"A card company personal information leakage crisis response"

A card company commissioned a large-scale project, and a PM belonging to one of the entrusted companies leaked a large amount of personal credit information. Immediately after identifying the facts through a prosecutor’s office search and seizure, A company established a crisis response situation room, and lawyers resided there, providing real-time responses.

In addition to the prosecutor’s office investigation, lawyers also responded in real-time while residing in the company throughout the two-month investigation by the financial authorities. Documents submitted during the prosecutor’s office investigation and the financial authorities' investigation could adversely affect subsequent civil lawsuits, so they thoroughly reviewed apology statements to customers and various documents from a legal perspective to maximize efforts to minimize risks to the company.

(Tip) As seen in recent rulings, courts consider ‘the company’s response immediately after the incident’ as an important factor when determining the amount of damages or whether to award damages. Also, the ‘Personal Information Protection Act,’ ‘Act on Promotion of Information and Communications Network Utilization and Protection of Information,’ and ‘Act on the Use and Protection of Credit Information’ all introduce statutory damages and punitive damages systems, explicitly stipulating “the degree of relief efforts” as a mandatory consideration when calculating damages. Considering these points, it is necessary to prepare crisis response policies/guidelines/procedures with personal information protection crisis response experts, identify vulnerabilities through rehearsals, and in the event of an actual crisis such as a personal information leak, it has become more important than ever to respond quickly based on preparations made in advance.

Thank you.

Law firm Veat