Starting September 11, a revised Personal Information Protection Act will enhance a prevention-focused privacy protection system. The law strengthens penalties for serious violations while providing incentives for proactive investments and swift responses from companies. It also increases the accountability of CEOs and boards of directors regarding data protection.
The amendment not only tightens penalties but also reinforces the incentive structure to encourage proactive investments and quick responses from businesses. Companies that effectively implement preventive measures and respond promptly to incidents can see fines reduced by up to 80%.
Yang Cheong-sam, head of the Personal Information Protection Commission, emphasized during a briefing at the Government Seoul Complex on September 10 that the core of this legal revision is a paradigm shift from post-incident penalties to a prevention-centered privacy protection policy. He explained that the goal is to view privacy protection not as a cost incurred after incidents but as a proactive investment that enhances customer trust and corporate value.
The revised law raises the maximum fine for repeated or serious data breaches from 3% to 10% of total revenue. This applies to cases of intentional or grossly negligent violations, incidents affecting over 10 million individuals, or breaches occurring after failing to comply with corrective orders.
Yang noted that even if an incident is not repeated, if intentional or gross negligence is recognized and affects over 10 million individuals, a maximum fine of 10% could still apply. Each of these conditions is treated as an independent aggravating factor.
Conversely, companies that have made sufficient prior investments and established management systems for data protection can receive a fine reduction of up to 40%. This applies to those that quickly detect anomalies after an incident and actively work to prevent further damage and improve vulnerabilities.
The Personal Information Protection Commission is placing equal emphasis on mechanisms that encourage preventive investments and responses after incidents, with the potential for an 80% reduction in fines for companies that meet both criteria. The aim is to encourage businesses to maintain robust protection systems and respond swiftly to incidents, as relying solely on post-incident penalties has limitations in reducing data breaches.
However, a higher investment does not automatically lead to a larger reduction in fines. The Commission will assess the level of investment, its sustainability, the identification of data assets and risks, the adequacy of safety measures, and the roles of the Chief Privacy Officer (CPO) and CEO to determine the extent of any reduction. Yang stated, "It is difficult to set a uniform numerical standard for privacy protection investments due to the unique characteristics of different industries."
Accountability for management has also increased. The revised law designates business owners or representatives as the ultimate managers responsible for data processing and protection. The CPO is required to report on the status of data protection, key risks, and necessary improvements to the CEO or board, and management must support the necessary budget and personnel. This elevates data protection from a mere operational task to a key decision-making issue for executives.
As a result, companies are expected to notify stakeholders of data breaches more promptly. Moving forward, even if a data breach has not been definitively confirmed, there must be objectively high circumstances indicating a likelihood of a breach.
The Commission cited examples such as information circulating on the dark web that matches actual database structures or confirmed signs of intrusion, even if the extent of damage is not yet determined.
Yang clarified, "It is not sufficient to notify merely based on vague suspicions of vulnerabilities or traces; there must be clear, objectively suspicious circumstances."
The CPO reporting obligation will have a grace period until December of next year. Currently, about 600 to 700 organizations are designated as requiring a professional CPO. Amid concerns that the grace period is excessively long, Yang explained that the reporting deadline is set for six months from the implementation date, meaning that actual violations are expected to occur after March of next year, justifying the grace period until the end of the year.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.