Song Kyung-hee, Chairperson of the Personal Information Protection Commission, salutes the national flag at the 2nd Commission plenary meeting held at the Government Complex Seoul in Jongno-gu, Seoul on the 28th. 2026.1.28 [Photo=Yonhap News]

The Board of Audit and Inspection announced the results of its inspection into the status of personal information leaks in the public sector from 2021 to 2024 on the 27th.

During this period, approximately 39 million cases of personal information were leaked, but the measures were concluded with warnings and notifications without demands for disciplinary action against those responsible.

According to the "Personal Information Protection and Management Status" audit report released by the Board of Audit and Inspection, over 90% of the personal information leaks that occurred during this period were attributed to hacking.

The Board of Audit and Inspection stated that its simulated hacking tests targeting key public systems that process large amounts of personal information confirmed the possibility of personal information theft through external intrusions across all inspected systems.

Despite this, the audit results did not include demands for disciplinary action or accountability against responsible parties in public institutions. The Board of Audit and Inspection limited its actions to administrative measures such as warnings and notifications.

The reason cited was that most personal information leaks were caused by external hacking, making it difficult to pinpoint specific individuals' intentional acts or gross negligence.

The actions taken by the Personal Information Protection Commission also revealed a lenient approach towards the public sector. In 2022, the commission acknowledged violations of the Personal Information Protection Act by the Suwon City Hall, but the penalties were limited to a fine of 3.6 million won and corrective measures.

This means that institutional responsibility was only limitedly imposed, even in cases of intentional leaks by public officials.

In contrast, the level of sanctions for personal information leaks by private companies has been clearly strengthening in recent times.

For the large-scale personal information leak incident involving SK Telecom in 2025, the Personal Information Protection Commission imposed a penalty exceeding 100 billion won.

Kakao was fined around 15 billion won for its poor personal information management.

Regarding the recent large-scale personal information leak incident involving Coupang, under current law, applying revenue-based criteria, the potential for penalties ranging up to hundreds of billions of won, and in some cases, up to 1 trillion won, has been mentioned.

The Personal Information Protection Commission, as the final supervisory authority for personal information protection encompassing both the public and private sectors under the Personal Information Protection Act, holds simultaneous sanctioning powers, including investigations, corrective orders, and the imposition of fines and penalties.

The organization is designed to assess and enforce responsibility based on the same standards, regardless of whether the entity responsible for the leak is a public institution or a private company.

However, criticisms have repeatedly pointed out that the methods and severity of sanctions applied to the public and private sectors appear different in actual enforcement processes.

This is why there are criticisms that "the structure where the weight of responsibility is differentiated at the enforcement stage, not in the law itself, is becoming entrenched."

While past personal information leaks in the public sector, as inspected by the Board of Audit and Inspection, were resolved with recommendations for systemic improvements and administrative measures, strong monetary sanctions have been applied or are being discussed for leaks by private companies that have occurred since then.

Despite the application of the same Personal Information Protection Act framework, the methods and severity of holding parties accountable appear significantly different between the public and private sectors.

When placing the Board of Audit and Inspection's audit results and cases of sanctions against private companies side-by-side, it is difficult to shake the impression that the public sector remains bound by past frameworks of accountability, even as the standards for personal information protection are being strengthened.

Even though the same Personal Information Protection Act framework is applied, an enforcement structure that consistently enforces sanctions for both public and private sectors is not evident.

The problem is not a discriminatory design, but rather the absence of a structure that holds individuals accountable to the end, regardless of who is responsible for the personal information leak.

For personal information protection to translate into tangible accountability rather than mere declarations, a uniform principle of responsibility that does not discriminate between public and private entities, and a clear structure to enforce it, are required.