How should we respond if we discover a personal information law violation?

If personal information is leaked from a game company, serious legal liability may arise under the Personal Information Protection Act.

First, personal information law violations are largely classified into "unauthorized collection," "unauthorized use," and "leakage and disclosure," and when users' personal information is leaked externally, it is regarded as a serious violation.

Once personal information leakage is confirmed, imprisonment of up to 5 years or a fine of up to 50 million won may be imposed under Articles 59(3) and 71 of the Personal Information Protection Act.

In addition, administrative dispositions and civil damages liability may also arise, making this a serious risk for the company.

If you become aware of personal information leakage, you must immediately report it to the Personal Information Protection Commission or the Korea Communications Commission, and you must notify users of the leakage and response status without delay.

If the leaked information is sensitive information, stricter reporting and notification obligations may apply.

In addition to the response, you must strictly operate internal control systems such as personal information access authority management, regular security checks and education reinforcement to prevent secondary damage.

When a personal information law violation incident occurs, you must establish a rapid response process and identify and improve problems through digital forensic investigation and cause analysis.

In conclusion, for game companies, strictly complying with the Personal Information Protection Act and responding rapidly and transparently when personal information law violation incidents such as leakage occur is the key to minimizing legal and trust damage.