The South Korean data protection authority conducted a comprehensive investigation into the practices of eight virtual mobile network operators, revealing systemic failures in security, retention periods, and lawfulness of data processing, notably of national identification numbers. This coordinated action highlights the risks inherent in rapid market growth at the expense of compliance with personal data protection.

Facts and context

The South Korean Personal Information Protection Commission (PIPC) published on November 12, 2026, a sanction decision against eight virtual mobile service providers, including administrative fines and penalties totaling 171,300,000 won (approximately €118,000) for breaches related to unlawful processing of national identification numbers, non-compliance with retention periods, and insufficient security measures.

The case originated from a PIPC-initiated investigation across the sector following concerns about the low level of data protection resulting from aggressive competition focused on acquiring new subscribers and market expansion.

Grounds for the decision

The authority identified several violations of the Personal Information Protection Act by the companies kt M mobile, MediaLog (U+ Umobile), S1 (Ansim Mobile), LG HelloVision (Hello Mobile), SK Telink (SK 7mobile), Unicoms (mobing), Kookmin Bank (KB Liiv M), and KT Skylife (skylife mobile).

• Processing identification data without legal basis: It was found that kt M mobile and Unicoms collected customers' resident registration numbers on their websites when selling SIM cards without legal grounds. Similarly, MediaLog collected this number when a user requested online that billing be made in the name of a third party, a practice also deemed unlawful.
• Failure to meet security obligations: Several operators, including SK Telink, LG HelloVision, kt M mobile, and MediaLog, stored sensitive personal data such as resident registration numbers, credit card numbers, and bank account numbers in clear text without any encryption. Additionally, KT Skylife and Unicoms did not retain records related to the management of user access rights to the processing system for the minimum required period of three years, while LG HelloVision failed to keep connection logs to the same system.
• Non-compliance with retention periods: The majority of operators inspected did not delete personal data once the retention period expired or the processing purpose was achieved, thus retaining information unduly.
• Non-compliant consent collection: The authority noted that optional consents, notably for providing data to third parties for additional services, were presented as mandatory consent elements. Consequently, customers could not activate or use their phone line if they refused to consent to these optional processes, thus compromising the freedom of their consent.
• Failure to supervise subcontractors: It was established that operators were negligent in managing and supervising their subcontractors, such as mobile network operators and sales points, who processed personal data on their behalf.

Authority's decision

Consequently, the authority imposed financial sanctions totaling 171,300,000 won (approximately €118,000) on the eight companies concerned. For the unlawful processing of resident registration numbers, kt M mobile was fined 13,700,000 won and MediaLog 47,200,000 won. Unicoms, although committing the same offense, was exempted from the administrative fine but received a penalty of 3,900,000 won.

Furthermore, the authority ordered the companies to take corrective measures to end the violations and mandated the publication of the sanctions. Recommendations were also issued for operators to define a minimal and necessary retention period for unsuccessful subscription records and to simplify the termination process so that it is as easy as subscription.

Lessons learned

This decision reminds that:

• The collection of a national identification number, even for verification or management processes, must imperatively be based on an explicit legal basis and cannot be justified solely by the operational necessity of the service.
• Sensitive personal data such as unique identifiers, credit card numbers, or bank details must be encrypted at rest and never stored in clear text in information systems.
• The service termination process must be as simple and accessible as the subscription process, so as not to create undue obstacles to individuals exercising their right to end data processing.