KT faces potential W200b fine as privacy regulator nears ruling this month

The government is set to finalize sanctions against KT Corp as early as this month over a data breach last year that exposed the personal information of more than 22,000 customers.

According to industry sources Sunday, the Personal Information Protection Commission plans to hold a plenary session on July 29 to deliberate and vote on sanctions against KT Corp, including a potential fine.

Based on past precedent, the commission is likely to issue a final ruling at that session, though a vote could be deferred if members determine further review is needed. The commission completed its investigation into KT Corp in May and sent the company a pre-disposition notice.

In September last year, KT Corp suffered a data breach in which the subscriber identification numbers (IMSI), device identification numbers (IMEI) and phone numbers of 22,227 customers were leaked through illegally installed small base stations known as femtocells. Of those affected, 368 customers were subsequently found to have suffered unauthorized micropayment charges totaling 777 transactions and about 243 million won ($163,000) in losses.

Attention has focused on the size of the fine. Under the current Personal Information Protection Act, the commission may impose a fine of up to 3 percent of the revenue tied to the violation. Given that KT Corp's average annual wireless service sales over the past three years stood at about 6.67 trillion won, a straightforward calculation at the statutory maximum would put the fine at around 200 billion won.

However, the actual fine will be determined by weighing the scope of revenue directly linked to the violation along with any mitigating or aggravating factors. Factors that could work in KT Corp's favor include its decision to waive early-termination fees for customers who canceled service after the breach, its operation of a compensation program, and its announcement of plans to expand investment in information security.

On the other hand, aggravating factors may include the company's failure to immediately report the compromised servers to authorities and its decision to handle the matter internally, as well as its continued subscriber acquisition activities even after identifying the security vulnerability.

SK Telecom, which faced expectations of a fine worth hundreds of billions of won following its own hacking incident last year, ultimately received a reduced penalty of 134.8 billion won after mitigating circumstances were taken into account. The record for the largest fine ever imposed remains the 624.7 billion won levied against Coupang Inc over a breach that exposed the personal data of about 37.56 million people.