Korea raises data breach fines to 10% of revenue
South Korea's revised privacy law now allows fines up to 10% of annual revenue for major negligent data leaks, up from 3%.
South Korea's revised Personal Information Protection Act enforcement decree, effective Friday, allows fines up to 10% of total annual revenue for companies leaking data of 10 million or more people through intent or gross negligence, up from the previous 3% cap. Companies must notify users within 72 hours of a potential breach with high exposure risk, and data altered by ransomware now triggers the same reporting duties. The change follows Coupang's 624.6 billion won ($466.3 million) fine in June for leaking data of 37.55 million people.
- Fines up to 10% of revenue apply to intentional or grossly negligent leaks of 10M+ people
- Potential-breach notification required within 72 hours when exposure risk is high
- Companies with proactive data protection investment can receive up to 40% fine reductions
- Firms above 180 billion won revenue processing 1M+ people need board approval for privacy officers
- Coupang's $466.3 million fine under old rules could have reached trillions of won
Full article790 words · extracted from koreajoongangdaily.com · click to collapse
Companies behind major negligent data leaks can now face fines of up to 10 percent of annual revenue under revised privacy rules.
Korea's privacy regulator is sharply raising the cost of data breaches, aiming to push companies to treat data protection as a preventive investment rather than a routine cost of doing business.
Starting Friday, companies found to have leaked the personal data of 10 million or more people through intent or gross negligence can be fined up to 10 percent of their total revenue as part of a broader overhaul under the revised Personal Information Protection Act that is set to take effect the same day. Even if a leak hasn't been confirmed, companies must notify users within 72 hours if the risk of exposure is high.
“Personal data breaches have recently occurred repeatedly and grown in scale in fields closely tied to daily life, such as retail and telecommunications,” Personal Information Protection Commission (PIPC) Secretary General Yang Cheong-sam told reporters Thursday. “We've improved the system to hold serious violations strictly accountable while also helping prevent breaches from happening in the first place.”
Under the enforcement decree, the cap applies to companies that repeatedly commit intentional or grossly negligent violations within three years, or that fail to comply with a corrective order and go on to suffer a breach as a result. Fines are calculated based on the nature and severity of the violation, the circumstances involved and the scale of the damage.
Before the revision, companies were subject to a penalty of up to 3 percent of sales.
The gap between the old and new rules becomes clear when applied to a real case. Local e-commerce giant Coupang was fined 624.6 billion won ($466.3 million) in June after leaking the personal data of 37.55 million people. Applying the new standard to that case could push the fine into the trillions of won. However, actual penalties will still depend on intent, negligence, the scale of damage and any mitigating factors.
Companies that invested in data protection beforehand will get credit under the new rules. Regulators will consider the scale and continuity of a company's investment in data protection budgets, staffing and equipment, along with its broader protection system, including its chief privacy officer, to reduce a fine by up to 40 percent. A company that detects a breach early, reports and notifies users promptly, and prevents the damage from spreading can also receive up to a 40 percent reduction.
The revision also introduces a “potential data breach notification system.” If a company determines there is a high likelihood that personal data was exposed — for instance, after illegal access to its data processing systems, or after discovering that some personal data was illegally traded in a way that suggests others' data may have leaked too — it must notify affected individuals within 72 hours of learning that. Data forged, altered or damaged by ransomware and similar attacks is now also subject to the same reporting and notification requirements.
The authority and responsibility of chief privacy officers at major companies and institutions will also expand. Companies with annual revenue exceeding 180 billion won that process the personal data of 1 million or more people, or the sensitive or unique identifying information of 50,000 or more people, must get board approval before appointing, changing or dismissing a chief privacy officer and report the decision to the PIPC. Universities with 20,000 or more students, tertiary general hospitals and operators of major public systems fall under the same requirement.
“We expect the way companies view investment in data protection to shift from seeing it as a cost to treating it as a proactive investment that builds customer trust and expands corporate profit,” PIPC's Chairperson Song Kyung-hee said.
BY HAN EUN-HWA [lee.jian@joongang.co.kr]
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
All materials contained on this site are protected by Korean copyright law and may not be reproduced, distributed, transmitted, displayed, published or broadcast without the prior consent of the JoongAng Ilbo | Tel: 1577-0510
JoongAng Ilbo Co., Ltd. | Address: 48-6 Sangamsan-ro, Mapo-gu, Seoul, Republic of Korea
Business registration number: 110-81-00999 | CEO & Publisher: Park Chang-hee | Executive Editor: Choi Ji-young
Mail order business report number: 2020-Seoul Mapo-3838 | Online newspaper registration No: 서울,아55177
Date of Registration: 2023. 11. 21 | Juvenile Protection Manager: Park Hyunyoung