State-run child rights agency fined record amount for massive data breach

SEOUL, Aug. 27 (Yonhap) -- A state-run child rights agency has been hit with record penalties for leaking more than 1.17 million pieces of personal information, including those of missing children and adoptees, and failing to report the breach, the state data protection watchdog said Thursday.

The Personal Information Protection Commission (PIPC) said it decided to impose a penalty of 863 million won (US$625,000) and a fine of 22.2 million won on the National Center for the Rights of the Child (NCRC) during a plenary meeting Wednesday for violating the Personal Information Protection Act.

This is the largest penalty ever imposed on a public institution.

The watchdog also asked the health ministry, which oversees the NCRC, to strengthen its guidance and supervision of the agency.

From 2013 to 2022, the NCRC carried out a computerization project to convert adoption records and missing child intake cards into Excel files and scanned documents. During the process, the contractor provided the digitized data to the NCRC on removable storage media, including external hard drives, USB flash drives and CDs.

The NCRC belatedly discovered that the storage media had gone missing while conducting an internal inspection into allegations of mismanagement in the adoption record computerization project.

As a result, 1.17 million pieces of personal information were exposed, including the resident registration numbers of about 300,000 adopted children and 15,000 missing children.

The PIPC said a separate personal information breach also occurred in the NCRC's adoption information disclosure request system, involving the personal information of 47 people, including 37 adoptees and 10 prospective adoptive parents.