Criticism at parliamentary audit: “Punitive surcharges alone cannot prevent personal data breaches”

[Financial News] At a parliamentary audit, lawmakers called for urgent, fundamental measures by the Personal Information Protection Commission (PIPC) and the government, saying punitive surcharges alone cannot prevent personal data breaches affecting the entire population.
Criticism continued over the government’s delayed notification and failure to take responsibility in connection with the Government24 personal data breach last August—even as companies prepare for penalty surcharges of up to 10% of their revenue.
At a parliamentary audit held at the National Assembly on the 13th, Rep. Cho Jung-hoon of the People Power Party pressed PIPC Chair Song Kyung-hee, saying, “Personal data breaches are no longer surprising.” He asked, “The government says it will impose punitive surcharges of up to 10% of a company’s revenue. With so many companies with net profit margins below 1%, will simply raising surcharges solve the personal data problem?”

He went on to criticize the commission sharply, saying, “In the five years since the PIPC was established, its budget has increased by 45%. Even after increasing the budget by this much, personal data breaches keep happening. I don’t know what on earth the results are or why the PIPC exists.”
Rep. Cho pointed out, “Compared with OECD countries, our country collects excessive amounts of personal data and has the structural problem of storing the information in just a handful of places.” He added, “It is the PIPC’s role to address these issues.”
Rep. Cho also pressed the issue, saying, “Personal data breaches are supposed to be reported to the data subjects within 72 hours, but Government24 informed the public of the breach a whole month after it happened.” He asked, “Shouldn’t someone in the government be held accountable for this?”
In response, Chair Song said, “I understand that the notification was a little late.”
On the successive personal data breaches, she also said, “I feel a heavy sense of responsibility and very much agree with the criticism.”
As for the causes of the personal data breaches, she said, “It is because South Korea’s IT infrastructure is highly advanced,” and added, “Having a well-developed IT infrastructure also means that it is correspondingly vulnerable.”
Song went on to explain, “It is true that domestic personal data protection management systems are considerably behind. Some of these problems have accumulated and surfaced, and the overall environment has also changed: as South Korea’s economy has developed, the value of its personal data has risen considerably, making it an increasingly frequent target.”
[email protected] Lee Gu-sun Reporter