The Personal Information Protection Commission imposed a 53.979 billion won penalty surcharge on KT, which caused leaks of customer personal information and unauthorized small-sum charges due to poor management of femtocells (small base stations). That is about 40% of the 134.791 billion won penalty surcharge levied last year for SK Telecom's USIM information leak incident. Attention is focusing on how the amount was calculated, as the personal data leak led to actual monetary damage but the penalty surcharge was set relatively low.
The Personal Information Protection Commission said on the 30th that it held a full meeting on the 29th and resolved to impose a penalty surcharge on KT for violating the safety measure obligations under the Personal Information Protection Act, along with a corrective order, improvement recommendation, and disclosure and disclosure order of the disposition. The scale of KT's personal information leak was identified as 16,647 people, including budget phone users. In addition, 368 people suffered about 240 million won in unauthorized small-sum charges.
Under the current Personal Information Protection Act, when a violation of safety measure obligations is confirmed in a personal information leak incident, the penalty surcharge is calculated by excluding sales unrelated to the violation, within a range not exceeding 3% of the average sales for the previous three years. Applying KT's recent three-year average wireless service sales of about 6.6689 trillion won on a simple basis, some projected the penalty surcharge could reach up to about 200 billion won.
However, the actual penalty surcharge was set at about 0.8% of those sales. The Personal Information Protection Commission said it calculated the final penalty surcharge by comprehensively reflecting the scale of harm from the violation and efforts at remediation.
To address the difficulty of directly sanctioning the concealment or destruction of evidence carried out before an investigation begins, the Personal Information Protection Commission said it will also push to introduce a system to impose a separate penalty surcharge of up to 3% of total sales on related businesses.
The move follows confirmation that KT and LG Uplus deleted or disposed of materials related to incidents with possible personal information leaks, hindering the investigation. In March 2024, KT did not report the malware infection to the government and deleted logs on some servers, while LG Uplus, after recognizing the personal information leak, reinstalled the operating system (OS) of relevant servers or disposed of servers before the Personal Information Protection Commission began its investigation.
The following are key questions and answers from a briefing held on the 30th at Government Complex Seoul.
—What sales were used as the standard to calculate the penalty surcharge?
"We included all of KT's 5G and LTE mobile communications sales. While femtocells are basically equipment used on LTE, in areas where 5G network facilities are not sufficiently built out, 5G services also use the LTE network. Independent sales not related to this incident, such as IPTV and internet, were excluded."
—Why was the penalty surcharge set lower than SK Telecom's even though there was monetary damage?
"Commissioners viewed the occurrence of secondary damage as very serious. However, compared with the SK Telecom incident, there were differences in the scale and type of personal information leaked. SK Telecom's damage scale reached 23 million people, and authentication information such as USIM authentication keys was leaked. In contrast, KT's leak involved 16,647 people, and the leaked information consisted of three items: mobile phone numbers, International Mobile Subscriber Identity (IMSI), and International Mobile Equipment Identity (IMEI). We also comprehensively considered KT's swift cooperation on compensation and corrective measures."
—How will the penalty surcharge be calculated for businesses that concealed or destroyed evidence before the investigation began?
"Under current law, concealing or destroying evidence during an investigation can lead to criminal punishment or fines, but acts committed before the investigation begins are difficult to sanction. Therefore, we are pushing a plan to impose a separate penalty surcharge of up to 3% of total sales, considering the degree of concealment or destruction of evidence and the illegality, when done before the investigation begins. This calculation method differs from the current personal information leak penalty surcharge, which is based only on sales related to the violation. Specific standards will be set during the legislative and enforcement decree process."
—If a new penalty surcharge for concealing or destroying evidence is created, can it be applied to the current KT and LG Uplus cases?
"As a rule, provisions that disadvantage businesses cannot be applied retroactively. Penalties and separate penalty surcharges for concealing or destroying evidence, and a reward program for reporting, will apply only to acts that occur after the law takes effect. However, if new facts are confirmed during subsequent investigations, additional dispositions may be taken accordingly."