The Personal Information Protection Commission on Tuesday issued a statement in response to some media reports that it did not impose administrative fines for leaks totaling 3.1 million cases over the past three years at elementary, middle and high schools and education offices, including 2.96 million cases at the Gyeonggi Provincial Office of Education. It said the Gyeonggi case fell under the previous Personal Information Protection Act, before September 2023, and under the rules at the time it was not subject to administrative fines unless resident registration numbers were leaked, so only a non-punitive fine was imposed.

It added that it introduced administrative fines of up to 2 billion won for personal data leaks at public institutions from September 2023 and raised the maximum to 5 billion won for serious or repeated leak incidents from Sept. 11, 2026.

Responding to criticism that no administrative fines were imposed even though the education offices in Yongin, South Gyeongsang and Gangwon did not notify victims, it said violations of notification obligations are defined as cases subject to non-punitive fines. It said it imposed non-punitive fines and other measures on three institutions, including the Yongin Office of Education Support.

It explained that from Sept. 11, 2026, a clause increasing administrative fines by 30 percent will take effect in cases where a report or notification is not made within the deadline and measures to prevent the spread of harm are not taken.