SKT CEO Jeong Jae-hyun refuses to pay a fine of 134.8 billion won... "A 3% fine on sales is severe."

Filed an administrative lawsuit against the fine imposed by the Personal Information Protection Commission
KT and LGU+ also suffered security incidents... keep a close eye on the court results

The battle between SK Telecom (SKT) and the Personal Information Protection Committee over the 134.8 billion won fine has entered a new phase. This is because SKT objected to the fine imposed related to the USIM information leakage hacking incident and filed an administrative lawsuit. This lawsuit, which is the first dispute since the launch of CEO Jeong Jae-heon's regime, is expected to have a significant impact not only on the standards for calculating fines but also on the personal information liability structure of the telecommunications industry as a whole, depending on the court's judgment.

According to the industry on the 20th, SKT filed an administrative lawsuit on the 19th to appeal the fine imposed by the Personal Information Protection Commission in relation to the USIM information leakage hacking incident. SKT explained the background of the lawsuit, saying, “We would like to receive a thorough judgment from the court regarding the appropriateness of the fine.”

SKT had customer SIM information stolen due to a hacker attack in April last year. As a result, 26.96 million pieces of key information including phone numbers and subscriber identification keys (IMSI) were leaked.

The Personal Information Commission imposed a fine of 134.791 billion won and a fine of 9.6 million won for the incident in August last year. This is the largest fine since the launch of the Personal Information Commission. At the time, Personal Information Commissioner Ko Hak-soo pointed out, “There were overall security vulnerabilities, and even though we were aware of this for a long time, we missed the opportunity to take action.”

The issue is ‘transition’… Whether the principle of proportionality is violated

The issue is whether the fine is excessive compared to the violation. The industry believes that SKT will bring to the fore the violation of the principle of proportionality in fines.

The principle of proportionality is the principle that means for achieving administrative purposes must have a reasonable proportional relationship with the purpose and that no more sanctions than necessary should be imposed. In accordance with the revised Personal Information Protection Act, the Personal Information Commission calculated a fine of 3% based on total sales, not sales directly related to illegal activities.

In response to this, SKT is expected to argue that considering the nature of the incident caused by an external attack such as hacking, sanctions based on total sales are a measure that excessively expands the scope of responsibility.

“Large-scale investment, no secondary damage”… Notice of legal dispute

In a personal information leak incident, a business may dispute legal responsibility over whether it has fulfilled its obligations to ensure safety under the Personal Information Protection Act.

However, in this lawsuit, SKT is focusing on the appropriateness of the fine rather than completely denying the violation of safety measure obligations itself. The court is also likely to base its judgment on the appropriateness of the level of sanctions rather than the illegality itself.

Jang Ji-woon, an attorney at Daeryun Law Firm, said, “SKT will emphasize that the accident occurred even though it implemented the protective measures required by the level of technology and industry practices at the time,” and added, “It is highly likely that they will mention that they made large-scale security investments and system improvements after the accident and that no secondary damage occurred.”

Kwon Kyu-bo, deputy representative attorney at Majung Law Firm, said, “Considering that the reason for the (SKT) lawsuit is centered on the excessiveness of the fine, the key issue will be whether the level of sanctions is appropriate compared to the violation of the law.”

The outcome of the ruling is likely to spread throughout the telecommunications industry.

This ruling is not limited to SKT and is expected to have an impact on the entire telecommunications industry.

Currently, KT is facing a fine from the Personal Information Commission after the investigation by the public-private joint investigation team is completed. LG U+ is currently under police investigation on charges of obstruction of official duties surrounding the disposal of hacked servers. In these cases, the company's response after the accident can also be a major factor in determining legal liability.

If SKT wins, all or part of the fine will be canceled. Naturally, the Personal Information Commission's method of calculating the overall sales standard is also put on hold. In particular, if a partial cancellation or reduction decision is made, a standard may be proposed that the standards for calculating fines in personal information infringement and hacking cases should be more strictly considered.

Conversely, if SKT loses, the method of calculating fines based on total sales applied by the Personal Information Commission will be recognized as justified by the judiciary.

This could lead to an interpretation that broadly holds companies responsible for managing personal information protection, regardless of whether they have suffered hacking damage or not. In addition, it is highly likely that the intensity of regulation on large-scale personal information processing businesses, including telecommunications companies, will be further increased. There are observations that along with the expansion of telecommunications companies' security investments, it will become inevitable to revise their management strategies to reflect potential regulatory risks.

An official from the telecommunications industry said, “This ruling will serve as a standard for measuring the extent to which fines based on total sales are tolerated by the judiciary,” and added, “It is highly likely that it will remain as a precedent that will determine the direction of the telecommunications industry and the domestic personal information sanctions system as a whole.”

[View full article]
SKT CEO Jeong Jae-hyun disobeys fine of KRW 134.8 billion... "3% fine on sales is severe" (Shortcut)