Personal Information Protection Commission to Reach Final Decision on KT Data Leak Sanctions as Early as July 29

Sanctions to Be Reviewed at Personal Information Commission Plenary Meeting
Statutory Maximum Fine Around 200 Billion Won... Focus on Mitigation and Aggravation Factors

The government's sanction plan regarding the KT personal information leak could be finalized as early as this month. Last year, KT was involved in an incident in which the personal information of over 20,000 people was leaked, and small payment damages amounting to about 2 billion won occurred.

A citizen is passing in front of the KT store in Seoul. Photo by Yonhap News Agency

According to industry sources on July 19, the Personal Information Protection Commission is considering convening a plenary meeting on July 29 to review and decide on sanctions against KT, including imposing a penalty surcharge. If further examination is deemed necessary, the decision could be postponed.

In September last year, KT experienced an incident in some areas of the Seoul metropolitan area where the subscriber identification numbers (IMSI), device identification numbers (IMEI), and phone numbers of 22,227 customers were leaked through illegal femtocells (micro base stations). Among the affected customers, a total of 368 people suffered 777 cases of unauthorized small payments, totaling about 243 million won.

However, it has been reported that the number of data subjects calculated by the Personal Information Protection Commission is lower, at about 16,000, compared with the initial 20,000. This figure excludes cases where one person owns multiple lines or lines for corporate use. Previously, the commission concluded its investigation into KT in May and sent out a preliminary notice of disposition.

Under the current Personal Information Protection Act, the commission can impose a penalty surcharge of up to 3% of the sales related to the violation. KT's wireless service sales over the past three years have averaged about 6.6689 trillion won annually, meaning that the statutory maximum penalty surcharge could reach 200 billion won. The final surcharge will take into account factors such as the severity of the violation and the measures taken after the incident, including those for mitigation or aggravation.

Factors considered for mitigation include KT's waiver of penalty charges for customers who canceled after the incident, the operation of a compensation program, and its announcement to expand investments in information security. However, the fact that KT processed the incident internally without immediately reporting the infected servers to the authorities, as well as continuing to attract new subscribers even after recognizing security vulnerabilities, may be considered aggravating factors.

So far, the highest penalty surcharge on record is 624.7 billion won, imposed on Coupang after the personal information of 37.56 million people was leaked. The previous record holder, SK Telecom, was fined 134.8 billion won, with mitigating factors taken into account.

This content was produced with the assistance of AI translation services.