The Personal Information Protection Commission has imposed approximately 759 billion won in fines on companies through August this year, a 112-fold increase from the 68 billion won levied in its inaugural year of 2020. Final confirmation of the legality of penalties can take four to five years due to companies filing lawsuits. Starting the 1st, punitive fines of up to 10% of revenue will be imposed for repeat violations within three years or cases causing harm to over 10 million people.
According to figures confirmed by the Personal Information Protection Commission to MoneyToday on the 6th, annual total fines were: △2020: 68 billion won △2021: 82 billion won △2022: 101.8 billion won △2023: 23.2 billion won △2024: 61.2 billion won △2025: 167.8 billion won △2026 (as of August): 758.9 billion won. The Coupang case involving data leaks from 37.55 million customers accounts for 624.7 billion won, representing 82% of this year's total. These figures exclude administrative fines based on voting decisions.
As of late July, there are 17 ongoing lawsuits filed in response to penalties. Of the six first-instance rulings involving Google, Meta (two cases), Samsung Electronics, Kakao, and Kakao Pay, all were won by the Personal Information Protection Commission, yet every losing company has appealed. Since the establishment of the Personal Information Protection Commission, six out of ten cases involving fines exceeding 50 billion won through the end of 2024 proceeded to litigation. Not a single objection requesting reconsideration was filed directly with the commission instead of pursuing legal action.
Litigation is time-consuming. The lawsuits against Google (69.2 billion won) and Meta (30.8 billion won), initiated in September 2022, remain at the second-instance level even after four years. It took four years and three months for the Supreme Court to confirm the legality of the 6.7 billion won fine imposed on Facebook in 2020. The Golfzon case (7.5 billion won) remains at first instance more than two years after the penalty was issued. Cases filed by SK Telecom (134.8 billion won) in January this year and the anticipated Coupang lawsuit are not expected to reach a conclusion until around 2030.
Prolonged litigation increases the government's response burden. The Personal Information Protection Commission's legal team consists of only six members, with an annual budget for legal proceedings of approximately 800 million won. A commission official stated, "It is difficult to consider our personnel and budget sufficient," noting that they must respond to global and big-tech companies represented by major law firms with far fewer resources. The commission has announced it is in discussions with relevant ministries to increase staffing and expand the budget.
If a court overturns a penalty, the government must return the amount collected plus accrued interest. There have been three cases where the Personal Information Protection Commission's penalties were annulled or reduced by courts: Wemakeprice (1.852 billion won), KT (70 million won), and Eastsoft (112 million won). The principal amounts returned total 2.034 billion won, with additional interest accruing at an annual rate of 3.1%. All three cases involved disputes over penalties originally imposed by the Korea Communications Commission before the establishment of the Personal Information Protection Commission in 2020.
Companies persist in litigation for two primary reasons: there are precedents where penalties were overturned, and accepting excessive fines without challenge could constitute breach of fiduciary duty. In November 2018, Wemakeprice was fined 1.852 billion won after an error on its event page exposed the personal information of 20 customers to 29 other users. While the Supreme Court ruled that calculating the fine based on total mall revenue was legal, it also determined that since the error lasted only one day and did not involve leaked resident registration numbers or passwords, "the punitive nature was overly emphasized, resulting in a calculation disproportionately severe relative to the degree of illegality." The penalty cancellation was finalized in October 2023.
Increasing penalty amounts does not significantly aid victim compensation. Fines go directly into the national treasury, while victims whose data was leaked must file separate civil lawsuits to seek compensation. While the government and companies dispute the legality and amount of penalties, victims are forced to pursue separate remediation procedures. This underscores the need for mechanisms that accelerate corporate security improvements alongside stricter sanctions and facilitate victim relief.
Abroad, there are mechanisms to resolve disputes before litigation. In the United States, personal data penalties are typically concluded through settlements rather than lawsuits. A Columbia Law Review article reported that out of 154 FTC cases involving personal data violations, only six ended without settlement. The Personal Information Protection Commission previously lacked a consent resolution system that would reduce penalties if companies proposed self-correction measures. This system was officially introduced only last July. Whether the consent resolution mechanism can effectively and swiftly drive actual improvements and compensation remains the critical issue.
in TECH
