Legislator Points Out Lack of Sanctions for Data Concealment Before Investigations

a yellow sign on a fence — GVZ 42 / Unsplash

A legislator has highlighted the need for stronger regulations regarding the concealment or destruction of documents by companies prior to official investigations into data breaches. This concern arises from the potential disadvantage faced by companies that report incidents and cooperate with inquiries, suggesting that reforms are necessary to improve the existing framework.

The legislator emphasized that the Personal Information Protection Commission currently lacks adequate authority to sanction companies for hiding or disposing of documents before investigations begin. If companies can eliminate evidence related to the cause and accountability of incidents without facing sufficient penalties, it becomes challenging to encourage honest reporting and cooperation during investigations.

In response, the head of the commission stated that the agency considers a company's willingness to cooperate with investigations and any obstructive behaviors when determining fines. However, they acknowledged that the current measures are insufficient to impose penalties on active concealment and destruction of documents, indicating a need for regulatory improvement.

Previously released official data from the commission confirmed these limitations. The agency noted that while criminal penalties and fines can be applied to acts of concealment during investigations, regulations governing actions taken before investigations are limited. This creates a gap that could work to the advantage of businesses that hide or destroy evidence after incidents occur.

The core issue raised is the absence of specific sanctions for document concealment and destruction before investigations commence. It is crucial to differentiate between the responsibility for legal violations that lead to data breaches and the responsibility for actions taken afterward to conceal evidence. Essential records, like access logs, are vital for identifying breach pathways and assessing the extent of damage, and their loss can hinder the investigation and prevention of future incidents.

The commission has announced plans to establish criminal penalties for document concealment prior to investigations, impose fines, and introduce evidence preservation orders in cases of breaches, aiming to refine the system to hold accountable those who deliberately conceal or destroy evidence while promoting honest reporting and cooperation.