Victims' personal information exposed after requesting footage deletion... Government damage figures also 'vary widely'

[Financial News] Personal information and details of harm submitted to Google by victims seeking the deletion of illegally filmed content were exposed on an external website. The government was found not to have even determined the exact scale of the damage. Each relevant agency used different criteria and reported different damage figures, while gaps also emerged in information sharing and follow-up verification among the agencies.
The findings came from an analysis released on the 20th by Lee Hoon-gi, a lawmaker from the Democratic Party of Korea and a member of the National Assembly's Science, Technology, Information, Broadcasting and Communications Committee. Lee's office examined materials submitted by the Korea Media and Communications Commission (KMCC), the Korea Communications Standards Commission (KCSC), the Ministry of Gender Equality and Family, and Google.
Google has provided information related to requests to remove online posts to Company A, an external research database, since 2002. The issue came to light on Aug. 12, when the Ministry of Gender Equality and Family discovered that the consent process for providing deletion-request information to Company A had disappeared.
The Ministry of Gender Equality and Family had asked Google to remove posts to prevent the distribution of illegally filmed content. After the consent process disappeared, some deletion-request records were provided to Company A's website. The site was found to have exposed personal information that could identify the victims. The Ministry of Gender Equality and Family asked Google to remove the relevant posts on Aug. 25.
The problem was that the relevant agencies had failed to assess the scale of the damage using a unified standard. The KMCC, which oversees and supervises platform operators; the KCSC, which reviews and blocks related information; and the Ministry of Gender Equality and Family, which protects victims of illegally filmed content and supports its removal, each reported different figures.
In response to a data request from Lee's office, the KMCC said, "It does not possess any data whatsoever on the scale of the damage or the exposed information." The KCSC identified 22 posts and 13 victims, while the Ministry of Gender Equality and Family counted more than 10 cases. Google reported 37 cases.
The agencies also used different units of measurement, including posts, victims, and reports, leaving no integrated data that would provide an overview of the total damage. The government was likewise found not to have determined whether the exposed information had been viewed, downloaded or copied externally, or redistributed to other websites—in other words, whether secondary harm had occurred.
Although public awareness of digital sex crimes rose after the 2019 Nth Room case, the episode has renewed criticism that the relevant agencies have still failed, seven years later, to establish even a common standard for measuring the scale of the damage.
Information was not shared among the agencies in a timely manner. The Ministry of Gender Equality and Family confirmed on Aug. 12 that the user-consent process for deletion-request information had disappeared and suspended deletion requests through Google. The KMCC also received information about the situation from the Ministry of Gender Equality and Family that same day.
By contrast, the KCSC, which reviews and blocks the URLs where the actual victim information was exposed, was not informed of the situation until Aug. 26, 14 days later. The KCSC subsequently launched emergency reviews of 18 URLs containing exposed victim information.
Gaps also emerged in the follow-up verification process. The KMCC said it confirmed through Google on Sept. 4 that the problematic posts had been completely deleted. However, Google was found to have received three additional reports and deleted more posts two days later, on Sept. 6. Controversy is expected over whether the scope of the government's confirmation of 'complete deletion' and its verification procedures were sufficient.
In June, the government also launched a pan-government consultative body on digital sex crimes covering the entire process, from prevention and investigation to blocking content and supporting victims. However, the latest incident showed that information sharing and damage assessment among the relevant agencies had not been unified.
Lee Hoon-gi said, "The fact that the personal information and details of harm submitted in desperation by victims suffering from illegally filmed content were exposed again is a serious incident in which a victim-redress procedure was turned into a channel for secondary victimization. A thorough investigation is needed to determine whether Google, which has an obligation to prevent the distribution of illegally filmed content, violated any laws in its personal-information protection measures or response process."
[email protected] Yoon Hong-jip Reporter