Personal Information Protection Commission Establishes Sanction Criteria for Minor Violations

[Asia Economy Reporter Eunmo Koo] On the 8th, the Personal Information Protection Commission held the 15th full meeting of the commission at the Government Seoul Office and decided that in cases where violations of the Personal Information Protection Act by information and communication service providers are minor, fines can be replaced with corrective orders and only administrative fines may be imposed.

The minor violations for which the commission may choose not to impose fines include ▲cases where the final calculated fine amount is 3 million KRW or less ▲violations caused by trivial mistakes or system errors with minimal damage ▲cases where the scale of personal information leakage is fewer than 100 cases. However, although specific criteria are established, fines will not be automatically waived; the decision on whether to impose fines will be made comprehensively considering the details and extent of damage on a case-by-case basis.

At the meeting, the commission applied this standard for the first time to six businesses that leaked personal information but whose violations were minor, deciding not to impose fines but instead issuing corrective measures including administrative fines totaling 48 million KRW, corrective orders, and public announcements. Three of these businesses used survey forms such as ‘Naver Form’ and ‘Google Form’ and set the survey option to ‘public,’ which allowed personal information of survey participants (within 100 cases) to be viewed mutually. The other three businesses had personal information leaks but the calculated fine amount was 3 million KRW or less, thus meeting the criteria for non-imposition of fines.

Song Sang-hoon, Director of the Investigation and Coordination Bureau at the Personal Information Protection Commission, stated, “We have established criteria for non-imposition of fines for minor violations and applied them for the first time to six businesses.” He added, “When amending the Personal Information Protection Act, we plan to shift from criminal penalties to economic penalties and even if fines are imposed based on total sales, we will promote non-imposition of fines in cases where the degree of violation and damage scale are minor.”

This content was produced with the assistance of AI translation services.