South Korea's Personal Information Protection Commission said it believes there are likely more cases in which companies are suspected of hiding or destroying evidence related to personal data leak incidents before government investigations. It also acknowledged that under current law there are not enough means to sanction evidence destruction before an investigation begins.

Song Kyung-hee (송경희), chair of the commission, told a comprehensive audit of the National Assembly's Political Affairs Committee on Oct. 21 that there were not many cases with evidence accurate enough to warrant a request for a criminal probe. She said she believes there are likely more cases that are presumed to involve such conduct, responding to a question from Democratic Party lawmaker Kang Jun-hyun (강준현) on whether there were cases beyond telecom companies.

Kang said there are not enough means to sanction companies if they conceal or destroy relevant materials before the commission begins an investigation. He said this could create a structure in which only companies that properly report personal data leaks are disadvantaged.

Song said whether a company cooperates promptly with an investigation and whether it obstructs an investigation are considered in the process of determining penalty surcharges. She added that there must be such a system because it is insufficient to actively sanction concealment and destruction.

Earlier, the commission decided in July to file a complaint after confirming that KT did not report a 2024 malware infection and deleted logs from some servers or submitted false materials.

It also found signs that LG Uplus destroyed evidence, including reinstalling the operating system on related servers or discarding servers before the commission began its investigation, and requested an investigation by investigative authorities.

The current Personal Information Protection Act provides a basis for sanctions for refusing to submit materials or obstructing an investigation after the commission begins its probe. But it has limits in directly sanctioning concealment or destruction of evidence that occurs before an investigation is launched.

The commission has previously said it would pursue institutional improvements within this year to address this gap when it took action against KT and LG Uplus.