The Personal Information Protection Commission eased security regulations for large operators that handle personal information of an average of 1 million or more people per day, allowing selective application of internet network blocking according to the risk level of work devices.
The Personal Information Protection Commission said it will push to improve internet network blocking measures, strengthen platform operators' responsibility for open market sellers, and bolster voluntary protection systems for personal information handlers through a revision to the Standards for Ensuring the Security of Personal Information, which takes effect on the 31st.
Previously, all work devices of employees who could download or delete personal information from personal information processing systems had to be blocked from the internet, but going forward, each device's risk will be assessed and additional protection measures will be implemented only when the risk is high, or low-risk devices may be excluded from blocking.
An official at the Personal Information Protection Commission said, "We aim to shift to a protection system based on data importance and risk to improve conditions for using artificial intelligence (AI) and the cloud."
Alongside this, open market sellers that handle personal information through platforms must also retain access logs, and the subjects of access authorization and authentication management have been expanded from "personal information handlers" to "all personnel performing work."
The regulatory easing and definition-related provisions in this revision take effect immediately on this day, while items requiring preparation, such as establishing internal management plans, will apply in one year. The Personal Information Protection Commission plans to publish a Guide to Measures for Ensuring Security reflecting the revisions within the year and hold briefings for stakeholders.