Kyunghyong "Personal Information Protection Act Amendment, Excessive Burden on Companies"

Concerns Over Industry Development as Corporate Fines Grow Too Large Due to Personal Information Protection Act Amendments

Source: Korea Employers Federation

[Asia Economy Reporter Changhwan Lee] The Korea Employers Federation announced on the 14th that it submitted the business community's concerns regarding the Personal Information Protection Act amendment, which was legislatively proposed by the Personal Information Protection Commission on the 10th, to the Commission.

The Federation expressed concerns that if the amendment is reflected, the upper limit of fines for various violations of the Personal Information Protection Act would be raised and newly established from '3% or less of sales related to the violation' to '3% or less of total sales,' which would excessively increase the burden on companies utilizing personal information and hinder the development of related industries.

In particular, it raised the issue that imposing fines based on the total sales of a company, including areas completely unrelated to violations of the Personal Information Protection Act, is irrational.

This creates an unfair situation where the size of fines for violations of the Personal Information Protection Act is determined according to the sales scale of other business sectors that have nothing to do with the use of personal information.

For example, assuming an IT company with 100% of its business using personal data (annual sales of 100 billion KRW) and a manufacturing company with 2% of its business using data (business sales of 100 billion KRW) and total sales of 5 trillion KRW, even though the sales from personal information utilization business are the same, the maximum fine can differ by up to 50 times (3 billion KRW / 150 billion KRW).

Furthermore, it expressed concerns that calculating fines based on total sales could lead to excessive fines compared to the violation.

In the current enforcement decree, which stipulates detailed standards for imposing fines, three imposition rates are distinguished according to the severity of the violation. The Federation argued that applying this to the amendment's total sales basis would result in excessively excessive fines compared to the violation.

Source: Korea Employers Federation

For instance, if the current enforcement decree standards are applied to the amendment, Samsung Electronics, the company with the largest domestic sales, would face a fine base amount equivalent to 1.5% of total sales, amounting to 2.4353 trillion KRW, even for 'general violations' without intent or gross negligence, and even with maximum mitigation, a minimum of 608.8 billion KRW would be imposed.

May Violate the Constitutional Principle of Proportionality

The Federation added that the amendment may violate the constitutional 'principle of proportionality' and is inconsistent with the fairness of fine regulations in other laws.

Fines are intended to 'deprive economic benefits obtained from violations (Supreme Court 2000Du6121),' and the amendment's 'total sales' basis does not align with this purpose.

Calculating fines based on 'total sales' does not meet the 'minimal infringement' requirement of the proportionality principle and is feared to excessively infringe on the property rights of personal information processors.

Minimal infringement means that among several selectable means, the chosen method to achieve the goal should minimally infringe on the legal interests of individuals or the public.

It pointed out that laws such as the Fair Trade Act and the Telecommunications Business Act delegate specific fine imposition standards to enforcement decrees and substantively apply sales standards related to the violation, and that the amendment's approach is unfair.

Hahm Sangwoo, head of the Economic Research Department at the Korea Employers Federation, said, "Regulating the upper limit of fines based on 'total sales,' including areas unrelated to the violation, can act as a significant constraint not only on the existing information and communication industry but also on industries broadly utilizing personal information data." He added, "It is necessary to seek reasonable improvement measures within the current law's fine upper limit based on 'sales related to the violation.'"