Conflict-of-interest concerns mount as Kim & Chang lawyers join privacy watchdog

The appointment of current and former attorneys from law firm Kim & Chang to the Personal Information Protection Commission has sparked debate over whether the selections are appropriate.

Commission members vote on fines imposed for personal data breaches. Kim & Chang, however, represents many of the companies that have filed administrative lawsuits challenging those very fines — raising conflict-of-interest concerns. Industry observers have gone so far as to describe the situation as "a referee playing on the field alongside the players."

The commission also lacks internal guidelines on recusal — mechanisms that would either bar a member with a stake in a case from participating or allow a member to voluntarily step aside from deliberations.

With public attention focused on the commission's fines following a string of recent data breaches, critics say clear standards and procedures are needed to assess potential conflicts of interest.

According to a litigation status report obtained through the office of Rebuilding Korea Party lawmaker Kim Hyeong-yeon, Kim & Chang has represented companies in disputes against the commission over the past three years in cases involving Golfzon (a fine of about 7.5 billion won ($5.58 million)), Kakao (about 15.1 billion won), SK Telecom (about 134.8 billion won) and Coupang Inc (about 201.1 billion won, with a separate fine of about 423.6 billion won for violations of safety-measure obligations).

Attention has intensified after the fines imposed on SK Telecom and then Coupang Inc each set new records.

Against this backdrop, the newly appointed commission members include a current Kim & Chang attorney, identified as Lee, and a former attorney, identified as Park, who now works at law firm MCP&Partners.

Under the Personal Information Protection Act, the commission is composed of members recommended by the commission chair — a minister-level post — two from the ruling party and three from the opposition. The current attorney Lee was recommended by the ruling party, while the former attorney Park was recommended by the opposition.

Industry insiders have raised conflict-of-interest concerns over the participation of current and former Kim & Chang attorneys as commission members. Those members vote on fines for personal data breaches, while Kim & Chang simultaneously represents companies that have received such fines and are seeking to have them overturned through administrative litigation.

The commission said it maintains fairness by excluding relevant members from fine deliberations through recusal or voluntary withdrawal.

The Personal Information Protection Act, however, defines the relevant standard vaguely — covering cases where "a member, or a public institution, corporation or organization to which the member belongs, has an interest in a party to whom it is providing advice or other support." Legal experts say the ambiguity of the term "interest" makes internal guidelines necessary, yet the commission has none in place.

The commission said it would "clearly inform newly appointed members of their legal obligations so that the commission can operate fairly."

Rebuilding Korea Party lawmaker Kim Hyeong-yeon criticized the appointments, saying that including current and former Kim & Chang attorneys among the members who vote on fines is "like a referee playing on the field alongside the players." He added that as the scale of litigation over commission fines continues to grow, "greater care must be taken in selecting commission members."