed out that similar types of damage can spread rapidly and simultaneously. The article notes that the amendment and changes in the enforcement of the Personal Information Protection Act, which made reporting mandatory, are one reason for the increase in reported incidents.

The safety management measures required in peacetime must be designed from four perspectives—organizational, human, physical, and technical—based on Article 23 of the Personal Information Protection Act and associated guidelines. Measures are not uniform; it is important to determine them on a risk basis according to business scale, the nature of the data handled, and the potential magnitude of harm.

Regarding vendor management, the article emphasizes that Article 25 of the Personal Information Protection Act obliges principals to provide "necessary and appropriate supervision." In practice, supervision centers on proper selection of vendors, specifying safety management matters in contracts, and understanding, evaluating, and reviewing handling practices; if subcontracting occurs, confirmation must extend to subcontractors as well.

As a legal obligation when a leak occurs, if the case falls under any of the four types set by the enforcement regulations (sensitive information, risk of financial damage, malicious intent, or more than 1,000 affected individuals), reporting to the Personal Information Protection Commission and, in principle, notifying affected individuals are required. Reporting is done in two stages after becoming aware of the situation: an initial notice (roughly 3–5 days) and a final report (generally within 30 days; 60 days if malicious intent is involved).

In initial response, priority is to promptly report to responsible personnel, prevent further spread of damage, and preserve evidence while investigating the facts and scope of impact and quickly determining whether reporting is required. For recurrence prevention, organizations must review regulations, governance, technical measures, employee training, and vendor management based on root-cause analysis, and are required to document both responses and countermeasures.