The Personal Information Protection Commission announced on the 2nd that it held an emergency plenary session regarding the personal information leak incident involving SK Telecom and decided to notify the leak immediately.
During the emergency plenary session held this morning, the Personal Information Protection Commission found that SK Telecom had recognized the signs of customer SIM information leakage and reported it, but had not individually notified the information subjects of the leak, which includes legal matters. After the incident, SK Telecom only sent text messages to all customers that included information on SIM protection services and SIM replacement, and there has been a surge in complaints to the Personal Information Protection Commission regarding this issue.
The current Personal Information Protection Act mandates that the items of leaked personal information, the timing and circumstances of the leak, methods to minimize damage, and procedures for victim relief must be individually notified to the information subjects. Additionally, businesses must quickly prepare measures to minimize damage, but user dissatisfaction is increasing due to a shortage of SIM cards and processing delays.
In particular, the procedures for SIM replacement through mobile or on-site visits have been pointed out as insufficient as a damage prevention measure due to a lack of accessibility for vulnerable groups such as the elderly and disabled.
In response, the Personal Information Protection Commission clearly demanded that SK Telecom immediately conduct leak notifications compliant with legal requirements for all users for whom a leak has been confirmed or is likely; establish separate protective measures for vulnerable groups such as the elderly and disabled, and prepare various countermeasures such as eSIMs or changes in providers; and expand the dedicated response team to address the surge in complaints.
SK Telecom must submit the results of its actions within 7 days, and the Personal Information Protection Commission plans to continuously monitor compliance to minimize public inconvenience and anxiety. The Personal Information Protection Commission stated, "In the future, we will conduct a comprehensive investigation of SK Telecom's personal information processing system to understand the circumstances of the leak and whether there are additional leaks, and if violations of the protection law are found, we plan to take strict action."