Korea raises data breach fines to 10% of revenue

Starting Friday, South Korea has significantly increased penalties for major data breaches, capping fines at 10 percent of a company's annual revenue. This is part of a broader overhaul of the Personal Information Protection Act, aimed at making data protection a top priority for businesses instead of just a routine cost. The privacy regulator, the Personal Information Protection Commission (PIPC), is cracking down on companies that negligently or intentionally leak personal data of 10 million or more individuals.

Even if a breach hasn't been confirmed, companies must notify users within 72 hours if there's a high risk of exposure. PIP Commission Secretary General Yang Cheong-sam emphasized that recent data breaches in sectors like retail and telecommunications have become more frequent and widespread. The new rules target companies that repeatedly commit intentional or grossly negligent violations within three years, or fail to comply with previous corrective orders.

Fines are based on the severity of the violation, circumstances, and the extent of damage. Under the old rules, the maximum penalty was 3 percent of sales. For example, e-commerce giant Coupang, which leaked data of 37.55 million people in June, could face fines in the trillions of won under the new system. However, actual penalties will depend on factors like intent, negligence, damage scale, and any mitigating measures taken by the company.

Companies that prioritize data protection will receive credit, with reductions of up to 40 percent for robust data protection investments, early breach detection, prompt reporting, and preventing further damage. A "potential data breach notification system" has been introduced, requiring companies to notify affected individuals within 72 hours if they determine there's a high likelihood of personal data exposure.

Chief privacy officers at major companies and institutions will have expanded authority, with companies exceeding 180 billion won in revenue and processing data for 1 million or more people, or sensitive information for 50,000 or more individuals, needing board approval before appointing, changing, or dismissing such officers. Universities with 20,000 or more students, tertiary general hospitals, and operators of major public systems also fall under this requirement.

PIP Commission Chairperson Song Kyung-hee expressed the hope that companies will view data protection as a proactive investment that builds customer trust and drives corporate profit.