Personal data dispute cases triple as average processing time hits 26 days

The number of personal data dispute cases closed and the time needed to resolve them have grown sharply as data breach incidents become more frequent.

Data submitted by the Personal Information Protection Commission to People Power Party lawmaker Park Sung-hoon's office Sunday showed that the number of cases closed annually by the Personal Information Dispute Mediation Committee nearly tripled, rising from 297 in 2020 to 899 last year. Through September this year, 859 cases had been closed — 95.6 percent of last year's full-year total — and the committee is on track to set an all-time annual record if the current pace continues.

The annual figures show a steady climb: 417 cases in 2021, 551 in 2022, 666 in 2023 and 806 in 2024.

The personal data dispute mediation system allows users who have suffered harm from data leaks or privacy violations to file claims with the committee seeking compensation and relief. Unlike litigation, the process is relatively fast and carries no filing costs.

A mediation agreement carries the same legal force as a court settlement, but if a business rejects the proposed terms, the claimant must file a separate civil lawsuit to obtain compensation.

As the number of mediation requests has grown, so has the average processing time. The average rose from 12.2 days in 2021 to 15.4 days in 2022, 17.7 days in 2023, 19.4 days in 2024 and 22.7 days last year. As of September this year, the figure stood at 26 days — more than double the 2021 level.

The number of cases that ended without a mediation agreement also increased, from 6 in 2023 to 40 in 2024 and 66 last year, with 70 recorded through September this year. Of those 70 failed mediations this year, 53 involved a respondent's refusal to accept the proposed agreement.

As awareness of the mediation system grows, a body of precedent is accumulating. Last October, a case was filed after a community welfare center employee uploaded a list of election workers as an attachment; the committee ordered 15,000 won ($112) in damages and required the center to take steps to prevent a recurrence.

Large-scale group mediation filings have also increased as data breaches grow in scope. In the most prominent case, more than 146,000 people — the largest group in the committee's history — filed for mediation over a Coupang Inc data breach. The committee voted at a mediation panel meeting on Aug. 10 to extend the processing period for the Coupang case by 60 days.

"Mediation requests and closed cases are surging as personal data breaches continue to pile up," Park said. "Delayed relief can lead to secondary harm, so we must expand mediation staffing and expertise, improve processing procedures and deliver swift, effective remedies for victims."