1. Reason for revision
Since smartphones are now used by the general public as the main means of communication, information transmission, and monetary transactions, it is very important for them opened and utilized safely from the subscription stage. However, social problems are occurring continuously due to the security vulnerabilities of some budget phone companies, including the illegal opening of smartphone accounts in other persons' names, and voice phishing crimes.
In response, this revision aims to enhance the security capabilities of budget phone companies and the safety of the information and telecommunication networks by mandating the certification of their information protection management systems and improving the system to require them to designate and report a Chief Information Security Officer (CISO).
2. Main contents
a. The operators of budget phone services are included among those who are legally required to designate and report a CISO (Newly established at the end of Article 36-7 (2)).
◌ The revision excludes the operators of budget phone services from the existing exclusion list of those who are exempt from reporting a CISO in order to make them subject to the obligation to designate and report a CISO.
b. Clarification of the definition of “major provider of information and telecommunications services” (Article 49 (1) 1)
◌ As the definition of “major provider of information and telecommunications services” in the current statute is unclear, it can be interpreted to include other entities. It is now defined to mean those operators that have installed and are in possession of telecommunications lines and equipment pursuant to Subparagraph 3 of Article 2 of the Telecommunications Business Act so as to limit the targets to those to whom the current provision can be applied.
c. Inclusion of budget phone service operators among those who are obliged to certify their information protection management system
◌ The revision aims to include the operators of budget phone services among those who are required to have their information protection management system certified under the Telecommunications Business Act.
