SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Jung-Chull Lee and Ari Yoon, Kim & Chang
implementation of the amended PIPA in 2023, this base amount was changed to “no more than 3% of the total revenue”, while allowing for the exclusion of unrelated revenues. Consequently, with the burden of proving the irrelevance to the violation shifting to the data controller, the amounts of imposed administra - tive penalties have been increasing. 1.9 Enforcement Trends The following are key regulatory actions taken by the PIPC from 2024 to 2025. As regulations have recent - ly been strengthened, it is important to proactively assess potential legal violation risks and identify con - duct that may be problematic for effective risk man - agement. In May 2024, the PIPC imposed an administrative penalty of approximately KRW7.5 billion and an administrative fine of KRW5.4 million in a case where personal information of over 2.21 million users was leaked. Additionally, an administrative penalty of approximately KRW15.1 billion and an administrative fine of KRW7.8 million were imposed in a case involv - ing leaks of anonymous chatroom users’ information. Additionally, in August 2025, the PIPC imposed an administrative penalty of approximately KRW134.7billion and an administrative fine of KRW9.6 million to a telecommunications carrier in a case where personal information of over 23 million users was leaked. This case marked the largest monetary penalty ever imposed for a personal information leak by the PIPC. In July 2024, the PIPC fined a Chinese e-commerce service provider an administrative penalty of approxi - mately KRW2 billion and an administrative fine of KRW7.8 million for failing to secure user consent for overseas transfers of personal information and not including necessary data protection measures in seller agreements. This case highlighted that overseas pro - viders are subject to the level of regulation required of domestic service providers to ensure robust protec - tions for managing personal information. In November 2025, despite repeated requests from the PIPC to submit materials for an investigation, an online wiki operator refused to comply on the grounds
that its headquarters were located overseas and that it was therefore not subject to Korean law. As a result, the PIPC referred the foreign operator to law enforce - ment authorities.
2. Privacy Litigation 2.1 Privacy Litigation Overview
The administrative penalty amount imposed for viola - tions of the PIPA has increased significantly, and the number of administrative lawsuits filed against the PIPC has been increasing – KRW61.1 billion/three cases in 2024 to KRW167.4 billion/seven cases in 2025 (up to November). Moreover, as explained in 1.8 Enforcement Proceedings and Fines , the amendment to the PIPA has changed the threshold for administra - tive penalties, which is expected to further increase the number of administrative lawsuits filed against the PIPC. In contrast, civil lawsuits brought by data subjects against data controllers most often arise in connec - tion with data breaches, where claims for damages or compensation for mental suffering are pursued. In practice, however, data subjects frequently face dif - ficulties in proving actual financial loss and therefore tend to focus their claims on compensation for mental suffering. Under the PIPA, data subjects may claim statutory damages of up to KRW3 million even without dem - onstrating an actual financial harm. In awarding dam - ages, Korean courts consider factors such as the sensitivity of personal information involved, the scale of the breach, and the data controller’s response to the incident. To avoid liability, the data controller must prove that the breach was not caused by intent or negligence, but this burden is often difficult to meet in practice. 2.2 Recent Case Law Major lawsuits related to privacy in 2025 were as fol - lows. In 2022, the PIPC imposed an administrative penalty of around KRW100 billion in total to two online plat - forms on the ground that they did not obtain legiti -
439 CHAMBERS.COM
Powered by FlippingBook