Jo Incheol Proposes Amendment to the Personal Information Protection Act
Amid growing public criticism, there are concerns that the fines and penalties related to the recent massive personal information leak at Coupang, which affected 33.7 million people, may be reduced.
In response, Jo Incheol, a National Assembly member from the Democratic Party of Korea (representing Gwangju Seo-gu Gap and a member of the National Assembly's Science, ICT, Broadcasting, and Communications Committee), announced on December 22 that he has sponsored a partial amendment to the Personal Information Protection Act. The amendment aims to restrict the reduction of fines if the same personal information leak or other illegal acts are repeated.
The proposed amendment stipulates that if a company has been fined for the same violation within the past three years, no reduction in fines will be allowed. The purpose is to substantially strengthen corporate accountability for repeated personal information breaches.
Currently, the Personal Information Protection Act allows fines of up to 3% of a company's total sales for violations. However, subordinate regulations permit up to a 50% reduction in fines for efforts to protect personal information, such as obtaining the Information Security Management System-Personal Information & Privacy (ISMS-P) certification or cooperating with investigations.
As a result, there has been ongoing criticism that the level of sanctions is significantly lowered even when the same personal information breach is repeated, leading to a system where leniency becomes entrenched.
In fact, despite Coupang leaking the personal information of 22,440 individuals-including orderers and recipients-in December 2023, the fine imposed by the Personal Information Protection Commission was significantly reduced last November due to reasons such as the acquisition of ISMS-P certification and cooperation with the investigation. As a result, the initially calculated fine of approximately 3.9 billion won was reduced to about 1.3 billion won after three rounds of reductions.
On December 2, during a Coupang-related inquiry at the Science, ICT, Broadcasting, and Communications Committee, and again at a Coupang hearing on December 17, Assemblyman Jo Incheol questioned the chairperson and vice-chairperson of the Personal Information Protection Commission, asking, "Is it true that Coupang, which previously received a reduction in fines for a personal information leak, could again receive up to a 50% reduction for the same incident simply because it holds ISMS-P certification?" He added, "Given the gravity of an incident involving the leak of tens of millions of individuals' personal information, the fines should be imposed as strictly as possible."
In response, the chairperson and vice-chairperson of the Personal Information Protection Commission stated, "We will make a strict judgment according to the seriousness of the matter," and acknowledged, "There is a systemic limitation in that there are no clear regulations restricting reductions for repeated violations."
Assemblyman Jo Incheol emphasized, "If the same company repeatedly receives reduced penalties for the same incident, it sends the wrong signal that it is acceptable to fail in protecting personal information."
He continued, "While efforts such as obtaining information security certification should be respected, they should not serve as grounds for reduction in cases of repeated personal information leaks. Only by imposing economic responsibility without exception for repeated violations can we prevent a second or third Coupang incident and substantially strengthen both corporate security investments and the protection of citizens' personal information."
Meanwhile, as Coupang has already received significant reductions in fines for previous personal information leaks, concerns are spreading that this latest incident may also result in only a "slap on the wrist."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
