[New Year's Address] Song Kyunghee: "10% Revenue Fine for Serious or Repeated Data Breaches"

Preemptive Inspections for Distributors and Platforms
Substantial Incentives for Companies Prioritizing Security

Song Kyunghee, Chairperson of the Personal Information Protection Commission, announced on January 2 that the commission will pursue fundamental reforms to prevent recurring personal information leakage incidents, including the introduction of punitive fines amounting to up to 10% of a company's revenue.

Song Kyunghee, Chairperson of the Personal Information Protection Commission, is speaking at a video plenary meeting held on December 3, 2025, at the Government Seoul Office in Jongno-gu, Seoul, regarding the Coupang personal information leak incident and prevention of secondary damage. Photo by Jo Yongjun

In her New Year's address that day, Chairperson Song stated, "In the face of repeated incidents, our current approaches are far from sufficient to alleviate public anxiety," adding, "We will fundamentally improve not only our working methods but also the entire system."

She predicted that the era of artificial intelligence (AI) agents will begin in earnest in 2026, and anticipated that the threats of sophisticated hacking and illegal distribution of personal information will intensify.

Accordingly, the Personal Information Protection Commission has designated this year as "the inaugural year of a major transformation in the personal information protection system," and will implement five key policies.

The five key policies are: ▲ Establishing a virtuous cycle where strong sanctions coexist with proactive investment ▲ Shifting to a prevention-centered protection system ▲ Leading an AI-innovative society based on trust ▲ Building a privacy safety net in daily life ▲ Cooperating with the international community on personal information protection.

First, Chairperson Song stated, "For serious or repeated leakage incidents, we will impose strict punitive fines of up to 10% of a company's revenue," and added, "We will provide substantial incentives to companies that prioritize security."

The commission recently established a new organization dedicated to leakage prevention, and plans to conduct preemptive inspections focused on companies that handle large volumes of personal information, such as distributors and platform operators.

In addition, Chairperson Song announced, "We will actively support small and micro-sized enterprises to strengthen their autonomous protection capabilities."

Furthermore, the commission will introduce special provisions allowing the use of original data for AI training under certain conditions, and will expand MyData services to sectors such as energy and education.

The commission also plans to introduce and expand a Privacy by Design (PbD) certification system, focusing on everyday smart devices such as robot vacuum cleaners.

Chairperson Song stated, "We will add compensation for damages to the scope of class action lawsuits and promote the establishment of a fund to open a path for affected citizens to receive compensation," adding, "We will do our utmost to create a society where people can use digital services with peace of mind."