“Even if there is a possibility of personal information leakage in the future, users must be informed of this.”
“In addition, a dispute resolution system for consumer damages will be introduced, and conditions for exemption for white-hat hacker activities will also be established.”
On the 28th, the government announced that it is promoting information protection measures containing these details, focusing on urgent short-term tasks.
First, to enhance user protection, the government will mandate notification to users even if there is a possibility of personal information leakage, even if no leakage has occurred.
Details concerning claims for damages will be added to the notification items.
The government will also introduce a dispute resolution system for consumer damages resulting from information protection breaches other than personal information leaks.
This system is expected to be implemented through an amendment to the Information and Communications Network Act within the year.
In addition, the government plans to develop security models by sector—such as infrastructure, services, and agents—in connection with AI and data security, and to officially operate an AI red team to check for AI vulnerabilities.
Moreover, regulations for inspecting related infrastructure and amending certification standards (ISMS) will be revised to encrypt important data held by state agencies and enterprises.
Institutional devices that allow companies to autonomously identify and improve vulnerabilities will also be prepared.
Standards for reporting procedures and exemption conditions will be established to allow companies to disclose issues and adopt and expand improvements through white-hat hackers.
Concurrently, measures to provide incentives to companies that actively strive to improve vulnerabilities will be pursued.
In addition, facing the digital and AI era this year, the government will also establish security policies for general products as most products and services include digital components.
The government stated, “It is expected that effects will be visible once the relevant legal amendments are implemented,” but also mentioned, “There is a need to address external criticisms such as insufficient actual compensation for consumers, the need for private incentives, and responses to environmental changes due to AI.”
(Photo provided by the Personal Information Protection Commission, Yonhap News)