Election watchdog reports voter data leak; privacy regulator investigates

The Personal Information Protection Commission has launched a fact-finding inquiry after the National Election Commission reported a data leak involving voter verification slips bearing names and genders found at Jamsil 7-dong Polling Station No. 2 in Songpa-gu, Seoul.

The National Election Commission filed a personal data breach report with the commission at around 8:30 p.m. Friday, the Personal Information Protection Commission said.

The polling station was the site of a ballot shortage during the main voting day of the 9th nationwide simultaneous local elections.

Protesters claiming election fraud effectively blockaded the station for three days, delaying the removal of ballot boxes. The boxes were not transported to the counting venue until police intervened Friday morning.

After the ballot boxes were removed, protesters who entered the polling station found voter verification slips that had been left behind, photographed them and livestreamed the footage online, exposing personal information including voters' names and genders.

The slips are believed to have served as queue tickets distributed to voters who could not cast their ballots immediately due to the ballot shortage on election day.

The Personal Information Protection Commission is now looking into how the slips came to be exposed publicly and whether documents the election commission was required to retain had been improperly released.

A commission official said in a phone interview that the case differs in nature from a typical hacking incident or external intrusion. "We plan to verify the full facts together with the election commission," the official said.

The official added that basic facts still need to be established — including whether the materials had been distributed to voters in advance and later exposed, or whether information the election commission was supposed to keep on file had been leaked.

Based on its findings, the commission said it will review whether the Personal Information Protection Act was violated and whether follow-up measures are needed.