The Personal Information Protection Commission said on the 21st that it would present a sanction plan against SK Telecom, following a large-scale customer USIM information leak incident, at its plenary session on the 27th.
The plenary session will be held in private, and if a conclusion is reached that day, the Personal Information Protection Commission will explain the results through a separate briefing. If additional discussions among the commissioners are necessary, the final decision could be delayed.
The Personal Information Protection Commission began its investigation after receiving a report of personal information leakage from SK Telecom in April. It is known that the commission focused on checking whether SK Telecom properly notified customers after the leakage occurred and whether it complied with legal security measures, such as blocking external intrusions. During this process, several senior officials from the commission publicly stated, "We judge that there was a leakage of personal information from SK Telecom's main server."
Previously, the Personal Information Protection Commission completed most of the investigation procedures and notified SK Telecom of the impending sanctions at the end of last month. The notice reportedly included the reasons for the sanctions, the contents of the sanctions, applicable laws, the deadline for submitting opinions, and a list of evidence. According to the "Regulations on Investigation and Sanction by the Personal Information Protection Commission," researchers must notify the parties of the notice concerning the impending sanctions and provide an opportunity to submit opinions for a period of at least 14 days.
In the telecommunications industry, there is keen interest in whether SK Telecom will face a record penalty surcharge due to this incident. Under the Personal Information Protection Act, penalty surcharges can be imposed up to 3% of revenue, and revenues unrelated to the leakage case can be excluded from the calculation.
Based on SK Telecom's wireless communication business revenue of approximately 12.77 trillion won last year, analyses suggest that the penalty surcharge could reach the mid-300 billion won range. To date, the largest penalty surcharge imposed by the Personal Information Protection Commission was 100 billion won on Google and Meta in September 2022.
However, some observers suggest that if SK Telecom's measures for victim relief and prevention of recurrence after the hacking incident are reflected, the penalty surcharge may be reduced to around 100 billion won.
Chairperson Ko Hak-soo of the Personal Information Protection Commission recently noted regarding the scale of the penalty surcharge to be imposed on SK Telecom, "The level of public interest is extremely high, so we are paying close attention to it," adding, "We will impose sanctions rigorously according to the law and principles."