Korean Bar Association Urges Prompt Enactment of Three Civil Laws Including Punitive Damages After TiViNG Personal Data Leak

"As Long as the Structure Remains Unchanged, Such Incidents Will Be Repeated"

The Korean Bar Association has urged the prompt enactment of the Three Civil Laws for Livelihood—discovery (evidence disclosure), punitive damages, and class action systems—in response to the TiViNG personal information leakage incident.

The Korean Bar Association

On September 7, the association released a statement expressing its deep concern over the massive personal information leak involving 39.54 million accounts due to a hacking incident at TiViNG at the end of May.

The association pointed out that TiViNG bears substantial responsibility for the incident. It explained that the attacker accessed internal systems by stealing a developer’s development environment access key, that management and monitoring of access keys were lax, and that vulnerabilities revealed in a 2024 penetration test had not been fixed. The association stated, “Millions of pieces of information were allowed to leak through holes that were knowingly left unattended. This cannot be regarded as mere negligence.”

The association also highlighted problems regarding the level of sanctions imposed. Although TiViNG failed to meet the legally mandated 24-hour reporting deadline, the penalty amounts to only a maximum fine of 30 million won. The association argued, “A fine of 30 million won cannot be regarded as a sanction for a company that handles the personal information of tens of millions of people.”

The association cited the 2011 SK Communications incident, the 2014 case involving three credit card companies, last year’s cases with SK Telecom and Coupang, pointing out that “Whenever a large-scale data leak occurs, it is the public who bears the damage, while companies get by with a token apology and nominal compensation.” The association warned that “This pattern will continue unless there is fundamental change.”

Accordingly, the association emphasized that the Personal Information Protection Commission and investigative authorities should thoroughly investigate the origins of the incident, the actual number of victims, the reasons and accountability for unresolved vulnerabilities identified in 2024, and the management and disposal of data belonging to withdrawn members. The investigation should include not only TiViNG but also its parent company, CJ Group, which holds supervisory responsibility and must be examined for fulfillment of its legal obligations.

The association also called for long-term monitoring and swift relief measures for damages such as identity theft and phishing resulting from the leak of CI (Connecting Information). It urged the government and National Assembly to strengthen security obligations for companies processing large-scale personal data, to increase penalty levels for both neglecting vulnerabilities and reporting delays, and to review the current system that allows private companies to retain massive amounts of CI, which users cannot change.

The association requested further institutional improvements. It explained that “In data breach incidents, all evidence concerning security system conditions, the causes of the leak, and the presence of negligence reside within companies, leaving victims unable to access such information,” and thus called for the introduction of a discovery system. Regarding the punitive damages system, it stated, “Only when companies face liability several times greater than existing compensation will they regard personal data protection as a duty, not a cost.” The association also urged expansion of the class action system to broadly cover violations of personal data and consumer rights.

Addressing the courts, the association called for damages awards that reflect reality in order to curb companies’ moral hazards. “If courts continue to award low damages in cases such as CI leaks—where harm persists over a long period—it will be difficult to expect adequate redress for victims, or improvements in companies’ security measures,” the association said.

The association reaffirmed, “The right to personal information self-determination is a basic constitutional right,” and emphasized, “The National Assembly must not further delay legislation of the Three Civil Laws for Livelihood, which incorporate discovery, punitive damages, and class action systems.”

This content was produced with the assistance of AI translation services.