[Alpha Biz= Kim Jisun] LG Uplus is facing scrutiny after a parliamentary research body concluded that its use of phone numbers within IMSI (International Mobile Subscriber Identity) may violate South Korea’s personal data protection laws.

According to a report cited on April 14 by the office of Rep. Kim Jang-gyeom of the People Power Party, the National Assembly Research Service stated that while IMSI alone may not directly identify an individual, “if the structure allows identification of a phone number—as in the LG Uplus case—it is highly likely to be considered personal information under the Personal Information Protection Act.”

IMSI is a unique identifier used to authenticate subscribers on mobile networks. Typically, telecom operators incorporate randomization into IMSI structures for security. However, LG Uplus has used mobile phone numbers directly in its IMSI system since 2011, raising concerns over potential vulnerabilities. The company is currently conducting free USIM replacements and system updates for all subscribers as part of efforts to overhaul the system.

The research service noted that LG Uplus’ IMSI structure “could be evaluated as a failure to adequately fulfill obligations to implement necessary security measures under the Personal Information Protection Act.” If violations are confirmed, the company could face fines of up to KRW 30 million.

The Personal Information Protection Commission also indicated that legal precedents recognizing IMEI (device identifiers) as personal data could similarly apply to IMSI.

Rep. Kim criticized the company, stating that LG Uplus is attempting to evade responsibility under the guise of “security concerns,” and accused it of misleading customers by presenting measures such as free USIM replacements as goodwill gestures. He urged the company to disclose relevant information transparently and called on authorities to thoroughly investigate and take strict action if violations are confirmed.

 

 

 

[ⓒ 알파경제. 무단전재-재배포 금지]