Supporting companies with personal information leaks through the victim relief fund?... Scheduled location: “Inappropriate”

When the Personal Information Protection Committee attempted to use funds for victims' relief purposes, such as system recovery and security system improvement of companies that had personal information leaks, the National Assembly Budget Office put the brakes on it.

According to the National Assembly Budget Office's '2027 Budget Committee Analysis' report on the 9th, the Personal Information Committee allocated a total of 15.737 billion won as a budget for three projects to the Public Interest Reporting Incentive Fund, which is under the jurisdiction of the Ministry of Planning and Budget and is being established next year.

The Public Interest Reporting Incentive Fund is a fund being newly established to integrate and manage reporting reward resources distributed across each ministry and to support indirect relief for victims of acts that violate the public interest.

Among these, the Personal Information Commission allocated 5.098 billion won from the victim's indirect relief account to the project to 'prevent the spread of personal information damage and operate a support system'.

In detail, 2.466 billion won was allocated to support the personal information management system of small and medium-sized enterprises, 2.232 billion won to support recovery from damage from leaks, and 400 million won to detect personal information exposure and illegal distribution on the dark web.

In the personal information management system support project, 1.5 billion won will be invested in comprehensive consulting to inspect and improve the company's access rights, encryption, access records, internal management plan, and personal information processing policy, and 966 million won will be spent on training youth personal information protection personnel.

The leak accident damage recovery support project provides support to small and medium-sized businesses where personal information has been leaked in analyzing the cause of the accident, restoring the system, improving the security system, and taking measures to prevent recurrence.

However, the Ministry of Planning pointed out that these projects have a strong character of strengthening companies' personal information protection capabilities and supporting accident resolution rather than providing relief to victims of personal information infringement.

In particular, it was pointed out that personal information processors have an obligation to ensure the safety of personal information and take necessary measures in the event of a leak in accordance with the Personal Information Protection Act.

The Ministry of Strategy and Finance said, “It is not appropriate to support the costs of accident resolution and protective measures that personal information processors must bear, such as recovering the accident company’s system, improving its security system, and preventing recurrence, from the fund for indirect relief for victims.”

He then ordered that projects directly related to damage prevention, such as detecting and responding to dark web personal information and blocking additional damage after a leak, should be promoted by the fund, but corporate support projects such as corporate personal information management system consulting, training of professional personnel, and system recovery of accident companies need to be converted to general accounting when necessary.

The possibility of overlap with existing businesses was also raised.

The Personal Information Commission is already providing personal information protection consulting to small and medium-sized businesses and training professional personnel through the general accounting business.

The Ministry of Science and ICT also allocated 50 billion won in next year's budget for the 'AI SECaaS provision' project, which supports security system diagnosis and consulting and introduction of artificial intelligence (AI)-based security services for 10,000 small and medium-sized companies.

The Ministry of Planning pointed out that the support targets and functions of this project may overlap with the 'Support for personal information management system for small and medium-sized enterprises' project organized by the Personal Information Commission into the Public Interest Reporting Incentive Fund.

Both projects will be carried out by the Korea Internet & Security Agency (KISA), and are similar in that they diagnose the security vulnerabilities of small and medium-sized businesses and improve them through consulting.

The Ministry of Planning emphasized the need to review the division of roles with existing projects and adjust the scope of support and budget size for new projects.

However, an official from the Personal Information Commission explained that it is in line with the fund's purpose of indirectly supporting victims, saying, "It is necessary to quickly restore companies that have experienced leaks to prevent the spread of secondary damage to information subjects and prevent accidents in vulnerable small and medium-sized businesses."