A fine of 7.2 million won was imposed on an organization that flew balloons carrying ‘personal information of North Korean residents’ to North Korea.

(Seoul = Yonhap News) Reporter Hong Jun-seok = It was revealed that a non-profit organization advocating reform and opening up North Korea sent SD cards containing the personal information of North Koreans to North Korea on a balloon.

According to the Personal Information Protection Committee on the 18th, the North Korea Development Research Institute, a non-profit organization, conducted a 'survey on the current status and distribution situation of the North Korean energy industry' at the request of the Energy Economic Research Institute from July to September 2019.

Through this process, the names, resident registration numbers, addresses, contact information, year of defection, residence before defection, and occupation before defection of the 131 North Koreans who participated in the survey were identified.

The Korea Development Institute stored the Excel file containing their personal information on an SD card, and when sending a balloon to North Korea in May 2022, immediately after the inauguration of the Yoon Seok-yeol government, the SD card in question was also placed in the balloon.

However, the balloon fell on a hill in Gapyeong-gun, Gyeonggi-do before reaching the north, and the police who recovered it found the personal information of North Koreans who participated in the survey on the SD card inside the balloon.

The police informed the representative of the Korea Development Institute on September 15, 2023 that the SD card containing the personal information of North Korean residents had been leaked, but the organization only notified and reported the personal information leak on July 8.

According to the current Personal Information Protection Act, a personal information processor who discovers that personal information has been leaked must notify the leaked items, the time and circumstances of the leak, and relief procedures within 72 hours.

In August of this year, the Second Subcommittee of the Personal Information Committee determined that the researcher violated the old Personal Information Act by not encrypting the personal information of North Korean residents in an SD card and encrypting it using a secure algorithm.

In addition, even after becoming aware of the personal information leakage through the police notification, they were notified of the personal information leakage almost three years later, and reporting it was considered a violation of the law and imposed a fine of 7.2 million won.