Eight MVNOs stored resident registration and card numbers without encryption; face fines

[Financial News] It has emerged that major MVNO operators violated the Personal Information Protection Act by storing key personal information, such as subscribers’ resident registration numbers and credit card numbers, without encryption, or retaining unnecessary personal information for extended periods.
Some operators were found to have made it impossible to activate an MVNO service unless customers consented to the provision of optional personal information.
The Personal Information Protection Commission said it held a plenary meeting on the 11th and imposed a total of 60.9 million won in surcharges and 110.4 million won in administrative fines on eight MVNO operators that violated the Personal Information Protection Act.
The eight companies subject to sanctions are KT M Mobile, MediaLog, S1, LG HelloVision, SK telink, Unicomz, KB Kookmin Bank and KT Skylife.
The PIPC explained that, following concerns that privacy protections were inadequate because the MVNO industry as a whole had focused on excessive competition to attract subscribers and expanding its market footprint, investigations of eight MVNO providers had uncovered violations of the law.


The PIPC’s investigation found that KT M Mobile and Unicomz collected resident registration numbers without a legal basis while selling SIM card products on their websites. MediaLog was also found to have collected resident registration numbers while changing the person responsible for paying telecom bills to a third party.
Cases of sensitive information being left unencrypted were also uncovered. SK telink, LG HelloVision, KT M Mobile and MediaLog stored resident registration numbers, credit card numbers and account numbers in plaintext.
KT Skylife and Unicomz did not retain records of access-rights management for their personal information processing systems for the legally required period of three years. LG HelloVision had inadequate management of access logs for its personal information processing system.
Most operators were found not to have destroyed personal information in a timely manner after its retention period had expired or its processing purpose had ended. There were also cases in which optional consent items were made mandatory, making it impossible to sign up or use services without consent.
The PIPC imposed surcharges of 13.7 million won on KT M Mobile and 47.2 million won on MediaLog for processing resident registration numbers without a legal basis. Unicomz was eligible for exemption from surcharges but was fined 3.9 million won for the same violation.
The PIPC urged compliance with the obligation to implement security measures, saying, “Because MVNO services process unique identifying information and payment information during signup and activation, a leak could lead to secondary harm, such as identity theft.”

[email protected] Lee Gu-sun Reporter