Personal Information Protection Commission (PPC) and the Act on the Protection of Personal Information

The Personal Information Protection Commission is an independent government body set up in January 2016, with a chair and eight members. Under the Act on the Protection of Personal Information and related laws, it oversees not only companies but also national ministries and local governments. It can give guidance and advice, ask for reports, inspect premises and, if the law is broken, issue recommendations or orders. [1]

An organization must report a leak, or a possible leak, of personal information to the commission when any of the following applies. [2]

• It includes especially sensitive information, such as medical history, health check results or criminal records [2]
• Misuse could cost people money, as with card numbers or the IDs and passwords of services that can send or pay money [2]
• It may have been done on purpose to cause harm, as with unauthorized access, ransomware or staff taking data out [2]
• It affects more than 1,000 people (more than 100 for ministries, local governments and other public bodies) [2]

Reporting has two steps: a first report within three to five days of finding out, then a full report within 30 days (60 days when it may have been done on purpose). In some industries the report goes to the ministry the commission has handed this power to, which passes it on to the commission. [2]

How to report, and the forms to use, are on the commission's website. [2]

For many incidents on this site, the text notes the report to the commission that the organization's notice mentions. A report is a legal step, and does not by itself tell how serious the harm was.