Destruction of Personal Information

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.4.1 Destruction of Personal Information], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

Internal policies related to the retention period and destruction of personal information shall be established including the following matters.

• By collected item, by collection purpose, and by collection channel: storage location (databases, backup data, etc.), destruction method, destruction point, legal basis, etc.
• Public institutions shall establish and implement a personal information destruction plan reflecting the retention period, processing purpose, etc. of the personal information file, and the personal information destruction plan may be included in the internal management plan (Standard Personal Information Protection Guidelines Article 55(2))

When the processing purpose of personal information has been achieved or the retention period has elapsed, the relevant personal information shall be destroyed without delay.

• When the personal information becomes unnecessary, such as achievement of the processing purpose, abolition of the relevant service, termination of the business, or elapse of the retention period under laws and regulations, the personal information shall be destroyed within 5 days from that time unless there is a justifiable reason

  ※ Cases where the purpose of collecting and using personal information has been achieved (examples)

  • When the data subject withdraws membership from a website
  • When the data subject cancels a high-speed internet service
  • When the data subject requests withdrawal from mileage membership
  • When an event collecting personal information has ended
  • When the telemarketing (TM) work of a third-party company has ended after providing information to that company for telemarketing purposes, etc.

When destroying personal information, it shall be destroyed in a safe manner so that it cannot be recovered or reproduced. Here, a method by which restoration is impossible means a method of taking measures so that the restoration of the destroyed personal information is impossible at a socially acceptable reasonable cost given the current level of technology.

• Complete destruction (incineration/shredding, etc.)

• Deletion using dedicated demagnetizing equipment (equipment that deletes data on a storage device using a magnetic field)

• Performing initialization or overwriting so that data cannot be restored

  ※ Destruction methods (examples)

  • Complete destruction : Destroying paper documents such as membership application forms containing personal information, or hard disks or magnetic tapes, by shredding, dissolving, or burning them in an incinerator or incineration facility, etc.
  • When using dedicated demagnetizing equipment : Deleting personal information stored on hard disks or magnetic tapes using a degausser, etc.
  • When performing initialization or overwriting so that data cannot be restored : Using methods such as a full format (3 or more times recommended) of the hard disk storing personal information, overwriting the data area with random values, 0s, 1s, etc. (3 or more times recommended), or storing the relevant drive encrypted with a secure algorithm and key length and then deleting it, followed by complete disposal of the key used for encryption and overwriting with random values, etc.

• When destroying only part of the personal information and it is difficult to destroy by the above methods, the following measures shall be implemented

  1. In the case of an electronic file form : After deleting the personal information, manage and supervise it so that it cannot be recovered or reproduced
  2. In the case of records, printed materials, documents, or other recording media other than an electronic file form : Delete the relevant part by masking, punching holes, etc.

• When it is significantly difficult to destroy by the above methods due to technical characteristics, take measures so that restoration is impossible by processing the information as information falling under Article 58-2 of the Act (anonymized processing)

Records of the destruction of personal information shall be kept and managed.

• The implementation of the destruction of personal information and the confirmation of the destruction results shall be carried out under the responsibility of the Chief Privacy Officer, and matters concerning destruction shall be recorded/managed
• Records of the destruction of personal information shall be recorded in a destruction management ledger, or photographs, etc. documenting the destruction shall be kept as records
• When a public institution destroys a personal information file, it shall confirm the destruction results and prepare a personal information file destruction management ledger (Standard Personal Information Protection Guidelines Article 55)