Dpk’s Han Jeongae: "Making Compensation for Personal Information Leaks More Effective"...Proposes Personal Information Protection Act Amendment

Clarifying Liability for Personal Information Controllers in Data Breaches
Penalizing the Illegal Distribution of Leaked Personal Information

On the 12th, Han Jeongae, Chair of the Policy Committee of the Democratic Party of Korea, announced that she had sponsored an amendment to the Personal Information Protection Act aimed at preventing secondary damage from large-scale personal information leaks and making compensation for damages more effective.

Under the current law, when personal information is lost, stolen, leaked, forged, altered, or damaged, the data subject may claim compensation for damages. However, if a company responsible for the leak claims that it fulfilled its duty of care, it is difficult for an individual to prove the company’s negligence.

Han Jeongae, Policy Committee Chair of the Democratic Party of Korea, is speaking at a party-government consultative meeting to strengthen responses to personal information breaches held on Feb. 4, 2026 at the National Assembly Members' Office Building. Photo by Kim Hyunmin

In addition, when a large amount of personal information is leaked through hacking and other means, there are concerns that it may be used for crimes on black markets such as the dark web or lead to secondary damage. Nevertheless, critics point out that the current law lacks criminal provisions for cases in which a person, knowing that it is "leaked personal information," purchases or receives it, or provides or distributes it to others.

Chair Han clarified the responsibility of personal information controllers, such as companies, for personal information leaks, and stipulated penalties for the illegal distribution of personal information that has been lost, stolen, or leaked. She also introduced a data preservation order and a system of compulsory fines for non-compliance.

Chair Han stressed, "If the amendment is passed, it is expected not only to impose strict sanctions on personal information leak incidents, but also to make remedies for victims more effective and prevent secondary damage," adding, "The party and the government will not stop at amending the Personal Information Protection Act, but will promote ex-ante protection in both the public and private sectors and strengthen preemptive preventive inspections to minimize the occurrence of leak incidents."

This content was produced with the assistance of AI translation services.