"In recent years, repeated data breaches have caused significant anxiety among citizens. Both the government and businesses must take this matter seriously."
Song Kyung-hee, Chairperson of the Personal Information Protection Commission, held a meeting with CEOs of the three major telecom operators (SK Telecom, KT, and LG Uplus) on the 28th at the Korea Press Center in Jung-gu, Seoul, and made these remarks. This was the first formal communication session between the commission and corporate CEOs. Song stated, "The telecommunications industry is a core foundation of digital society that directly impacts citizens' daily lives," adding, "Protecting personal information in the telecom sector is essential to safeguarding citizens' everyday lives and the digital society."
The Personal Information Protection Commission plans to expand its outreach to other industries. Lee Sang-min, Chairperson of the Personal Information Protection Commission, said, "With frequent data breach incidents occurring, restoring public trust is our duty as the information authority," and added, "Although no specific schedule has been set yet, we will proceed with meetings with representatives from other industries as coordination progresses. We will not limit these engagements to formal formats."
During the meeting, the three major telecom operators expressed concerns about insufficient time and personnel at the Personal Information Protection Commission. They noted that the telecommunications industry relies on legacy systems over 20 years old alongside cutting-edge technologies, making comprehensive improvements difficult to implement all at once. Additionally, they highlighted a shortage of information security professionals, leading to slow recruitment efforts. Song conveyed, "From the telecom operators' perspective, ensuring network stability is their top priority, and strengthening personal information protection could potentially undermine this," adding, "They requested the government's collaborative support."
The three major telecom operators also emphasized the need for a pre-consultation framework to ensure the effective operation of the AI-specific exemption scheduled to take effect on March 9 next year. The Personal Information Protection Commission is currently working to concretize the enforcement decree and related notices. Director Lee explained, "We are discussing what specific safety measures the exemption requires, how risk factors will be evaluated, and what criteria will apply."
On this occasion, Song Kyung-hee and representatives from the three major telecom operators agreed that protection systems must shift from post-incident response to proactive prevention. Jung Jae-heon, CEO of SK Telecom, stated, "Once a data breach occurs, no amount of effective response afterward can fully restore lost public trust," adding, "The best personal information protection involves preemptively blocking risks through advance measures."
The three major telecom operators also proposed the need for a public-private communication channel. In response, Director Lee clarified, "While direct negotiations between the three telecom CEOs and Song Kyung-hee are not planned, the commission is maintaining continuous communication with each company's Chief Privacy Officer (CPO)."
Additionally, the meeting broadly discussed measures including: establishing internal controls to prevent recurrence of data breaches and building a proactive protection system; systematic management across the entire telecommunications distribution network; cultivating personal information protection talent; and constructing a public-private cooperation framework to address personal information issues.
Meanwhile, the Personal Information Protection Commission has been implementing the revised Personal Information Protection Act since the 11th. The core provision allows for administrative fines of up to 10% of a company's annual revenue in cases of data breaches. Other strengthened measures include explicit CEO accountability, enhanced roles for Chief Privacy Officers (CPOs), and the introduction of mandatory reporting systems, all reinforcing corporate internal control obligations.
in TECH
