Personal Information Commission May Impose Fine on SKT as Early as Late August: "Strict Action Will Be Taken"

Haksoo Ko, Chairperson of the Personal Information Protection Commission, commented on potential sanctions such as the size of the fine to be imposed in response to the SK Telecom hacking incident. On August 6, he stated, "We will take strict action in accordance with the law and principles," adding, "Given the high level of public interest, we are paying even closer attention to the matter."

Haksoo Ko, Chairperson of the Personal Information Protection Commission. Photo by Yongjun Cho

At the 'Generative AI and Privacy' open seminar held at the Jeongdong 1928 Art Center in Jung-gu, Seoul on the same day, Ko met with reporters and said, "There are various criteria for imposing fines, such as aggravating and mitigating factors. Whether or not to apply these elements will be decided through a plenary meeting," he explained.

He added, "The investigation is proceeding at a normal pace at the working level," but also noted, "There is no specific date set yet for when the results will be released. Since it is early August, we need to monitor the situation."

Previously, at the end of last month, the Personal Information Protection Commission issued a preliminary notice of disposition to SKT, having completed most of the investigation procedures. The Commission had launched an investigation into SKT on April 22, following a customer personal information leak incident. According to the Commission's regulations on investigation and disposition, the investigator must notify the party of the planned disposition based on the investigation report and provide at least 14 days for the party to submit their opinion.

Accordingly, some expect that the decision regarding SKT will be announced at the end of this month, as the SKT-related agenda is highly likely to be submitted to the Commission's plenary meeting scheduled for August 27. However, the Commission explained that the timing could be further delayed for various reasons, such as if SKT's opinion submission process is prolonged or if commissioners request additional supplementary materials.

Under the Personal Information Protection Act, fines can be imposed up to 3% of sales revenue, and revenue unrelated to the data breach can be excluded from the calculation basis.

In the telecommunications industry, it is estimated that, based on SK Telecom's wireless communications business revenue last year (12.77 trillion won), the fine could reach up to the mid-300 billion won range. However, some predict that if SK Telecom's efforts to compensate victims and implement measures to prevent recurrence after the hacking incident are taken into account, the fine could be reduced to around 100 billion won.