The recurring personal data breaches in recent times can no longer be dismissed as mere accidents. From major telecom companies and e-commerce firms to financial institutions and web portals, hacking and data theft continue unabated, with personal information including resident registration numbers and contact details of tens of millions of people being leaked repeatedly. The government has classified this as a national crisis and announced record-breaking fines and sanctions against responsible parties such as SK Telecom, KT, and Coupang. The message is clear: companies will be held strictly accountable for negligent security investment and poor management.
But is our government applying the same standards to itself on personal data protection? The government imposes strict protection obligations and management responsibilities on private companies. However, we must ask whether these regulations and administrative standards are forcing private institutions to collect, store, and distribute excessive personal information.
This question arises from the administrative procedures we encounter in daily life. I myself have repeatedly experienced this whenever I receive small honorariums from other universities or institutions for external activities. For instance, regardless of the amount of a paper review fee, institutions invariably require submission of resident registration numbers, home addresses, mobile phone numbers, emails, bank account numbers, and consent forms for personal information use. The scope of information demanded is excessive, the procedures are cumbersome, and each time I feel anxious about how my personal data is being managed.
When I ask administrators why, they simply respond that "government reporting and tax systems are centered on resident registration numbers, so there is no alternative." However, in situations where resident registration numbers alone would suffice for tax reporting, the practice of repeatedly demanding personal addresses, contact information, and bank account numbers is excessive. Public institutions accumulate more personal information than necessary, systematically expanding the risk of data breaches. Despite this routine collection of personal data by government and public institutions, there is no basis to conclude that public sector security levels are higher than those of private companies. Nevertheless, cases where public institutions are held as heavily accountable for data breaches as private companies are rare.
The government's personal data collection practices are more a matter of legal and institutional problems than technical limitations. The National Tax Service can already access most income and account information, and tax reporting is fully possible with minimal information. Now that the MyData system has spread, the rationale for individuals repeatedly submitting their full resident registration numbers to each institution is losing credibility. If Korea transitions to "submit once" administration like Finland, Denmark, or Estonia, personal data submissions could be significantly reduced. Yet in Korea, reforming administrative procedures is still considered inconvenient, and momentum for change is not being generated.
This issue cannot be dismissed as mere administrative inefficiency. Personal data protection is not a matter of technology or security, but of power and administrative methods. Citizens must submit extensive personal information to access various administrative services, and the state accepts this as a matter of course. This shows that the longstanding relationship—where the state remains the subject that manages and controls data while citizens are positioned as objects who provide it—persists unchanged in the digital age. Today, when personal data has become a core resource constituting individual identity and life trajectories, how data is collected and managed is directly connected not just to administrative efficiency but to democratic trust.
Ultimately, raising Korea's level of personal data protection cannot be achieved through corporate sanctions alone. The government must thoroughly apply the principle of data minimization starting with its own administration, gradually dismantle the outdated structure centered on resident registration numbers, and transition to payment and settlement methods where public institutions do not retain personal information. Institutional mechanisms must also be strengthened to impose far stricter accountability for personal data breaches in the public sector than currently exists.
In a country where individuals must submit their full resident registration numbers to receive 20,000 won in miscellaneous income, personal data protection has not yet reached the starting line. Administration in the digital age must begin with the responsibility to protect information rather than demanding it from citizens. To this end, the government needs to comprehensively re-examine all personal data-related administration from the principle of "minimum data collection" and apply those standards to the private sector as well.
