South Korea to Enforce Penalties of Up to 10% of Sales for Large-Scale Data Leaks
South Korea's revised privacy law, effective Friday, allows fines of up to 10 percent of sales for data leaks affecting more than 10 million people.
The Personal Information Protection Commission said the revised personal information protection law covers large-scale leaks caused by intentional misconduct or gross negligence. Companies that repeatedly violate personal information laws within three years, and those whose data leaks stem from a failure to follow corrective orders, are also subject to the punishment.
Under the previous rules, companies faced a penalty of up to 3 percent of sales.
The commission said it could reduce the penalty by as much as 40 percent, taking into account the level of investment a company made in personal information protection and other safety measures.
The revision follows a series of high-profile cases that pushed Seoul to tighten its protection of personal information. The e-commerce operator Coupang suffered a data breach affecting more than 37 million users, according to Yonhap News.