[DigitalToday reporter Jin-ho Lee (이진호)] The Personal Information Protection Commission is expected to finalise this month the size of an administrative fine over KT’s hacking incident. The industry is watching the level of sanctions on KT after the commission earlier imposed a fine of more than 130 billion won over SK Telecom’s hacking case.

Telecommunications industry and government sources said on July 7 that the commission is known to be preparing to table a sanctions plan for KT’s hacking incident at a full commission meeting by the third week of this month at the latest and to finalise the fine amount.

The commission last year imposed a 134.8 billion won administrative fine and a 9,600,000 won penalty on SKT after it suffered a USIM hacking incident. At the time, the commission judged that more than 23 million users’ USIM information and other data were leaked due to poor management of core mobile networks and systems.

Under the current system, the possibility of a fine in the 100 billion won range for KT is also being discussed. The Personal Information Protection Act allows a fine of up to 3 percent, based on total revenue excluding revenue unrelated to the violation, for violations such as personal data leaks.

KT’s average wireless service revenue for the three years before a small-payment incident via femtocells, or ultra-small base stations, occurred last year was about 6.5 trillion won. That would allow a fine of up to 195 billion won arithmetically. Still, the prevailing view is that the actual fine will be set at a lower level. KT’s case could take into account that corporate lines were excluded from the scope of the personal data leak and that the scale of damage was relatively smaller than in the SKT case. Some in the industry also expect the sanctions to come in below 100 billion won.

A key issue is how much the commission recognises KT’s incident response and follow-up measures as mitigating factors. In its review, the commission is expected to focus on whether KT fulfilled obligations for necessary safety measures to protect personal data and whether user notification after the incident was recognised and steps to prevent further damage were appropriate.

After the incident, KT implemented a measure to waive contract termination fees and ran a customer compensation programme. It also stressed a policy to expand security investment. More recently, it disclosed at a press briefing a plan to invest 4 trillion won in information protection over three years.

For KT, in particular, the size of the fine is expected to be a watershed for future business restructuring. KT is expected to focus on reducing the size of sanctions through administrative litigation even after the fine is finalised. It needs a final fine amount to remove uncertainty to accelerate investment again in key businesses such as an AI transformation (AX) company, as well as mobile telecommunications, the internet and IPTV.

An industry official said, "The fine amount can affect overall infrastructure investment and marketing strategy, beyond being a simple one-off cost," adding, "It is important what message KT will deliver after clearing sanctions uncertainty."