Government sanctions on KT over last year's personal information leak and unauthorized small-amount payment incidents are expected to be finalized as early as the end of this month. The statutory maximum penalty surcharge, simply calculated based on revenue related to the violations, is about 200 billion won, but the actual amount imposed is expected to vary depending on the circumstances of the incident, the scale of damage, and follow-up measures.
According to the industry on the 19th, the Personal Information Protection Commission is expected to hold a plenary meeting on the 29th to deliberate and decide on sanctions against KT, including a penalty surcharge and corrective orders, for violations of the Personal Information Protection Act. After completing its investigation in May, the Personal Information Protection Commission sent KT a prior notice of disposition and is reviewing the explanatory materials the company submitted. If it determines that additional review is needed, the decision could be delayed.
At KT, a personal information leak and unauthorized small-amount payments occurred in September last year using illegal ultra-small base stations (femtocells). A public-private joint investigation team under the Ministry of Science and ICT found that through 20 illegal femtocells, phone numbers and international mobile subscriber identity (IMSI) numbers, as well as international mobile equipment identity (IMEI) numbers, for 22,227 lines were leaked.
Among them, 368 people suffered a total of 777 cases of unauthorized small-amount payments amounting to 243.19 million won due to intercepted payment authentication text messages and calls. The Personal Information Protection Commission is said to have calculated the number of data subjects whose personal information was leaked at a little over 16,000, excluding cases where one person held multiple lines and corporate lines.
Under the Personal Information Protection Act, the Personal Information Protection Commission can impose a penalty surcharge of up to 3% of the revenue related to the violations. KT's average annual wireless service revenue over the past three years is about 6.6689 trillion won. Based on this simple calculation, the upper limit of the penalty surcharge is about 200 billion won.
However, the actual penalty surcharge is determined by reflecting the scope of revenue directly related to the violations, the duration and severity of the violations, the scale of damage, and factors for aggravation or mitigation. The facts that KT failed to block illegal femtocells from accessing its internal network and that the leaked identification information was directly used for unauthorized payments could raise the level of sanctions.
The public-private joint investigation team noted that the femtocells supplied to KT used the same certificate and that the certificate validity period was set at 10 years, enabling illegal equipment to access the internal network. It also confirmed that KT did not report to authorities even after discovering 43 servers infected with malware in the past, and that the incident report was delayed.
Reporting the server disposal date inaccurately and failing to submit related backup logs could also work to KT's disadvantage. In connection with this, the investigation team determined there were indications that KT interfered with the government's investigation and referred the case to investigative authorities on suspicion of obstruction of official duties by fraudulent means.
On the other hand, KT's compensation of customers for unauthorized payment amounts and its implementation of relief measures such as free USIM replacement and waiver of cancellation penalties could be considered as mitigating factors. Recurrence prevention measures, including blocking illegal femtocell access, expanding investment in information protection, and launching a security advisory committee, are also expected to be reflected in the sanction level.
Previously, the Personal Information Protection Commission imposed a 134.8 billion won penalty surcharge on SK Telecom for a large-scale personal information leak. The current largest penalty surcharge is 624.7 billion won, imposed on Coupang for a leak affecting 37.56 million people. Even if the Personal Information Protection Commission finalizes the sanctions, if KT files an administrative appeal or brings an administrative lawsuit, it could lead to legal disputes over the basis for calculating the penalty surcharge and the scope of liability.