2010년 5월 20일 Resident Registration Number Crisis
The resident registration number in South Korea is often cited as a bad case with respect to the privacy concern. It is a lot similar to the social security number in United States, but it was going too far so that even small private websites ask for the user’s RRN.
I don’t think that the existence of RRN or SSN worsens the privacy of citizens; in fact such systems are implemented in many countries, though many of them are not originally intended as a unique mean of identifying persons. In this sense RRN is rare (if not unique) that it was developed specifically to identify persons uniquely, but it doesn’t make much difference between de jure and de facto systems. Actually any service that most citizens use requires such identifier, in form of primary key; RRN is a good example of such identifiers if many offices have to allocate numbers in real time and it is hard to lookup the new numbers globally.1 If this were problematic we should ban such public and private services at all, but that’s an another story.
Whichever the identifier is de facto or de jure, the problem arises from the unnecessary use of them. In South Korea RRN is the standard for identifying persons, making the identity theft not only possible but also very effective. For instance, Zeroboard 4, a webboard software once popular in South Korea, supported the field for RRN in its user registration form and made the use of RRN for such purpose widespread. This causes a lot of problems: I have to enter RRN to many websites even if I will never do anything that really requires RRN (for example, the online payment), and many foreigners without proper RRN have to do so too2. Several huge websites with tens of millions of RRN has been cracked — for your information, there are almost fifty million persons in South Korea — and that becomes the national disaster.
Thus the solution is clear: the nation should forbid the use of identification numbers outside the government strictly. The South Korean government has developed the I-PIN system few years ago, but this is not even the solution as it doesn’t matter whether the number is de facto or de jure. We may agree on the necessity of such numbers in the some form, but it doesn’t mean all the citizens have to take care of them.
-
RRN has the 4-digit unique number for offices in it, so if we can keep office number uniquely we can always generate the unique RRN locally. The list of office numbers is undisclosed, and sometimes not up to date. ↩
-
There exists an alien registration number which is quite similar to RRN (with the special “gender” for aliens), but many websites reject the RRN in their verification process. That’s why I said that they don’t have the proper RRN. ↩
