Tving, which suffered a large-scale personal data leak, drew criticism at a National Assembly audit for offering compensation such as coupons that encourage use of its own services, even as it invested 450 billion won to secure exclusive Korea Baseball Organization broadcasting rights. After accusations it inflated the compensation amount, it also faced suspicions that extending the application period was a ploy to seek a reduction in administrative fines.

At an audit by the National Assembly's Political Affairs Committee on Monday, Democratic Party lawmaker Kim Hyun-jung (김현정) pressed Tving CEO Choi Joo-hee (최주희) on the effectiveness of the compensation plan for victims of the data leak.

Tving said in May that personal information was leaked from 39.54 million accounts, including active, dormant and cancelled members. It estimated the number of affected people, excluding duplicates, at about 19.53 million.

Tving is offering an insurance product, Tving points, partner coupons and premium viewing features. Some benefits require paid subscriptions or additional payments, and former members must rejoin to apply for compensation, prompting criticism that the measures encourage use of its services rather than provide practical relief.

Kim cited Tving's decision to extend its KBO broadcasting rights from 1.35 trillion won over 3 years to about 450 billion won over 5 years starting in 2027. She said it was a point for public reproach that the company says it is running losses while being stingy with compensation and spending 90 billion won a year.

She also questioned why Tving extended the compensation application period by 1 month from its original end date in late September. Only 2,752,030 of the estimated 19.53 million victims applied during the first application period, for an application rate of 14.1 percent.

Kim said deceptive marketing tactics and a crafty extension should never be allowed to be rebranded as voluntary efforts to remedy harm and become a pretext to cut fines by even 1 won.

Kim also asked Choi to review additional, substantive compensation measures before the comprehensive audit, and urged the privacy watchdog to impose strict sanctions if the compensation is not effective.

Choi said she was sorry that the compensation level did not meet the public's expectations.

Personal Information Protection Commission Chairperson Song Kyung-hee (송경희) said that if the plan is not effective, it would not be easy to take it into account simply because compensation was provided. She added that the commission would make an overall judgment on whether to reduce fines, saying it also needs to consider incentives for companies to voluntarily remedy harm. She said the disposition on the Tving leak would be completed within the year.

The method used to calculate the compensation amount also came under fire. Social Democratic Party lawmaker Han Chang-min (한창민) took issue with Tving presenting a compensation plan worth 390.6 billion won, based on calculating benefits worth about 20,000 won per person for 19.53 million estimated victims.

He said Tving added up benefits as if all victims would receive the same package even though conditions and eligible recipients differ by item, including insurance, points and coupons. Han also said the company did not submit detailed data such as the actual number of recipients and coupon usage results, and pressed it on the basis for its compensation calculations.

Lawmakers also raised the question of responsibility at the CJ Group level. Democratic Party lawmaker Han Min-soo (한민수) cited the leak of information from 8.63 million accounts registered with Tving through CJ One integrated membership and asked whether it is one CJ when gathering customers but separate companies when information is leaked.

Han criticised CJ Group for sharing benefits through the integrated membership system while seeking to limit responsibility for the leak to Tving. Choi said she did not attend related meetings in person, and Song said the commission would thoroughly investigate the flow of CJ One integrated membership information and responsibility of the relevant legal entities.

The handling of personal information from cancelled members also became an issue. Kim said Tving's retention of information on cancelled members must be strictly reviewed for legality in light of obligations under the Personal Information Protection Act to destroy such data.

Choi said that when there is transaction history or customer complaints, the company must retain information for 5 years under relevant laws. Song said the commission would expand inspections of whether companies that process personal information on a large scale comply with destruction obligations.