Eight budget mobile operators were found to have violated South Korea's Personal Information Protection Act by collecting resident registration numbers without legal grounds or failing to encrypt key personal data, among other breaches.

The Personal Information Protection Commission said on Wednesday it decided at its 22nd plenary meeting on Nov. 11 to impose 60.9 million won in penalty surcharges and 110.4 million won in fines on the eight operators, and to issue corrective and public disclosure orders.

The sanctioned companies are KT M Mobile, MediaLog, S1, LG HelloVision, SK Telink, Unicoms, KB Kookmin Bank and KT Skylife.

The probe was launched after criticism that the industry had focused on competing for subscribers while making insufficient efforts to protect personal data. The commission inspected personal data handling across the full process from sign-up and activation to service use and cancellation.

Some operators were found to have collected resident registration numbers without legal grounds. KT M Mobile and Unicoms collected resident registration numbers while selling USIM products on their websites. MediaLog collected resident registration numbers while processing requests during online sign-up and activation to change the bill payer from the line holder to a third party.

The commission imposed penalty surcharges of 13.7 million won on KT M Mobile and 47.2 million won on MediaLog. Unicoms was deemed exempt after the surcharge calculation and was fined 3.9 million won instead.

There were also cases in which key personal data were not encrypted. SK Telink, LG HelloVision, KT M Mobile and MediaLog stored resident registration numbers, credit card numbers and account numbers in plain text without encryption.

KT Skylife and Unicoms did not keep records of access-rights management by handlers of personal data processing systems for the legally required retention period of 3 years. LG HelloVision was found to have been lax in meeting its duty to manage access logs for personal data processing systems.

The commission imposed fines for the violations and issued corrective and public disclosure orders to prevent recurrence.

The retention period for applications that were not fully activated was also cited as an area for improvement. Operators were keeping cancelled, rejected or pending subscription applications for differing periods ranging from at least 5 days to as long as 1 year. The commission instructed them to establish internal standards to set retention periods to the minimum necessary.

The commission also recommended procedural improvements for operators that allow sign-ups online but handle cancellations only through in-person agency visits or via customer-service agents.

According to Ministry of Science and ICT statistics, as of August this year budget mobile subscription lines totalled about 10.5 million, accounting for about 18 percent of all mobile phone lines. The commission pointed out that because important personal data such as resident registration numbers and payment information are processed during sign-up and activation, any leakage could lead to secondary harm such as identity theft.