Government24 Personal Data Leak: What Can You Do If a Public Institution Leaks Your Personal Information?
Hello, this is Jean, a licensed administrative agent at Ethos Administrative Agent Office.
Do you use TVING?
I used to use TVING as well, then deleted it, but about a week ago I received a text message saying that my account information had been hacked.
But data leaks like this do not happen only at private companies.
They also happen at government agencies. In this case, the agency involved was Government24.
In April 2024, a data incident occurred on Government24, the administrative portal used nationwide, where the personal information of 1,233 people was exposed to the wrong individuals.
School records, graduation certificates, resident registration numbers, tax payment records.
Sensitive information appeared on the screens of people who had no right to see it.
What was even more troubling was that the Ministry of the Interior and Safety reportedly became aware of the incident on April 1, 2024, but notified affected individuals only 11 to 22 days later.
Article 34(1) of the Personal Information Protection Act and Article 39(1) of its Enforcement Decree generally require notification to data subjects within 72 hours after becoming aware of a personal data leak.
The Personal Information Protection Commission later decided to impose an administrative surcharge of KRW 273 million and an administrative fine of KRW 7.5 million on the Ministry of the Interior and Safety.
This case shows that public institutions have the same responsibility to protect personal information as private companies.
But the matter should not stop there.
Administrative surcharges are sanctions against the administrative agency.
As the affected individual, I must separately exercise my own rights.
Today, I will summarize the administrative options that victims may consider when a public institution leaks their personal information.
How Is a Public Institution Leak Different From a Private Company Leak?
The response process may differ depending on whether personal information was leaked by a private company such as TVING or by a public institution such as Government24.
| Category | Private Company Leak | Public Institution Leak | |---|---|---| | Direct exercise of rights | Request access, deletion, etc. from the company | Request access, deletion, etc. from the relevant public institution | | Remedies and appeals | Dispute mediation, civil lawsuit, etc. | Administrative appeal may be considered depending on the disposition | | Administrative appeal cost | Not applicable | Free | | Main feature | Relationship between business operator and data subject | An administrative disposition or omission by a public agency may be at issue |
When the other party is a public institution, it is important to remember that, in addition to exercising rights under the Personal Information Protection Act, if the institution issues a refusal or similar response, an administrative remedy such as an administrative appeal may be considered.
Step 1 — You Can Request Access to How Your Information Was Processed
First, under Article 35 of the Personal Information Protection Act, you may request access to your own personal information held by the relevant institution.
Using the Government24 incident as an example, one possible step would be to ask the Ministry of the Interior and Safety or another relevant agency to confirm how your personal information is being processed.
If it is difficult to submit the request directly to the public institution, you may also use the personal information access request procedure through the Personal Information Portal.
The important point is not to end with a verbal inquiry only.
You should leave a written record of what information you requested and how the institution responded, because those records may be useful in later steps.
An administrative agent may, with the client’s authorization and within the scope permitted by applicable law, assist with preparing and submitting documents to administrative agencies.
Step 2 — You Can Request Deletion or Suspension of Processing
After reviewing the access results, you may consider requesting deletion or suspension of processing depending on the situation.
Article 36 of the Personal Information Protection Act provides rights concerning correction and deletion of personal information, while Article 37 provides the right to request suspension of processing.
However, there is an important exception.
If a public institution is required by law to retain or process certain information, the data subject cannot always demand deletion of that information.
In other words, even if you request:
My personal information was leaked, so please delete all information the government has about me.
that does not necessarily mean all information must be deleted.
You need to examine what type of personal information is involved, under what legal basis the institution holds it, and whether deletion or suspension of processing is legally possible.
Where necessary, support may also be considered for preparing requests for correction, deletion, or suspension of processing.
Step 3 — If the Public Institution Refuses, You May Consider an Administrative Appeal
If you request access, correction, deletion, or suspension of processing from a public institution and the institution refuses, it is necessary to consider whether that refusal qualifies as a disposition subject to administrative appeal.
Unlike administrative litigation, administrative appeal does not require a separate filing fee, and the procedure is relatively simple.
If you believe your rights or interests have been infringed by an administrative agency’s disposition, it may become an important remedy.
However, not every personal information dispute automatically qualifies for administrative appeal.
The key question is whether the institution’s response is merely guidance, or whether it legally qualifies as a disposition or omission that directly affects a citizen’s rights or obligations.
Administrative appeals also have filing deadlines.
Under the Administrative Appeals Act, as a general rule, an appeal must be filed within 90 days from the date you became aware of the disposition, and within 180 days from the date the disposition was made.
Therefore, if you receive a refusal notice, it is advisable to check not only the content of the notice but also the date you received it.
An administrative agent may assist in administrative appeal matters by preparing petitions, organizing facts, structuring evidence, and reviewing filing periods.
Step 4 — You May Also Consider Filing a Personal Information Infringement Report
If a personal information infringement has occurred, you may also consider filing a personal information infringement report.
You can use the Personal Information Portal online or call 118 without an area code to check consultation and reporting procedures related to personal information infringement.
The important point is that administrative appeals and personal information infringement reports serve different purposes.
An infringement report mainly seeks investigation, correction, and sanctions for violations of the Personal Information Protection Act, while an administrative appeal challenges the illegality or unfairness of a specific disposition made by a public institution against you.
Depending on the case, it may not be necessary to choose only one procedure. Different procedures with different purposes may be considered together.
What Should You Check First If Your Information Was Leaked?
If you receive a personal information leak notification from a public institution, it is advisable to check at least the following.
- What personal information was leaked?
- When did the institution learn of the leak?
- When did the institution notify me?
- How is the personal information currently being processed?
- Is there a need to request correction, deletion, or suspension of processing?
- If I already made a request to the institution, what response did I receive?
- If I received a refusal notice, when did I receive it?
- Has it been reviewed whether the matter is a disposition subject to administrative appeal?
In particular, if you are considering an administrative appeal, it is important to preserve the date you received the disposition notice and the actual contents of the notice.
A Fine Against the Institution Does Not Mean the Victim’s Problem Is Over
Even if an administrative surcharge or fine was imposed on the administrative agency in the Government24 personal data leak case, this does not mean that each victim’s individual rights have been restored.
Sanctions against the institution and individual remedies are separate matters.
If you want to confirm the scope of your leaked personal information, an access request may be necessary.
If incorrect information is being processed, correction or deletion may be considered.
If the processing of your personal information needs to stop, you may request suspension of processing.
And if a public institution unlawfully or unfairly refuses these requests, the possibility of an administrative appeal may also be reviewed.
In administrative procedures, records are ultimately critical.
When you were notified, what you requested, and why the institution refused can all affect later decisions.
Closing
The Government24 incident should not be viewed merely as a system error.
Public institutions hold large volumes of highly sensitive information directly connected to people’s lives, including resident registration numbers.
Therefore, when personal information is leaked, the important thing is not simply to read the news and check the amount of the fine.
You need to confirm what information of yours is involved, exercise the rights you need, and examine what remedies may be available if the institution refuses.
In particular, if a public institution refuses your request for access, correction, deletion, or suspension of processing of personal information, you should first check whether that response may qualify as a disposition subject to administrative appeal.
If you received a disposition or refusal notice from an administrative agency regarding personal information and do not know where to begin, the first step is to organize the notice and the institution’s response that you currently have.