[2026 Parliamentary Audit] Personal Information Protection Commission's Data Breach Response Under Scrutiny; Song Gyeonghui: "Strengthening the Effectiveness of Investigations and Penalties"

"Fundamentally overhaul the personal information protection system"

As personal information leak incidents surge, the Personal Information Protection Commission’s field investigations and response system have become key issues in the parliamentary audit.

Song Kyung-hee, chairperson of the Personal Information Protection Commission. Yonhap News Agency

On the morning of October 13, the National Assembly’s Political Affairs Committee held a parliamentary audit of Song Gyeonghui, chairperson of the Personal Information Protection Commission, and others, and reviewed the response to a series of data breaches.

In her opening remarks, Song said, "A series of large-scale data breaches have occurred since last year, making it increasingly necessary to fundamentally overhaul the personal information protection system. We have introduced strict penalties, including punitive surcharges, and established preventive measures to ensure that investment in personal information protection yields tangible benefits." She added, "We will strengthen the effectiveness of investigations and ensure that the new surcharge system operates effectively. I feel a heavy sense of responsibility for recent data breaches, including those involving personal credit information, and will conduct a thorough investigation in cooperation with the relevant ministries."

According to data submitted by the Personal Information Protection Commission to Rep. Park Seonghun of the People Power Party, 579 breach reports were received from January through August this year, up 132, or 29.5%, from 447 for all of last year. However, the Commission conducted field investigations into only 33 cases, or 5.7% of the total, this year. The Commission explained that it first conducts document-based investigations, including requests for the submission of materials, and then verifies the facts, such as the scale and circumstances of the breaches.

Some have also pointed out that although the Commission’s budget and spending on strengthening its investigative capacity have risen steadily over the past four years, 30 cases have remained unresolved for more than two years after being reported. The Commission’s internal rules stipulate that investigation results must be reported within six months of an investigation’s start, or within a maximum of 12 months for complex cases. Rep. Kim Jaeseop said the "Plan to Expedite Investigations and Strengthen Capacity for Data Breach and Security Incident Cases," announced ahead of the parliamentary audit, was "nothing more than an attempt to evade responsibility."

This afternoon, witnesses will include TVING CEO Choi Juhee and KT Chief Information Security Officer (CISO) Lee Sangyun, as well as Healingpaper CEO Hong Seungil, whose companies have experienced personal information breaches. Google Korea CEO Yoon Gu will appear to address content management issues, including the exposure of information about requests to remove content.

With security a major social issue, Choi also appeared before the Science, ICT, Broadcasting and Communications Committee and the Culture, Sports and Tourism Committee for their parliamentary audits, where she explained the causes of the security incidents and the company’s information protection system and responded to criticism of the compensation plan. Lee and Yoon are also appearing before several standing committees. Earlier, the heads of the three major telecommunications companies, including KT CEO Park Yunyoung, met with Song and issued a joint declaration pledging to make personal information protection a top management priority and to continue investing in it. KT plans to invest KRW 2.2 trillion over five years in areas including IT infrastructure modernization.

This content was produced with the assistance of AI translation services.