Group cloud migration and a ransomware incident affecting health data
Cheongsol Life's Seoul branch is migrating policy administration to the group's cloud platform hosted in Singapore and Virginia. The dataset covers 1.3 million policyholders, including 420,000 records containing health and medical information from claims. The group data protection officer says the group's binding corporate rules and the head office's standard contractual clauses are sufficient, and that no customer contact is required. The branch's privacy notice mentions 'processing within the group' but does not state destination countries or retention periods. On 3 June a ransomware incident encrypts a claims batch and a backup, affecting an estimated 60,000 records. The branch's incident playbook is a one-page head office template. The local CEO wants to wait until the forensic report is final, expected in three weeks, before notifying anyone, in order to 'avoid panic and premature conclusions'.
1. Analyse the legal basis for the cross-border transfer and what must be fixed before or immediately after go-live.
Read the worked answer
Binding corporate rules and standard contractual clauses do not answer the Korean question. They are transfer mechanisms recognised in other regimes. Under the Personal Information Protection Act a cross-border transfer still needs a recognised local basis, in practice specific and separate consent, together with disclosure of the recipient, destination country, purpose, data items, retention period, and how the data subject may refuse and what follows from refusal.
What must happen:
- Repaper or re-notice. Update the privacy notice and consent flow to name Singapore and the United States, the group recipient, and retention. Obtain fresh consent where required; for existing customers rely only on a ground that genuinely applies, and document why.
- Sensitive data. The 420,000 health and claims records need separate consent and stronger safeguards: encryption in transit and at rest, key custody held locally or in a separate jurisdiction, least-privilege access, logging, and deletion at contract end.
- Accountability: a data-processing agreement with the group entity, a transfer impact assessment covering government-access risk, records of processing, a DPIA, and DPO sign-off.
- Supervisory dimension: moving data to a group platform is also an IT outsourcing event. Check notification and reporting duties to the FSS and add it to the outsourcing inventory.
2. What are the notification obligations for the 3 June incident, to whom and when? Address the CEO's proposal to wait three weeks.
Read the worked answer
Notify now, not in three weeks. Forensics explains the cause; it is not a precondition for telling customers their data may have been compromised. Delay concentrates regulatory risk, because late notification is a separate violation and looks like concealment.
- Data subjects: notify affected customers without delay once the branch is aware, with the prescribed content: what happened, when, what data, likely consequences, what the branch has done, and a contact point. If the numbers are still being established, give the defensible estimate and update it.
- Regulator: report to the Personal Information Protection Commission and KISA within the statutory window for large-scale breaches, confirming with counsel the current threshold and the affected-population trigger, then update the report as facts firm up.
- Financial supervisor: treat the event as an IT and operational incident under supervisory reporting and business-continuity rules, and coordinate the two filings so the figures agree.
- Others: police or cyber-crime reporting, the group and home regulator, and affected counterparties.
The CEO's instruction should be declined in writing with the legal basis and a proposed notification timetable, escalated the same day to the compliance committee and group CCO. Preserve logs, contain the spread, and decide any ransom question against sanctions and legal advice.
3. The branch asks whether it may keep a cloud backup in Virginia for disaster recovery. What factors decide, and what should the decision record show?
Read the worked answer
Backups and disaster recovery are transfers. The Virginia copy is a cross-border transfer of the same dataset, and a regulator will test it exactly as it tests production.
- Basis: does the consent and notice cover the United States, including DR use and failover access from Singapore or Korea? If not, extend the disclosure before failover is enabled.
- Access and control: who can decrypt, and from where? Holding the keys with the Korean branch removes the practical ability of a foreign entity or government to read the data and is often the most persuasive safeguard.
- Sub-processors: the cloud provider's sub-processors and their locations must be disclosed and approved.
- Contract and audit: deletion, return, breach-notification timelines, audit rights and government-request transparency.
- Resilience: a DR site that fails a restore test is not DR. Test restoration, measure recovery time and recovery point objectives, and document the results.
- Alternatives: a domestic DR site or a key-holding architecture may be less contentious than a US copy of sensitive health data.
Decision record: a DPIA setting out the options considered, the chosen basis, the safeguards, residual risk, DPO and local management approval, and the corresponding update to the privacy notice and outsourcing inventory. If the transfer cannot be legitimised, do not enable it.