SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Jung-Chull Lee and Ari Yoon, Kim & Chang
the courts. If a data controller refuses to participate in collective dispute mediation or declines to accept the mediation outcome, consumer organisations or civic groups designated under the PIPA may file an injunctive action with the court seeking to prohibit or suspend the infringing conduct. 1.7 Regulators The key regulators are as follows: • the PIPC (in charge of enforcing the PIPA); • the Korea Media and Communications Commis - sion (KMCC) (in charge of enforcing the Network Act and the Location Information Act); • the KISA (conducts tasks related to information security as delegated by the PIPC, the KMCC and MSIT); • the Financial Services Commission (FSC) (in charge of enforcing the Credit Information Act); and • the MSIT (in charge of enforcing the AI Framework Act). The PIPC, the KMCC, the FSC and the MSIT have the authority to conduct investigations – for example, through requests for information and on-site inspec - tions. While the KISA does not have law enforcement authority by itself, it often conducts investigations on behalf of the PIPC, the KMCC and the MSIT. Although investigations are often initiated when data controllers report a data breach or personal informa - tion infringement to the regulators, the regulators also conduct regular as well as ad hoc inspections based on the relevant laws and regulations. The regulators – including the PIPC, KMCC and FSC – issue an annual work plan at the beginning of each year, and this helps businesses to anticipate which industry sectors may be a target each year. Investigations can also be trig - gered when there is media coverage of a specific inci - dent or issue. In data breaches where multiple regula - tors are involved, investigations are often conducted in parallel. While the guidance issued by each regula - tor is not legally binding, it effectively serves as the practical standard for enforcement in practice. The PIPC has recently declared its intention to “secure leadership in global personal information regulatory norms”. To that end, it expressed its commitment to
strengthening international co-operation, providing more detailed guidance for foreign business opera - tors, and analysing major enforcement actions taken by overseas regulators. Through these efforts, the PIPC aims to enhance its global investigative capabili - ties and establish an international information-sharing network. 1.8 Enforcement Proceedings and Fines Regulators must provide a written notice before com - mencing an investigation, as well as prior to imposing an administrative disposition. In order for an admin - istrative disposition to be lawful, not only should the procedures be lawful but the content of such disposi - tion must also satisfy the principle of proportionality. Where a data controller intends to object to an admin - istrative fine, it may do so in writing and go through a trial. For other administrative dispositions, it may file an administrative appeal or an administrative lawsuit. The administrative fine and the administrative penalty are both monetary sanctions for administrative viola - tions, but they differ in the nature and severity of the offences they address. Typically, administrative fines are imposed for minor violations and have a maximum amount specified by law. In contrast, administrative penalties are reserved for more serious violations, with the maximum amount determined as a percentage of the violator’s revenue. In practice, administrative fines are calculated based on a predetermined amount according to the type and number of violations. These fines can be adjusted – either increased or decreased – by considering factors such as the severity, duration, motive and damage caused by the violation, as well as other legal criteria. Generally, administrative penalties cannot exceed 3% of the violator’s total revenue, although revenue unre - lated to the violation is to be excluded from this calcu - lation. Administrative penalties may also be adjusted based on factors such as the number and duration of violations, the profits gained, voluntary corrective actions and efforts to mitigate damage. Previously, the maximum base amount for adminis - trative penalties was set at “no more than 3% of the revenue related to the violation”. However, with the
438 CHAMBERS.COM
Powered by FlippingBook