12869899

Companies behind major negligent data leaks can now face fines of up to 10 percent of annual revenue under revised privacy rules.

Korea's privacy regulator is sharply raising the cost of data breaches, aiming to push companies to treat data protection as a preventive investment rather than a routine cost of doing business.

Starting Friday, companies found to have leaked the personal data of 10 million or more people through intent or gross negligence can be fined up to 10 percent of their total revenue as part of a broader overhaul under the revised Personal Information Protection Act that is set to take effect the same day. Even if a leak hasn't been confirmed, companies must notify users within 72 hours if the risk of exposure is high.

“Personal data breaches have recently occurred repeatedly and grown in scale in fields closely tied to daily life, such as retail and telecommunications,” Personal Information Protection Commission (PIPC) Secretary General Yang Cheong-sam told reporters Thursday. “We've improved the system to hold serious violations strictly accountable while also helping prevent breaches from happening in the first place.”

Korea to introduce strengthened penalties for large-scale data leaks

Korea to introduce strengthened penalties for large-scale data leaks

Gender Ministry considers criminal charges against Google over leaked victim data

Gender Ministry considers criminal charges against Google over leaked victim data

As U.S. and Europe hit gas on Chinese smart car restrictions, Korea sits at red light

As U.S. and Europe hit gas on Chinese smart car restrictions, Korea sits at red light

Under the enforcement decree, the cap applies to companies that repeatedly commit intentional or grossly negligent violations within three years, or that fail to comply with a corrective order and go on to suffer a breach as a result. Fines are calculated based on the nature and severity of the violation, the circumstances involved and the scale of the damage.

Before the revision, companies were subject to a penalty of up to 3 percent of sales.

The gap between the old and new rules becomes clear when applied to a real case. Local e-commerce giant Coupang was fined 624.6 billion won ($466.3 million) in June after leaking the personal data of 37.55 million people. Applying the new standard to that case could push the fine into the trillions of won. However, actual penalties will still depend on intent, negligence, the scale of damage and any mitigating factors.

Companies that invested in data protection beforehand will get credit under the new rules. Regulators will consider the scale and continuity of a company's investment in data protection budgets, staffing and equipment, along with its broader protection system, including its chief privacy officer, to reduce a fine by up to 40 percent. A company that detects a breach early, reports and notifies users promptly, and prevents the damage from spreading can also receive up to a 40 percent reduction.

The revision also introduces a “potential data breach notification system.” If a company determines there is a high likelihood that personal data was exposed — for instance, after illegal access to its data processing systems, or after discovering that some personal data was illegally traded in a way that suggests others' data may have leaked too — it must notify affected individuals within 72 hours of learning that. Data forged, altered or damaged by ransomware and similar attacks is now also subject to the same reporting and notification requirements.

The authority and responsibility of chief privacy officers at major companies and institutions will also expand. Companies with annual revenue exceeding 180 billion won that process the personal data of 1 million or more people, or the sensitive or unique identifying information of 50,000 or more people, must get board approval before appointing, changing or dismissing a chief privacy officer and report the decision to the PIPC. Universities with 20,000 or more students, tertiary general hospitals and operators of major public systems fall under the same requirement.

“We expect the way companies view investment in data protection to shift from seeing it as a cost to treating it as a proactive investment that builds customer trust and expands corporate profit,” PIPC's Chairperson Song Kyung-hee said.

BY HAN EUN-HWA [[email protected]]

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.