Tving holds company-wide privacy training after massive data breach

Tving, the streaming platform caught up in a massive personal data breach, has conducted a company-wide privacy training session for all employees as part of efforts to embed a security-first culture and make data protection a fundamental operating principle.

Tving said Tuesday it held the company-wide personal data protection training on Monday. Yoon Jong-su, a partner attorney at law firm Gwangjang and a serving board member of the Korea Association of Personal Information Professionals, led the session on the theme of "Growing risks of personal data breaches, the shifting regulatory paradigm, and response strategies."

The session covered changes in the personal data protection landscape, the importance of building proactive prevention systems, the direction of data protection in the AI era, and key points employees should keep in mind when handling personal data in their day-to-day work.

According to Tving, Yoon stressed the importance of data lifecycle management — overseeing personal data from the point of creation and collection through to use, storage and disposal. He also shared practical measures based on improvements to related systems and processes, including steps to strengthen data management standards such as reviewing retention periods and processing purposes, and ensuring timely disposal of unnecessary personal data.

Yoon also addressed "privacy by design" — the principle of incorporating data protection from the earliest stages of service planning and development, ensuring that privacy considerations are built into every phase of a service rather than addressed after the fact.

"Personal data protection is not something to be dealt with after a service launches — it is a fundamental principle that must be considered from the planning stage," Yoon said. "It is important to put in place a system that ensures personal data handling is reviewed and protective measures are applied throughout the entire service lifecycle."

Tving said it plans to strengthen its personal data protection programs following the training. The company will review its management systems covering the entire data processing cycle, improve related procedures, and establish data protection as a working principle practiced by every member of the organization.

"Personal data protection is a fundamental principle that every member of the organization must practice with individual accountability," said Ko Min-seok, Tving's executive vice president of human resources. "Alongside training, we will review the relevant standards and procedures so that employees can apply an understanding of the importance and responsibility of personal data handling to their work, and we will make improvements where needed."

Meanwhile, on Sept. 3, a joint public-private investigation team under the Ministry of Science and ICT announced the findings of its probe into the Tving data breach. The team said personal data from about 39.54 million accounts, including duplicate accounts, had been leaked. The breach extended beyond user information to include 361 development projects containing source code used for personalized content recommendations, search algorithms, payment management and paid service operations.