Punitive Fines Alone Cannot Ensure Personal Information Protection

A series of large-scale hacking incidents and personal data breaches at major telecommunications companies—including SK Telecom, KT, and LG Uplus—has recently fueled widespread public anxiety. In the case of SK Telecom, the Personal Information Protection Commission (PIPC) imposed a record-high fine of 134.7 billion won following the leakage of data affecting more than 23 million customers. However, controversy has arisen over fairness, as “punitive fines” are being levied even in the absence of demonstrable harm or illicit corporate gains.

The core issue is not simply the size of the fines. When the government focuses solely on exemplary punishment, it inevitably increases market uncertainty and weakens firms’ capacity for future investment. At a time when investment in emerging industries such as artificial intelligence and data-driven services is accelerating, the normalization of trillion-won-level penalties risks seriously undermining the competitiveness of the broader IT sector.

Google, for instance, was fined only 69.2 billion won despite collecting and using personal data for advertising purposes without consent. By contrast, SK Telecom—despite being a victim of hacking and having gained no unfair benefit—was fined more than twice that amount. The fundamental purpose of administrative fines is the disgorgement of illicit gains. Imposing fines of more than 130 billion won purely for punitive purposes, in the absence of such gains, is not merely excessive but arguably unreasonable.

When enforcement loses its sense of proportionality, regulation can instead erode policy credibility. Fines should, by nature, serve to recover profits obtained through unlawful conduct, while punitive sanctions should be applied only in limited circumstances, based on clear legal grounds and broad social consensus. If regulators continue to impose near-maximum fines regardless of whether illicit gains exist, such measures become an unpredictable risk for businesses and amount, in effect, to a quasi-criminal penalty regime.

As the PIPC itself emphasizes, personal data protection is no longer a peripheral management issue but a core component of corporate governance. Yet if the policy response is reduced to ever-stronger regulation and heavier fines, balance is lost. Security investment should be driven by firms’ autonomous judgment and long-term strategies, while the government’s role should be to create the institutional conditions that make such investment feasible.

What is needed now is not punishment, but innovation. Given that private IT companies are often victims of hacking themselves, they should be granted a reasonable transition and preparation period—approximately one year—to build advanced security systems. As global hacker organizations grow increasingly sophisticated and persistent, it is unrealistic to expect companies to establish perfect defenses in a short time frame. Rather than relying on uniform regulatory enforcement, the government should present flexible implementation plans that enable the private sector to take the lead in upgrading its security capabilities.

At the same time, national-level support is essential. Personal data protection has the characteristics of a public good that individual firms cannot shoulder alone. Accordingly, the government should promote security technology innovation through R&D support and strengthen public–private cooperation frameworks to enable joint responses to cyber threats. A wiser approach is to foster an institutional environment that encourages sustained security investment ex ante, rather than resorting to punitive measures after incidents occur.

In short, administrative fines are a tool for disgorging illegal gains—not a mechanism for victim compensation or security enhancement. The government’s role should shift away from punitive regulation toward building a genuine foundation for protecting citizens’ personal data and strengthening national cybersecurity capabilities. This moment should also be seized as an opportunity to promote IT firms’ investment in information-security R&D and growth in the roughly USD 2 trillion global cybersecurity market in the era of AI and big data.

Kwang-yong Ko
Director of Policy, The Center for Free Enterprise

Korean version: https://www.cfe.org/bbs/bbsDetail.php?cid=press&pn=2&idx=28074