Naver unveils privacy tool after users' data leak

Naver has introduced a new “My Data Management Tool” after a data exposure involving about 15,067 users’ activity histories on Knowledge iN.

The breach happened when a profile link was mistakenly connected to Naver’s People Information Service, making user activity records publicly accessible from 3 p.m. on February 3.

Naver disabled the feature at 10:20 p.m. on February 4 and notified affected users by text and email.

The company also allowed users to check their exposure status through inquiries.

The new Privacy Center lets users request suspension of personal data processing and withdraw consent for third-party sharing.

The Rights Protection Center supports reports of privacy violations and requests to remove exposed content, excluding posts written by users.

Naver CEO Choi Soo-yeon reported the incident to the Personal Information Protection Commission and pledged full cooperation with the investigation.

🔗 Source: Chosunbiz

🧠 Food for thought

Implications, context, and why it matters.

Naver’s response is shaped by a high-stakes regulatory climate

Naver moved quickly after 15,067 users’ activity histories on Knowledge iN were exposed, since South Korean regulators can issue steep penalties.
Louis Vuitton and Christian Dior’s local units received combined fines of KRW 33.621 billion (about $25 million) after leaks tied to basic security failures while using a software-as-a-service (SaaS) customer management tool affected about 5.55 million people 1.
E-commerce giant Coupang faces a potential fine exceeding $1 billion after a breach exposed data from about 33.67 million users, plus a police raid of its headquarters 2, 3.
The ceo reported the incident to the Personal Information Protection Commission (PIPC), South Korea’s national privacy regulator, as regulators push “effective sanctions” to deter corporate negligence 4.

South Korea’s data breach crackdown raises the stakes for companies using third-party software

Recent enforcement adds new compliance duties for companies that rely on third-party software in South Korea.
Regulators held luxury brands responsible for leaks from a SaaS platform, since using such services does not shift a company’s legal duty to protect data 5.
This approach puts pressure on global SaaS providers to offer strong, configurable protections, since regulators want controls like IP-based access restrictions and strong authentication for remote access when companies use SaaS to process personal data 1.
Amendments passed by South Korea’s National Assembly allow administrative fines of up to 10% of total revenue in some high-severity breach cases, effective six months after enactment, making the risk comparable to Europe’s General Data Protection Regulation (GDPR) in the most severe cases 6.