📌 3-Line Summary > - Leak notifications have legally mandated items. If what, when, and how much leaked isn't included, along with a reporting contact, you can demand it. > - "Reporting" comes in two forms. The report a business makes to the Personal Information Protection Commission, and the report a victim makes to the Personal Information Privacy Complaint Center are separate procedures. > - Don't just file a report and be done. You must include requests for deletion and processing suspension to actually stop the messages.
Table of Contents 1. A Question Started with a Text Message 2. Three Things Missing from the Notification 3. Distinguishing Two "Reports" 4. How Did the List Get Out? 5. Choosing What to Write on the Report 6. Why Include Deletion and Processing Suspension Together 7. The Reply Received Four Weeks Later 8. What to Do If You Received a Personal Information Leak Notification
I am an administrative agent (administrative scrivener) with an office located in Songdo, Yeonsu-gu, Incheon. I’d like to introduce an episode I encountered while working.
Inquiries regarding personal information used to primarily come from corporate representatives a few years ago. Nowadays, it’s the opposite. There are far more cases where victims ask, "Where and how should I report this?" This is largely due to the influence of changes in the system, but also because people are beginning to feel how far their information is spreading.
This case started the same way. It was an advertisement text message.
1. A Question Started with a Text Message The client was a woman in her early thirties with two elementary school children. The initial contact was via email, and it included four screen captures.
Three of the screen captures were advertisement messages. They were for learning materials, an English camp, and a cram school she had never heard of, with announcements for their seminars. All three messages accurately stated her children's names. Not just "○○ Mother," but "○○i Mother, 3rd Grade," including the grade level.
The remaining screen capture was of the notification sent by a local cram school that closed four months prior. Attached below two paragraphs announcing the closure was a single line stating that circumstances had been confirmed indicating the leakage of member information.
That single line was all there was.
She said she didn’t think much of the notification when she received it. Her attention was first drawn to the news that the cram school was closing, and the line below seemed like a formality. However, about two months later, the messages started coming. Initially, there were one or two messages per month, but recently, there have been three or four messages per week.
She had also tried it herself. She called the number listed in the message and asked where they obtained the number. The consultant only replied, "From affiliated companies," and wouldn't disclose which affiliated company. She blocked the number, but they came from another number. In the meantime, messages with her children's names increased.
The sentence she wrote at the end of the email was, "It’s fine that my number leaked, but I’m worried that my children’s names and grade levels keep circulating.”
2. Three Things Missing from the Notification The consultation appointment was scheduled for Friday afternoon of that week. Before that, I reviewed the notification.
The Personal Information Protection Act requires personal information processors to notify information subjects when personal information has been leaked. It also specifies in the law the items that must be included in that notification: the leaked items, the time and circumstances of the leak, how the information subject can minimize damage, the personal information processor’s response measures and damage relief procedures, and the contact information for the department and contact point where the victim can report or consult.
Three of these items were missing from the notification she received. They were what leaked, when and how it leaked, and where to report it.
This verification comes first because all subsequent documents will originate from here. Whether the leaked items are only the name and phone number, or whether it includes the address and school, will affect the content of the report. Without knowing the time of the leak, you can’t connect it to the messages that came later.
Therefore, the first document was designated as a demand for notification supplementation. It’s a short, businesslike document requesting that the missing items be filled in, as they were omitted from what the law mandates. It included the relevant statutory provision, listed the missing items by number, and specified a reply deadline.
There was a practical reason for sending this document first. If the business responds, the circumstances of the leak will be recorded in their words. If they don’t respond, the fact that they didn’t respond will itself be recorded. Either way, it can be used for the next step.
3. Distinguishing Two 'Reports' During Friday’s consultation, the first thing I clarified was the meaning of the word "report."
The information that person had found online was mixed up. Some articles said to report to the Personal Information Protection Commission, others said to go to the Personal Information Infringement Reporting Center. Still others said to file for dispute resolution. They were confused about whether these three things were the same or different.
They are different procedures. If you organize them in order, it’s like this:
- Report filed by the business operator: If there is an outflow of a certain scale or if sensitive information or unique identification information is included, the personal information processor is obligated to report to the Personal Information Protection Commission or a professional institution. This is the business operator’s obligation, not a procedure for the victim to follow.
- Report filed by the victim: If you believe your personal information rights or interests have been infringed, you can report to the Personal Information Infringement Reporting Center. Cases received will lead to investigation, corrective recommendations, and, if necessary, dispositions.
- Dispute resolution: This is a procedure for resolving disputes between parties, such as compensation for damages. If the other party is a "business operator" and the dispute is primarily financial, it falls into this area.
Our work is to draft and submit reports and petitions to administrative agencies. This case was about stopping the text messages and deleting the list, which fell into the former category.
I asked the person again about their purpose. The answer was clear: they didn't want money; they wanted the list containing their child’s name to disappear.
When the purpose is clear, the documents become clear too.
4. How Did the List Get Out? The following Tuesday, the business operator responded. It was faster than expected.
It was a short email sent by the person who had been in charge of running the academy during its closure. The content was that there was a circumstance where the account used for managing student information was left as is during the closure process, and the former employee who had access rights to that account downloaded the list and passed it on to somewhere else. The items that were leaked were the student’s name, grade, parent’s name, and parent’s mobile phone number. It is estimated that the leakage occurred within two weeks before the closure.
One thing caught my eye. Regardless of the closure, personal information must be destroyed without delay when the retention period expires or the purpose of processing is achieved. If the academy closed, there was no principle reason to continue holding student information. However, the list remained in the program.
In other words, this case had two layers. One was the leakage by an unauthorized person taking the list, and the other was the problem of managing information that should have been destroyed. We decided to separate these two in the report. If we wrote it as one lump, it would only be read as an "incident where an employee secretly took it," and the business operator would have an easy time avoiding responsibility.
And this reply email itself became an important piece of evidence. It contained the business operator’s account of the leakage circumstances, items, and timing. This is why I sent a supplementary notice request first.
5. Choosing What to Include in the Report The most time was spent not on refining the sentences in the report, but on choosing what to exclude.
The person had a lot to say. How annoying the text messages were, how disappointed they were with the academy, what their child said when they saw the text message with their name on it. All of this was true, but including it all in the report would blur the outline of the case. What the investigating party should see is not emotion, but the facts and violations.
Therefore, I organized it into three categories.
First, what, when, and how did the information leak? I copied the items, timing, and circumstances as written in the business operator’s reply and attached the email as evidence.
Second, what obligations were not met? I separately wrote about the omission of the legally required items in the leakage notification, the failure to destroy the information after closure, and the lack of access control management. Two or three sentences per item were sufficient.
Third, did the leakage actually result in consequences? This part was the most powerful in this case. The fact that advertising texts with the child’s name and grade came from multiple companies showed that the list had spread to more than one place. I created a table with the dates and times the person received the text messages. There were twenty-six messages over eight months.
The moment it was put into a table, it changed character. "The texts kept coming" becomes "twenty-six messages from eight different companies over eight months."
At that point, the person created a small commotion. While organizing the data, they accidentally deleted three text messages. There was a call when I realized it, and their voice was very tense. Fortunately, they were saved thanks to the telecom company’s text message storage function. After that, the person started taking screenshots and saving them separately whenever a new text arrived.
6. Why Both Deletion and Processing Suspension Were Included Will just submitting the application form stop the texts? No, it won’t.
While the application leads to investigation and correction, that process takes time. In the meantime, the lists remain within the sending systems of the companies. Therefore, in addition to the application, we decided to include both requests with the companies sending the texts.
The 「Personal Information Protection Act」 grants information subjects the right to request access to, correction/deletion of, and suspension of processing of their personal information. This right can be exercised not only against the entity that originally provided the information, but also against the entity currently holding and processing it.
- Right of Access: This allows you to confirm which items of your information and from where the company is holding it.
- Right of Deletion: This allows you to request deletion if there is no legitimate basis for retention.
- Right of Processing Suspension: Even before deletion, this allows you to request a halt to processing, such as sending advertisements.
There’s a reason for this order. If you only request deletion, the company will stall, saying "under review," while the texts continue to arrive. Including processing suspension provides a basis to stop the sending even during that period. Placing the right of access first forces the company to disclose where they obtained the list, and that disclosure provides clues to trace the distribution path.
We sent requests of the same format to eight companies, six of which had identifiable sender numbers. The content was the same, differing only in the company name and the history of received texts. For the remaining two companies, the sender number was an internet sending agency number, making it difficult to identify the business, and that fact was noted in the application.
We also provided additional guidance. These requests have established response deadlines, and if a company fails to respond or refuses, they must provide a reason. Therefore, we advised you to keep any responses you receive, as a failure to respond itself becomes subsequent evidence.
7. The Response Received Eight Weeks Later The first contact received after submitting the application was a request for clarification of the facts. We were asked to resubmit the period during which texts were received, the number of companies, and the original email response from the business. Thanks to the information being organized in a table, we were able to respond that same afternoon.
The responses from the companies were mixed. Four of the six reported completion of deletion. Two of them also provided where they had received the lists, and both pointed to the same name of a brokerage firm. One responded only that they “received it lawfully from an affiliated company.” The last company did not respond.
The fact that the same brokerage firm appeared twice was included as additional supporting documentation. This suggested that the lists may have spread from a single source rather than each company obtaining them independently.
The texts noticeably decreased approximately six weeks after the application. They hadn’t completely stopped, but the texts from the companies that had responded to the processing suspension request ceased, while the company that had not responded remained unchanged. A separate request was then sent to that company.
I remember what the person said during the last phone call. They said that while the texts hadn’t completely disappeared, they were now less afraid because they knew what to do when a text arrived. They could capture it, note the date, and send a request.
The results of administrative procedures are not always neat. However, the difference between knowing what happened and what you can do next, and not knowing, is significant.
8. If You Have Received a Personal Information Leak Notification ① First, confirm whether the notification contains all the legally required items. It should include the leaked items, the time and circumstances of the leak, the measures taken by the processor, procedures for relief, and reporting/consultation channels. If anything is missing, request that it be completed, as that response will become supporting documentation later.
② Distinguish which ‘report’ is being referred to. Differentiate between the report the business makes to the Personal Information Protection Commission and the report the victim makes to the Personal Information Privacy Violation Reporting Center. Monetary disputes for damages fall under the jurisdiction of dispute resolution or litigation.
③ Organize the facts of the incident in a table, not emotional terms. Creating a list of sender numbers, receipt dates, and personal information items contained in the texts transforms "it's annoying" into "twenty-six texts from eight companies over four months."
④ Include a request for access, deletion, and processing suspension along with the report. The list will not immediately stop spreading simply by filing a report. Including all three provides a basis to halt sending during the investigation period.
⑤ Do not discard responses; collect them. The fact that a company did not respond, or failed to provide a reason, is also documentation.
⑥ Even if a company has gone out of business, liability does not disappear. The principle of immediate disposal after the purpose of processing is complete applies even after business closure.
The procedures and reporting destinations that apply may vary depending on the scale and items of the leak, and the agency’s judgment may differ depending on the case. Confirmation with the relevant agency is required before application.
This article is reconstructed based on actual consultation cases and the individuals, business names, place names, and figures mentioned are unrelated to specific individuals or events.
