When my money and personal information were compromised... for whom is the thousands-of-billions-won fine a 'severe punishment'?

Banking institutions are also not free from the burden of the government's "strict administrative punishment." More than 97% of accounts affected by the incomplete sales of Hong Kong H-Index equity-linked securities (ELS) have agreed to voluntary compensation, and although the Fair Trade Commission determined that it is difficult to accurately calculate the losses suffered by borrowers in the loan-to-value ratio (LTV) information exchange cartel, fines amounting to hundreds of billions of won are expected. Excessive fines are reducing the capacity for productive finance that supplies capital to businesses and inclusive finance that supports vulnerable groups.

According to the financial sector on the 6th, the Financial Services Commission is reviewing a proposal to impose administrative fines on five Hong Kong ELS-selling banks: KB Kookmin Bank, Shinhan Bank, Hana Bank, NH Agricultural Cooperative Bank, and Standard Chartered Bank Korea. The scale of the fine was initially around 2 trillion won during the prior notification stage by the Financial Supervisory Service but was reduced to approximately 1.4 trillion won after going through the Sanctions Deliberation Committee. Subsequently, the Financial Services Commission requested supplementary information on legal grounds and factual circumstances, prompting the Financial Supervisory Service to conduct a rehearing, which resulted in the fine being lowered further to around 60 billion won.

However, the banking sector still voices opinions that the fine is at a "punitive level." The five banks sold approximately 19 trillion won worth of Hong Kong ELS products over four years from 2021, earning about 200 billion won in commission revenue. They are now facing a situation where they must pay fines amounting to roughly three times the profits they earned.

Financial authorities amended regulations last November to include post-harm relief as a mitigating factor for administrative fines, but there are complaints that this was not sufficiently reflected. The five banks that sold ELS had already reached agreements on voluntary compensation with 162,973 out of a total of 169,594 accounts by June last year, before the fines were notified in advance. As of the end of January this year, agreements on compensation had been reached with 164,845 accounts (97.2%).

Criticism is being raised that the administrative fine for the LTV collusion is excessive compared to the actual benefits gained by the banking sector. The Korea Fair Trade Commission imposed a total fine of 272 billion won on Kookmin, Shinhan, Hana, and Woori Banks in January, stating that they exchanged LTV information from 2022 to 2024, generating a total interest income of 6.8 trillion won through real estate collateral loans. However, the Korea Fair Trade Commission acknowledged that it is difficult to accurately quantify the damages suffered by borrowers in monetary terms and admitted that the actual scale of profits gained through collusion cannot be determined. The banking sector argues instead that due to information exchange, LTV ratios were lowered, resulting in reduced profits related to lending.

In addition, the results of the deliberation on the collusion by banks regarding government bonds are expected to be announced soon. Fines may also be imposed. Consecutive fines not only affect bank profits and losses but also negatively impact "productive finance," a key government initiative. Assuming a 100 billion won decrease in net income and domestic banks maintaining their CET1 ratio at an average of 14.5 percent, approximately 690 billion won worth of RWA would need to be reduced or additional capital raised. Converted into corporate loans with a risk-weighted asset level of around 43 percent, this implies a reduction in lending capacity of about 1.6 trillion won. In particular, SMEs (small and medium-sized enterprises) lacking sufficient collateral or with low credit ratings, as well as early-stage innovative companies with strong technological capabilities but fragile financial structures, could be more significantly affected by the contraction in funding supply.

Inclusive finance is also influenced by capital adequacy. Low- and medium-grade borrowers and small business owners, among others, have a relatively higher risk of loan defaults, making them significant capital burdens for banks. If banks adjust their loan portfolios to meet capital ratio requirements, they are likely to adopt a conservative approach toward issuing new loans or extending maturities for these borrowers.

A banking official said, "The banking sector has already set aside more than 1 trillion won in reserves for ELS and LTV," adding, "It makes no policy sense to deplete banks' capital flexibility through fines while simultaneously urging them to expand productive finance."

Some of the stringent sanctions imposed by financial authorities on chief executive officers (CEOs) of financial firms in response to financial scandals have lost their effect after years of legal disputes. Although the stated rationale was to hold parties strictly accountable for massive investor losses, there have been cases where the legal grounds applied by financial regulators were not accepted by the courts.

The penalties have an immediate impact on business activities and employment in the financial sector, but correcting erroneous penalties can take years. Despite the strict administrative enforcement by financial authorities with strong regulatory powers, there are calls for corresponding accountability.

◆ CEO severe disciplinary actions repeatedly overturned by courts

A representative case is the Loom·Optimus scandal. The Financial Services Commission imposed a three-month suspension on former KB Securities CEO Park Jung-rim regarding the Loom Fund incident and issued a reprimand to former NH Investment & Securities CEO Jeong Young-chaey regarding the Optimus incident, citing violations of obligations to establish internal control standards as grounds for severe disciplinary action.

The financial authorities determined that internal controls at the selling financial firms failed to function properly and that executives bear responsibility in the private fund crisis involving significant losses for large-scale investors. A reprimand warning is a severe penalty that restricts the future appointment of financial firm executives beyond mere disciplinary action.

However, the court's ruling was different. Park Jeon (CEO) and Jung Jeon (CEO) both won their administrative lawsuits against the Financial Services Commission (FSC) in the first and second instances. The FSC appealed to the Supreme Court, but in April, both cases were dismissed for lack of grounds for review. The two severe disciplinary actions were cancelled in both the first and second instances, and ultimately cancelled when the Supreme Court did not accept the FSC's appeal. Park Jeon (CEO)'s case was finalized by the Supreme Court on April 9, and Jung Jeon (CEO)'s case was finalized on April 2.

In particular, the first-instance court in the Park Jeon (CEO) case ruled that deeming the failure to establish more effective internal control standards as a violation of obligations amounts to "punishment based on ex post facto evaluation." The ruling emphasized that the obligation to establish internal control standards should not be interpreted expansively to the detriment of the party subject to the sanction.

This is not the first time that a court has halted sanctions on internal control responsibilities imposed by financial authorities. Former Woori Financial Holdings Chairman Son Tae-seung filed a lawsuit challenging a disciplinary warning related to the foreign interest rate-linked derivative fund (DLF) crisis and ultimately won at the Supreme Court in 2022. At that time, the Supreme Court ruled that under the existing legal framework, there must be a distinction between the "obligation to establish" internal control standards and the "obligation to comply" with them.

◆ Sanctions take effect immediately; relief comes years later

The cancellation of sanctions does not erase the uncertainty that has already materialized. Park Jeon (CEO) received a four-year suspension from duty, and Jung Jeon (CEO) was given a disciplinary warning; both are severe penalties restricting their eligibility to serve as executives at financial institutions for four and three years, respectively. From the moment the sanctions were imposed, they have directly affected the individuals' management activities and future career decisions.

On the other hand, to overturn a penalty, one must go through an application for suspension of execution and an administrative lawsuit. In the cases of Park Jeon (CEO) and Jung Jeon (CEO), it took more than two years from the November 2023 sanctions until the Supreme Court's final ruling in April this year. The court also ruled in Park Jeon (CEO)'s suspension of execution case that even if he were to win on the merits, there was a risk of "irreparable harm" should the penalty be upheld.

In the financial investment industry, there are concerns that holding individuals strictly accountable for financial incidents should be distinguished from expanding legal regulations after an incident to identify responsible parties. As pressure mounts to hold executives accountable in major financial scandals, there are worries that the severity of sanctions may precede legal reasoning.

Critics also point out that unpredictable sanctions can make financial institutions' decision-making more conservative. A representative from the financial investment industry said, "If the government urges financial companies to take on active risks and expand productive finance while simultaneously increasing the risk of post-facto sanctions, financial companies may become passive in pursuing new businesses and investments."

Holding financial authorities strictly accountable for financial misconduct and enhancing the accountability of institutional investors for regulatory violations are not mutually exclusive. It is pointed out that the stronger a financial authority's regulatory powers, the more it needs to practice "accountable administration" — one that rigorously adheres to legal principles and the scope of responsibility from the very stage of imposing penalties, rather than simply issuing severe disciplinary measures first.

The Personal Information Protection Commission has imposed administrative fines totaling approximately 759 billion won on companies through August this year. This figure is 112 times the 6.8 trillion won levied in its first year of operation, 2020. It can take four to five years for the legality of such penalties to be finally confirmed, as companies often file lawsuits. Starting from the 11th, punitive fines of up to 10 percent of a company's sales will be imposed on repeat violations within three years or cases involving damage to more than 10 million people.

On the 6th, the Personal Information Protection Commission confirmed to Money Today that the total amount of administrative fines levied annually are as follows: △2020: 6.8 trillion won; △2021: 8.2 billion won; △2022: 101.8 billion won; △2023: 23.2 billion won; △2024: 61.2 billion won; △2025: 167.8 billion won; and △2026 (as of August): 758.9 billion won. The case involving the data of 37.55 million customers at Coupang accounted for 82% of this year's total amount. These figures exclude fines imposed based on voting decisions.

As of late July, there are 17 lawsuits filed in response to enforcement actions. Of the six cases that received first-instance rulings — involving Google, Meta (2 cases), Samsung Electronics, Kakao, and Kakao Pay — the Personal Information Protection Commission won all of them, yet every company that lost has filed an appeal. Since the establishment of the Personal Information Protection Commission, six out of ten administrative fines exceeding 5 billion won issued by the end of 2024 have resulted in lawsuits. Not a single objection requesting a re-examination was submitted to the Personal Information Protection Commission as an alternative to litigation.

Litigation takes a long time. The lawsuit between Google (69.2 billion won) and Meta (30.8 billion won), which began in September 2022, remains at the second instance even after four years have passed. It took four years and three months for the Supreme Court to confirm that the 6.7 billion won fine imposed on Facebook in 2020 was lawful. The Golfzon case (7.5 billion won) is still at the first instance two years after the administrative decision. The SK Telecom case, which filed a lawsuit in January this year (134.8 billion won), and the Coupang case, for which litigation has been anticipated, are expected to reach a conclusion around 2030.

As lawsuits drag on, the government's burden of response also increases. The litigation team at the Personal Information Protection Commission consists of six members, and this year's litigation budget is approximately 800 million won. A representative from the Personal Information Protection Commission stated, "It is difficult to consider that personnel and budget are sufficient," explaining that they must respond with far fewer staff and resources compared to global and big tech companies that have hired large law firms. The Personal Information Protection Commission announced that it is currently in discussions with relevant ministries regarding an increase in personnel and expansion of the budget.

If a court overturns an administrative disposition, the recipient must return the amount received along with accrued interest. There have been three cases where the Personal Information Protection Commission's dispositions were revoked or reduced by courts and became final: Wemake (1.852 billion won), KT (70 million won), and Eastsoft (112 million won). The principal amounts returned total 2.034 billion won, to which interest at an annual rate of 3.1 percent is added. All three cases involved disputes over administrative penalties originally imposed by the Korea Communications Commission before the establishment of the Personal Information Protection Commission in 2020.

There are two main reasons why companies do not give up on lawsuits: first, because overturned precedents exist, and second, because accepting excessive fines as they stand could constitute breach of trust. In November 2018, Wemakeprice was fined 1.852 billion won after a configuration error on an event page exposed the personal information of 20 customers to 29 other users. The Supreme Court ruled that while imposing fines based on total sales across all shopping malls is lawful, it determined that "the punitive nature was overly emphasized, resulting in a calculation that was excessively severe relative to the degree of illegality," noting that the error lasted only one day and that no resident registration numbers or passwords were leaked. The cancellation of the fine penalty was finalized in October 2023.

The fact that the penalty amount has increased does not necessarily provide significant help in restoring damages. Fines go into the national treasury, and victims whose information was leaked must file separate civil lawsuits to receive compensation. While the government and companies dispute the legality of the penalties and the amounts involved, victims are required to pursue relief procedures separately. This means that alongside strengthening sanctions, there is a need for mechanisms to accelerate corporate security improvements and lead victim relief efforts.

Abroad, there are mechanisms to resolve disputes before they go to court. In the United States, privacy-related sanctions are concluded through settlements rather than litigation. A Columbia Law Review article reported that among 154 cases filed by the Federal Trade Commission (FTC) regarding personal information, only six ended without a settlement. The Personal Information Protection Commission previously lacked a consent agreement system that would reduce sanctions if companies proposed their own corrective measures. It was only in July that the introduction of such a system was officially formalized. Whether the consent agreement can actually lead to swift improvements and compensation remains the key issue.