JIPYONG LLC

Jipyong News|Column

Each Nation’s ID Protection Plan

2009.07.15

What is the 13 digit number, a number that the cartoon character "Dooly" and the Robot Tae Kwon V has? What is the number that every Korean citizen has? It is the Resident Registration Number. The number that is given to every citizen in the world is called a National ID. This National ID has become a target of ID theft in many countries. For this reason, each nation has declared war against ID theft, putting a great deal of effort into protecting the National Identification Number. 
 
In the United States, citizens do not have a Resident Registration Number as in Korea. However, since the use of the Social Security Number ("SSN") from 1936, the SSN has been distributed to and is currently functioning as de facto national ID of 227 million U.S. citizens. Although the SNN was implemented for social security purposes, there is no doubt, it is currently being used as a personal identification number for various purposes such as opening of accounts, issuance of credit cards, and other various transactions. The SNN also functions as a password for authentification. For these reasons, the SNN is also known as the "key to the kingdom," and has become a target for ID theft. According to a professional research agency report, around 8.4 million people in the U.S. have been damaged due to ID theft in only one year, 2007, and the damage amount was estimated to exceed 4.93 billion dollars. 
 
In May 2006, President Bush placed an agency under the president called the "President's Identity Theft Task Force" ("PITTF") for ID Theft control. PITTF, putting a great emphasis on SSN protection, published the 31 Strategic Plan in April 2007 and published recommendations on using the SNN in the civil sector on December 2008. It addressed issues such as restricting use of SSN, restricting public display and internet transmission of SSN, coming up with a national standard for SSN protection, and strengthening the notification system should there be a leak or violation of such information, as well as educating consumers and businesses. For the past several years each state and federal district has been diligently preparing the legislation addressing these issues. It is also noteworthy that the first bill passed in the U.S. 111th National Assembly after the inauguration of President Obama was the legislation concerning the protection of the SSN. However the conclusive view is that this is not enough. In order to restrict the use of the SSN, the strongest view is that we must list each specific case for authorizing the use of the SSN as in Canada or Australia. The petition that the Positive List should be adopted is gaining greater support. 
 
In Canada, no citizen has a personal identification number because the Social Insurance Number ("SIN") which was issued since 1964 has been de facto used as an Identification Number, just like in the United States. ID theft is also a huge problem with almost 2 billion dollars estimated in damage costs. Hence in Canada, the limited cases of authorized use of the SIN are stipulated by law, and a Positive List is in place so that the SIN may not be used unless permitted by law. The cases listed as authorized use of the identification number are limited to applying for pension, senior insurance or unemployment insurance, sale of financial products that accrue interests, receiving veteran soldier benefits, student loans or student financial aid. The Canada Privacy Commission has also issued a corrective measure so that the mobile-phone operators cannot refuse the application solely because the customer did not provide the SIN. Canada has implemented much stronger SIN protection than the United States. 
 
In Australia, there are no identification numbers that are compulsory. However there is the Medicare Care Number in the medical field and the Tax Filing Number related to taxes, which are both strictly regulated in similar ways as the Positive List in Canada. 
 
Likewise, since the identification number is becoming more and more a target for ID Theft, countries worldwide have been restricting its use, and have enacted diverse plans for its protection. 
 
How about Korea? Although it may not be leveled with Canadian or Australian regulations, the careful use of Resident Registration Number has been regulated by law and the scope of protection is continuously expanding. The Act on Promotion of Information and Communications Network Utilization and Information Protection in Korea requires the Resident Registration Number to be coded when being filed. It also requires establishing a secure server in case of transmitting or receiving the number through the information and communications network. In addition, a business that prefers an alternative method of identification other than the Resident Registration Number such alternative method must be provided to the business. This will enable a reduction in the use of the Resident Registration Number. These duties apply to information technology service providers, education institutes, airlines, hotels, gas stations, hospitals, real estate agents, etc. If businesses uphold all these duties, the cost is formidable. Also should the Resident Registration Number ever be leaked, the business will be responsible for a huge amount of damage. Hence, it is better for the business to gather identification numbers as few as possible. 
 
The problem in Korea is that businesses have been customarily gathering customer's Resident Registration Numbers. For example, the most popular Twitter or U-Tube services do not ask for one's identification number for registration, whereas according to the 2007 Korean Consumer Agency Survey, 91.9% of Korea's main websites do. Businesses consider Resident Registration Number as "useful information" when they collect it, however they must face the reality that the gathered identification numbers will become more and more of a burden to them. Furthermore, we must remember that users dislike businesses that ask for identification numbers. According to a study conducted in 2003, 75% of users in Korea chose the Resident Registration Number as the #1 information they are most reluctant to give away. 
 
However, the Real-Name System in Korea has left businesses caught between a rock and a hard place. In order to operate a website where the users can leave their own comments, one must undergo a real name verification process. There are 153 such websites and almost all of the main internet websites fall under this category. Such businesses have to bite the bullet and conduct this verification process through the Resident Registration Number or some alternative method, keep on file the gathered information for 6 months after coding them, and must be very, very careful in handling the information. 
 
Where other countries are restricting the use of identification numbers, we can only say that the Internet Real-Name System, is a step going backwards. As long as this system is enforced, internet users and businesses will always be at risk of personal information exposure. The Real-Name System must be abolished and groundbreaking legislation similar to that of Canada and Australia limiting the use of identification numbers is indeed advisable.

Back to List

Related Practices

Intellectual Property

Related Practices

SHARE

Disclaimer

Limited Liabilities