4.3Security-related Laws

SG tests not just the technical correctness of a control but also responses grounded in relevant law. Laws in this area are frequently revised, so it is important to remember current names and requirements accurately—in particular, note that the name once known as the Provider Liability Limitation Act has changed.

4.3.1The Personal Information Protection Act and the Unauthorized Access Prohibition Act

• The Act on the Protection of Personal Information requires businesses that handle personal information to specify and notify the purpose of use, implement safety-control measures, and restrict provision to third parties, among other obligations. If a breach of personal data occurs, under certain conditions the business is obligated to report it to the Personal Information Protection Commission and notify the affected individuals. When outsourcing the handling of personal data to a supplier, the outsourcing party is obligated to exercise necessary and appropriate supervision over the supplier.
• The Unauthorized Computer Access Prohibition Act bans unauthorized access—logging into an access-controlled system by using someone else's ID/password without authorization—as well as acts that facilitate it, such as illegally acquiring, storing, or providing to a third party an ID/password. Importantly, the act is illegal at the point access control is bypassed and login succeeds, even if no actual damage has occurred yet.