Seoul: A state-run child rights agency has been hit with record penalties for leaking more than 1.17 million pieces of personal information, including those of missing children and adoptees, and failing to report the breach, the state data protection watchdog said Thursday.

According to Yonhap News Agency, the Personal Information Protection Commission (PIPC) decided to impose a penalty of 863 million won (US$625,000) and a fine of 22.2 million won on the National Center for the Rights of the Child (NCRC) during a plenary meeting Wednesday for violating the Personal Information Protection Act. This marks the largest penalty ever imposed on a public institution.

The watchdog also urged the health ministry, which oversees the NCRC, to strengthen its guidance and supervision of the agency. From 2013 to 2022, the NCRC undertook a computerization project to convert adoption records and missing child intake cards into Excel files and scanned documents. During this process, the contractor provided the digitized data to the NCRC on removable storage media, including external hard drives, USB flash drives, and CDs.

The NCRC belatedly discovered that the storage media had gone missing while conducting an internal inspection into allegations of mismanagement in the adoption record computerization project. As a result, 1.17 million pieces of personal information were exposed, including the resident registration numbers of about 300,000 adopted children and 15,000 missing children.

The PIPC noted that a separate personal information breach also occurred in the NCRC's adoption information disclosure request system, involving the personal information of 47 people, including 37 adoptees and 10 prospective adoptive parents.