If a violation of the Personal Information Protection Act is discovered, how should one respond?

If personal information is leaked at a game company, serious legal liability may arise under the Personal Information Protection Act.

First, violations of the Personal Information Protection Act are broadly classified into 'unauthorized collection,' 'unauthorized use,' and 'leakage and disclosure,' and when a user's personal information is leaked externally, it is regarded as a serious violation.

If a leak of personal information is confirmed, under Article 59, Item 3 and Article 71 of the Personal Information Protection Act, imprisonment of up to five years or a fine of up to 50 million won may be imposed.

In addition, administrative dispositions and civil liability for damages may also arise together, so this is inevitably a serious risk from the company's perspective.

If you become aware of a personal information leak, you must promptly report it to the Personal Information Protection Commission or the Korea Communications Commission, and you must notify users of the leak and the status of the response without delay.

If the leaked information is sensitive information, stricter reporting and notification obligations may apply.

In addition to responding, you must strictly operate internal control systems, such as managing access rights to personal information and strengthening regular security inspections and training, in order to prevent secondary harm.

When an incident involving a violation of the Personal Information Protection Act occurs, you should establish a prompt response process and improve the problems through digital forensic investigation and root cause analysis.

Ultimately, for a game company, thoroughly complying with the Personal Information Protection Act and responding promptly and transparently when an incident involving a violation of the Act, such as a leak, occurs is the key to minimizing legal and reputational harm.