Song Kyoung-hee, chairperson of the Personal Information Protection Commission, acknowledged that South Korea's data protection framework lags behind other countries and pledged to respond firmly to breaches using punitive fines and other sanctions.
"It is true that our country's data security and privacy management systems lag considerably," Song said on the 13th at a parliamentary audit by the National Assembly's National Policy Committee in Yeouido, Seoul. Asked by Cho Jung-hoon, a lawmaker of the People Power Party, why South Korea is vulnerable to data breaches, she said security spending had not kept pace with investment in information technology. "As the value of personal data has risen, our country has increasingly become a target," she added.
While threats from artificial intelligence-driven hacking have grown, Song said the direct cause of recent large-scale breaches was inadequate basic security measures. Responding to a question from Min Byoung-dug, a lawmaker of the Democratic Party of Korea, she said AI hacking had accelerated attacks and widened their scope, but added: "Major incidents occurred because basic measures were not taken — access rights were not properly managed, encryption was not properly applied, and abnormal traffic was not detected."
Lawmakers also criticized the response after breaches occurred. Cho said a data leak at the Government24 public services portal in August was disclosed only a month later, missing the 72-hour deadline for notifying affected individuals. He also noted that breaches have continued despite a 45% increase in the commission's budget over the past five years. Song replied that she felt a heavy sense of responsibility and shared the concerns.
In her opening remarks at the audit, Song had said she felt responsible for the recent series of breaches and would strengthen sanctions. She said the commission would make effective use of a punitive fine system, in effect since September, that allows penalties of up to 10% of a company's revenue, and would impose enforcement charges on firms that fail to cooperate with investigations. Major cases will be handled by dedicated investigation teams, and recent breaches at financial firms and public agencies will be a focus of scrutiny.
Song also outlined plans for victim relief and regulatory changes. The commission will strengthen the statutory damages system so that companies bear the burden of proof when a breach occurs, and will operate a fund using collected fines to support recovery for victims. Promising to ease difficulties for AI developers through special provisions, she said: "We will review and improve the current privacy framework so that it fits the AI era, including by addressing privacy issues raised by agentic AI."