A bill that would allow authorities to impose a penalty surcharge of up to 10% of total sales on corporations that intentionally or repeatedly cause large-scale personal data breaches passed the National Policy Committee's Bill Review Subcommittee No. 1 on the 15th in a bipartisan agreement.
The National Policy Committee's Bill Review Subcommittee No. 1 on the day reviewed and approved amendments to the Personal Information Protection Act proposed by Park Beom-kye of the Democratic Party of Korea and Kim Sang-hoon of the People Power Party, among others.
National Policy Committee Subcommittee Chairperson Kang Jun-hyeon met with reporters after the meeting and said, "The Personal Information Protection Act, the response law to the Coupang data leak, was passed today by bipartisan agreement," adding that "the ruling and opposition parties agreed that the (personal data leak situation) is extremely serious."
The centerpiece of the amendment is an overhaul of the penalty surcharge. If a serious personal data infringement occurs, a penalty surcharge of up to 10% of total sales or up to 5 billion won will be imposed. Currently, for personal data leaks, a penalty surcharge of up to 3% of total sales or up to 2 billion won can be imposed.
However, such punitive penalty surcharges are limited to cases such as ▲ repeated violations with intent or gross negligence within the past three years ▲ harm caused to 10 million or more people ▲ personal data was leaked due to failure to comply with a government corrective order. If the violation is not serious, the penalty surcharge will remain within 3% of sales as before.
The amendment also strengthens the obligation to designate a personal data protection officer and shortens the current "within 72 hours" notification deadline in the event of a data breach.
However, adding damage compensation claims to the scope of personal data "class actions" will be discussed later after compiling the Supreme Court's review opinion. Class actions are filed by consumer or civic groups, and currently only lawsuits seeking injunctions to prohibit or stop rights-infringing acts are allowed.
Chairperson Kang said, "The opposition party noted that it might be excessive to include damages within the scope of class actions along with punitive penalty surcharges," adding, "On this issue, the ruling and opposition parties agreed to introduce an amendment once the Supreme Court's related review opinion is issued."
The amendment is expected to be handled as early as the provisional National Assembly session in Jan. Chairperson Kang said, "Since it is a bipartisan agreement, there may be no major disagreement in the Judiciary Committee. If so, I expect it will be handled in the provisional session in Jan." The National Policy Committee's full session to review the amendment will be held on the 17th.
Even if the amendment later clears the plenary session, it will not apply retroactively to personal data breaches that occurred before the law takes effect.
Meanwhile, the subcommittee also passed an amendment to the "Act on the Refund of Telecommunication Fraud Damage" that grants virtual asset exchanges the authority to suspend payments on voice phishing accounts. The amendment includes virtual assets as "victim assets" of voice phishing and designates virtual asset exchanges such as Upbit and Bithumb as institutions responsible for prevention and refunds. Once the amendment passes, virtual asset exchanges will be subject to the same level of regulation as existing financial companies, including payment suspension, customer verification, and data submission.
In addition, to improve the operational efficiency of credit unions, the subcommittee approved an amendment to the Credit Unions Act that abolishes the position of vice chair of credit unions.