South Korea Raises Data Breach Fines to 10% of Revenue
South Korea's revised Personal Information Protection Act, effective Friday, allows fines up to 10 percent of total revenue for companies that leak personal data of 10 million or more people through intent or gross negligence. The cap applies to repeat offenders within three years or those ignoring corrective orders. Companies must also notify users within 72 hours if exposure risk is high, even without confirmed breach. Investments in data protection can reduce fines by up to 40 percent.
We expect the way companies view investment in data protection to shift from seeing it as a cost to treating it as a proactive investment that builds customer trust and expands corporate profit.
- augment_me
You can just do what my university did, hire a small shell firm with 3 employees to hold all your data, and when it got hacked they just went bankrupt and we switched to a new shell firm with similar form and function.
Minimizes money usage and does not require any security investments
- prologic
Wow! :O Finally, a legislator with enough balls to put up something that _might_ (just might) make corporations _actually_ care about security and privacy! I can't wait for this to start being adopted in other countries. It's about time!
- SoftTalker
"through intent or gross negligence"
I'm not familiar with Korean law but that seems a rather high bar. I don't think we'll see many fines actually levied.
- hn_submit
This is exactly what we need in the West! I have a strong suspicion that nobody here actually cares about security or customer data being spilled into the streets.
Security costs money and as long as there aren't any penalties for negligence management will make the calculation to prioritize increased profitability over securing company data.
- _the_inflator
And what about the governments like Berlin for example? Massive data breach, and guess what happens? Nothing to those who are responsible for the breach.
So even though this is Korea, it is modern hypocrisy. Companies have to comply to more and more complicated regulation, while those who govern the states get a free pass.
If the Berlin incident remotely had happened to any private company - hell would have been loose.
Berlin reduced the IT budget especially regarding maintenance and security massively over the years. In fact, what came to light - CCC talk as a reference besides others - sounds so embarrassing, that all companies should get a bonus payment whenever they get hacked.
- markhahn
This is wonderful, though a little low.
Basing it on revenue is sensible, since the goal is to make it hurt. But that would argue for a higher fraction. But the main thing is to introduce an incentive to take security more seriously.
- roundup
Assuming global adoption, this would also have the side effect of increasing bug bounty payouts. Consider the recent OpenAI compromise: an attack RCE, an SSO configuration flaw, and subsequent employee account takeover, for a mere $6500 bounty for a trillion-dollar company.
- xp84
I'm assuming the intent is to protect customers.
Tying the fine to intent or gross negligence doesn't work for me, as a customer doesn't care why, they only care that the harm happened. Doesn't matter to me if you train everyone really well and one guy forgot his training just one time, or if you don't train at all.
I'm thinking:
(The following example is in "American" terms, I assume some other countries have similar ideas as SSN though)
- Name and address or name and phone number leak: $100 per customer affected.
- Email: $50 per customer affected, or $100 if tied to any other data.
- Social Security numbers: $2000 per customer affected
- Unsalted or plaintext passwords: $500 per customer affected.
- Cap is the greater of 200% of annual EBITDA, or 20% of revenue
Money goes to the government to be distributed DIRECTLY (tax-free) to the affected users.
This might bankrupt a couple of companies in particularly bad breaches, while companies are still getting used to it. Good! I hope it does and that business textbooks highlight those disasters, the way they do the Enron collapse.
My goals for this system are for businesses to properly price in the risk of holding (or even momentarily touching) sensitive data. SSNs, for instance should already (in a sane world) be radioactive for any business to even CONSIDER touching. To the extent any business feels the need to collect or hold it, frankly I'd say, think again. Credit reporting agencies are the worst offenders (and under my rul […]