From now on, the penalty surcharge on corporations that leak personal information will be calculated based on sales in the immediately preceding fiscal year, and the application of reductions will be limited for serious violations.
The Personal Information Protection Commission said on the 18th that, starting on the 19th, revisions to the Enforcement Decree of the Personal Information Protection Act and partial amendments to the notice on standards for imposing a penalty surcharge for violations of the Personal Information Protection Act will take effect.
Under the amendment, the penalty surcharge will be calculated based on the larger of sales in the immediately preceding fiscal year or the three-year average sales over the last three fiscal years. Previously, only the three-year average sales for the three years before the fiscal year in which the violation occurred were used, creating a problem in which the calculation standard for the penalty surcharge was lower than the actual economic capacity for corporations whose sales were growing rapidly.
A basis has also been established to restrict reductions of the penalty surcharge for very serious violations where the degree of violation and the scale of harm are severe. Under current standards, cooperation with investigations or voluntary protection activities allow a reduction of the penalty surcharge, but there has been criticism that applying reduction rules uniformly even to serious incidents weakens the punitive effect and undermines corporations' efforts to prevent incidents.
Accordingly, going forward, when the seriousness of a violation is very high, reductions may not be applied in whole or in part even if there are grounds for reduction.
However, under the General Act on Public Administration, the revised rules apply to violations that occur after implementation. For violations that were completed before the revised rules take effect, the previous rules apply.
The Personal Information Protection Commission said, "These revisions to the decree and notice aim to enhance the effectiveness and accountability of sanctions for corporations' legal violations," adding, "Through imposing a penalty surcharge commensurate with corporations' current economic capacity and the degree of violation, we will respond more strictly to serious personal information infringements."