Personal Information Protection Commission to Expand Scope of Companies Required to Subscribe to Personal Data Leakage Compensation Insurance

[Asia Economy Reporter Eunmo Koo] The scope of companies required to subscribe to personal information damage compensation insurance will be expanded. This is to enhance the effectiveness of remedying victims of personal information leaks by companies and to alleviate the compensation burden on companies.

The Personal Information Protection Commission announced the "Improvement Plan for the Personal Information Damage Compensation Liability Guarantee System" containing these details at its 10th plenary session on the 9th.

The Commission prepared improvement measures in three directions to secure the effectiveness of the "Personal Information Damage Compensation Liability Guarantee System" and to activate the system. First, the subscription target will be expanded to offline businesses, raising subscription criteria such as sales revenue and the scale of personal information held, and clearly defining exemption targets to enhance the system's effectiveness. Additionally, the system will be activated by strengthening promotion related to group insurance subscription and related systems by industry and function. For companies not subscribing to insurance, correction orders will be issued first, and if not followed, fines will be imposed to encourage insurance subscription.

The Commission has been implementing the Personal Information Damage Compensation Liability Guarantee System since June 2019, requiring information and communication service providers with annual sales of 50 million KRW or more and 1,000 or more users whose personal information is stored or managed to compulsorily subscribe to insurance or mutual aid or accumulate reserves. However, due to low awareness of the system among companies, lack of incentives to subscribe to insurance, and controversies over excessive regulation, the insurance subscription rate remains low.

Under these circumstances, the scope of mandatory damage compensation liability insurance subscription is expected to expand from "information and communication service providers, etc." to "personal information processors" under the second amendment to the Personal Information Protection Act currently underway, increasing the necessity for system improvement more than ever.

This improvement plan was developed after collecting diverse and in-depth opinions from experts and stakeholders on operational issues of the system, and also incorporated discussions from the 12th "Personal Information Talk Talk Relay" held in May on the theme of "Improvement Directions for the Personal Information Damage Compensation Liability Guarantee System."

Song Sang-hoon, Director of the Investigation and Adjustment Bureau at the Personal Information Protection Commission, stated, "As interest and utilization of personal information increase, risks such as personal information leaks and companies' compensation liabilities are also growing. We will establish the damage compensation liability guarantee system by fully listening to experts and industry opinions to reduce companies' compensation burdens and ensure sufficient compensation to data subjects."