With large-scale personal information leaks recurring, the government's prevention and oversight system and the effectiveness of sanctions came under scrutiny during a parliamentary audit. Lawmakers raised concerns that penalties are inadequate to prevent companies from concealing leaks or obstructing investigations, and that accountability measures for those responsible at public institutions are also insufficient. The Personal Information Protection Commission said it recognised the limits of the current protection system and would strengthen a sanctions- and prevention-focused management framework.

At an audit held on Oct. 13 by the National Assembly's Political Affairs Committee for the commission and the Office for Government Policy Coordination, ruling and opposition lawmakers pressed the government over its responsibility for managing repeated leak incidents and the effectiveness of its response.

Cho Jung-hoon (조정훈), a lawmaker from the People Power Party, questioned policy performance, saying the commission's budget rose 45 percent over the past 5 years but personal information leaks continue to recur.

He also said it took more than a month to inform the public of an information leak involving Government24 in August, criticising the government for failing to properly meet obligations to protect personal information and notify victims.

Cho rebuked the commission, saying, "Why does the Personal Information Protection Commission even exist?" and "What results have you achieved?" He also said there are limits to trying to solve personal information leaks only by imposing punitive penalty surcharges of up to 10 percent of revenue.

Song Kyung-hee (송경희), chair of the commission, replied that she was aware notification on Government24 was delayed. She said security investment has been very insufficient compared with investment in IT development, and that problems have accumulated as personal information protection and management systems have lagged behind.

◆Hefty penalty surcharges for companies, limited discipline for public institution officials

The effectiveness of sanctions for personal information leaks at public institutions also became an issue.

Seo Il-jun (서일준), a People Power Party lawmaker, cited materials submitted by the commission and said about 7.72 million cases of information were leaked across 128 personal information leak incidents at public institutions from 2022 through August this year, but recommendations for disciplining those responsible amounted to only 2 cases.

Seo said public institutions effectively receive preferential treatment because discipline is not carried out even when leaks occur, and raised the gap in sanction levels between private companies and public institutions.

Song said that of 20 cases in which discipline was requested, seven institutions accepted the requests. She said she would submit relevant materials to explain because there was a difference with Seo's tally.

She also added that public institutions have no revenue so fixed-amount penalty surcharges are applied, and the system is being improved in a direction that strengthens discipline for responsible staff and accountability for institutions.

◆Limits to sanctions even if leaks are concealed; push to strengthen investigative powers

A sanction gap also emerged over companies concealing personal information leaks and obstructing investigations.

Kim Yong-man (김용만), a Democratic Party lawmaker, pointed to KT, saying it did not report after recognising in March 2024 that 38 servers were infected with malware, and that signs of obstruction were confirmed, including deletion of logs from some compromised servers.

He said KT initially told investigators there were no preserved materials but later submitted separately stored materials after log deletion was discovered, and argued penalties should be strengthened for intentional concealment of leaks.

KT's chief information security officer, who appeared as a witness, acknowledged shortcomings in the response and measures at the time. He said it was difficult to answer in detail on whether there was an organised cover-up because an investigation was under way.

Song also acknowledged there is insufficient basis for separate sanctions against acts such as hiding or destroying evidence before an investigation begins. She said revisions to the Personal Information Protection Act are needed to impose penalty surcharges for such conduct and raise the coercive power of investigations.

The commission imposed a total of 747 billion won in penalty surcharges through August this year. That far exceeds the annual total of 167.8 billion won last year. Since September, a punitive penalty surcharge system of up to 10 percent of revenue has also been implemented for serious and repeated violations.

The commission is also pushing to introduce evidence preservation orders and enforcement fines for non-cooperation with investigations. It plans to form dedicated investigation teams for major cases, including large-scale leaks of more than 1 million cases, to respond quickly.

◆Separate reporting by ministry; need for integrated response system raised

Concerns were also raised that initial response is inefficient because duties for responding to personal information leak incidents are scattered across multiple government agencies.

Yoo Dong-soo (유동soo), a Democratic Party lawmaker, said laws and reporting agencies differ for personal information, personal credit information and network intrusion incidents, forcing companies to file duplicate reports to multiple agencies for the same incident.

Yoo cited an example in which five of seven financial companies recently reported to both the commission and financial authorities. He proposed building a one-stop reporting system in which reporting to one agency would share information with related agencies.

Song said the point at which hacking and personal information leaks are recognised can differ, but agreed there is a need to link common reporting information to related agencies.

She said relevant ministries must discuss whether one report can go to all relevant agencies and implement it systematically, and added she would work to put such a system in place.

Song also said in a work report that day that she feels a heavy sense of responsibility over recent personal information leak incidents. She said the commission would cooperate with relevant ministries on finance and security to investigate incidents and prevent the spread of harm.

She also said it would pursue setting up an integrated fund worth 15.8 billion won to be used for relief of victims' rights, accident prevention and rewards for reporting the concealment or destruction of evidence. It also plans to strengthen advance inspections of public institutions and large-scale personal information processors.