 |
Photo courtesy of Yonhap News |
[Alpha Biz= Paul Lee] Song Kyung-hee, Chairperson of South Korea’s Personal Information Protection Commission (PIPC), announced that the agency will “actively respond” to SK Telecom’s administrative lawsuit seeking the cancellation of a record-setting fine.
Speaking at a New Year press briefing on January 21 at the Press Center in Seoul, Song stated, “The measures were determined after a thorough review and calculation of legal factors, so we will respond appropriately.”
Addressing media commentary suggesting the fine may be excessive because SK Telecom did not cause direct harm to users, Song emphasized, “The purpose of imposing a fine for personal data breaches is to hold companies accountable for failing to properly control the collection, storage, and use of large volumes of personal information, which can harm data subjects.” She also acknowledged that the PIPC’s litigation team is relatively small and may need reinforcements to handle the case effectively, noting that some observers have framed the legal battle as “David versus Goliath.”
SK Telecom filed its lawsuit on January 19 at the Seoul Administrative Court, seeking to annul the PIPC’s fine. The filing was made just one day before the deadline under the Administrative Litigation Act.
The fine stems from a hacking incident investigated by the PIPC in August last year, which revealed that 23,244,649 users’ mobile numbers, IMSI identifiers, SIM authentication keys, and 25 other types of personal data were compromised. The commission cited inadequate security measures and imposed a record KRW 134.791 billion (approximately USD 100 million) fine, the largest since the agency’s inception, surpassing the KRW 100 billion fines previously imposed on Google and Meta in 2022.
SK Telecom has argued in its lawsuit that it invested a total of KRW 1.2 trillion in compensation and information security improvements following the breach, that no financial damages occurred due to the leak, and that the case should be evaluated in light of precedents involving Google and Meta, which involved deliberate or profit-driven misuse of personal data. The company stated that it seeks “a careful judicial review of the PIPC’s fine.”
Alphabiz Reporter Paul Lee(hoondork1977@alphabiz.co.kr)
