Controversy erupted when the CEO of Duo, a matchmaking service where sensitive personal information—including income, assets, and marital status—of approximately 420,000 members was leaked, responded to inquiries regarding compensation plans at the National Assembly's Ministry of Science and ICT and Korea Communications Commission national audit on the 6th by stating that "what members want is to find a good partner." As criticism mounted over Duo's complacent attitude and the "light punishment" imposed, the issue of reverse discrimination compared to Coupang, an e-commerce company recently subjected to high-intensity investigations resulting in a record-breaking fine of 620 billion won due to recent information leak incidents, has been raised. Opinions also suggest that to heighten corporate awareness of information security, investigations should be conducted rigorously using the same verification standards as those applied to Coupang, and fine determination criteria should comprehensively consider factors such as the sensitivity of the leaked information, potential for secondary harm exploitation, and actual damage cases, rather than revenue.
According to the Personal Information Protection Commission (PIPC) on the 7th, in January last year, a work PC used by an employee handling personal information at Duo was hacked, resulting in the leakage of personal data belonging to 427,464 regular members. The leaked information included more than 10 types of data, such as IDs and passwords, names, dates of birth, encrypted resident registration numbers, addresses, height and weight, blood type, religion, hobbies, marriage history, sibling relationships, schools attended, majors, and workplace names. For some members, sensitive information that could lead to secondary harm, including the names of former spouses, reasons for divorce, annual income, assets, and health status, was leaked. It was also confirmed that Duo had failed to dispose of 298,566 pieces of personal information it had held for more than five years. In response, the PIPC imposed a fine of 1.197 billion won and an administrative penalty fee of 13.2 million won on Duo. Duo filed an administrative lawsuit in July last month, contesting the sanction.
Considering these points, it is pointed out that the PIPC should conduct thorough investigations and promote preventive measures against recurrence for information leak incidents while simultaneously improving its sanction criteria. Seo Jong-hee, a professor at Yonsei University Law School Moon Dae-hak-won (Prof.), stated, "It is necessary to examine whether the results sufficiently reflect the nature of the leaked information, whether actual damage occurred, and the company's post-incident response efforts," adding, "The method of calculating fines based on revenue, regardless of the business operator's profit or loss, leaves room for misunderstanding that it constitutes an excessive sanction only for specific companies." Cho Dong-geun, a professor emeritus in the Department of Economics at Myongji University, said, "The revenue of a company involved in an information leak has no direct relationship with the damage suffered by consumers," and stated, "The criteria for determining the amount of fines should be the severity of the infringement act and the actual damage." He added, "If administrative sanctions prioritize the logic that 'large companies pay large fines,' there is a risk that fines will degenerate into a kind of 'size tax.'"
in INDUSTRY
