Exclusive
28 Local Government Regulations 'Virtually Illegal', Mandating Resident Registration Number Collection Without Legal Basis

[비즈한국] Amid a rising number of personal information leak incidents at public institutions every year, it has been confirmed that local governments are maintaining autonomous regulations that allow the collection of personal resident registration numbers without any legal basis. Since the resident registration number is a unique identification number used to specify an individual, and damage from leaks is difficult to repair, critics argue that these baseless collection regulations must be rectified.

According to data compiled by the Ministry of the Interior and Safety and obtained by the office of Representative Kim Young-man of the Democratic Party of Korea, who serves on the National Assembly's Public Administration and Security Committee, there are a total of 28 autonomous regulations as of June this year that mandate the collection of resident registration numbers without legal grounds. In 2017, the Ministry of the Interior and Safety counted 352 such autonomous regulations; 10 of those slated for revision at the time still remain. The other 18 cases were newly identified through legislative enactments or similar processes.

In Seoul, regulations lacking a legal basis for collecting resident registration numbers were identified in Dongjak-gu, Seocho-gu, and Yeongdeungpo-gu. Currently, the Seocho-gu Ordinance on the Payment of Rewards for Reporting Irregularities requires personal details such as the reporter's name, resident registration number, address, occupation, workplace, and contact information when processing reports of civil servant misconduct. Similarly, the security operation rules of Dongjak-gu and Yeongdeungpo-gu require the confirmation of the applicant's name, address, resident registration number, and affiliation/title when a request is made to disclose restricted geographic information.

Autonomous regulations that require the collection of resident registration numbers without legal grounds violate higher-level laws. Under the Personal Information Protection Act, a personal information controller cannot process unique identification numbers such as resident registration numbers, passport numbers, driver's license numbers, or foreign resident registration numbers unless the processing is specifically required or permitted by law. Autonomous regulations, which refer to ordinances and rules established by local governments for their own affairs, must be enacted within the scope of higher laws.

An official from the Ministry of the Interior and Safety's Election, Assembly, and Autonomous Regulation Division stated, "Autonomous regulations that stipulated personal information collection without a legal basis were selected as a revision task in 2017 and once pursued for reform, but I understand that follow-up management was not conducted. Now that we are aware that these relevant autonomous regulations still exist, we plan to select them as a future revision task and pursue them again."

Meanwhile, the number of public institutions that experienced personal information leak accidents this year has reached 62. According to the "Personal Information Leak Accident Report Status" data from the Personal Information Protection Commission obtained by Representative Kim Young-man's office, the number of public institutions experiencing leaks over the past five years has been hitting record highs annually: 11 institutions (74,000 cases) in 2020, 22 institutions (213,000 cases) in 2021, 23 institutions (648,000 cases) in 2022, 41 institutions (3.521 million cases) in 2023, and 62 institutions (188,000 cases) in the first half of 2024. Last year, 2.966 million pieces of personal information, including academic records, were leaked from the Gyeonggi Provincial Office of Education.

Representative Kim Young-man pointed out, "Autonomous regulations that collect resident registration numbers without legal grounds have yet to be rectified. Because personal information is difficult to restore once leaked, extreme caution must be exercised in handling it to prevent misuse. Constant management is needed, not just temporary revisions."