It took an average of eight months to investigate personal information leak and infringement cases. The National Assembly Budget Office said that with investigators concentrated on large cases, handling of routine cases could be delayed, and noted that criteria for prioritizing cases and allocating staff should be established.
According to a settlement of account analysis report by the National Assembly Budget Office on the 26th, the Personal Information Protection Commission's average investigation period by year of disposition was ▲ 216.3 days in 2021 ▲ 195.7 days in 2022 ▲ 291.9 days in 2023 ▲ 259.4 days in 2024 ▲ 239.4 days in 2025, exceeding an average of 200 days.
This is the average length of time from the start to the completion of an investigation, based on cases the Personal Information Protection Commission disposed of each year. Even after an investigation is completed, follow-up steps such as advance notice and commission resolution remain, so additional time may be required until an actual disposition.
The budget office analyzed that the lengthening of investigations was not solely due to an increase in personal information leak incidents. The Personal Information Protection Commission's Investigation Coordination Bureau staff increased from 48 at the end of 2022 to 60 in April this year, and the authorized headcount also expanded from 57 to 75 over the same period.
By contrast, large personal information leak incidents with significant social impact were handled relatively quickly. According to the status of major cases analyzed by the budget office, the SK Telecom personal information leak that occurred last year took 127 days from the start of the investigation to disposition, while the Coupang personal information leak case took 201 days.
For the SK Telecom case, a dedicated task force of 14 people was deployed, including four Personal Information Protection Commission Researchers and seven Korea Internet & Security Agency (KISA) technical support staff. The incident investigation was completed in about three months, and including the disposition process, wrapped up in about four months. The Coupang personal information leak case also saw a total of 14 people deployed, including four Personal Information Protection Commission Researchers and seven KISA technical support staff.
The budget office analyzed that when Researchers and KISA technical support staff are concentrated on large cases, there is a possibility that the start and handling of other personal information leak and infringement investigations could be delayed. Accordingly, it recommended that the Personal Information Protection Commission systematically manage the time required at each stage of incident investigation and the status of long-pending cases, and clearly establish priorities and handling standards that take into account the scale of the leak, the sensitivity of the information, the seriousness of the case, and the difficulty of handling.