South Korea to Toughen Penalties for Large-Scale Data Breaches

South Korea will introduce stricter penalties this week for companies involved in personal data leaks affecting more than 10 million people. According to Sina Finance, the Personal Information Protection Commission said the revised Personal Information Protection Act will take effect on Friday, and companies found to have caused such large-scale breaches through intentional misconduct or gross negligence could face fines of up to 10% of sales. The regulator said the same penalty would also apply to companies that repeatedly violated personal information protection laws within three years, or that failed to follow corrective orders and triggered data leaks. Before the revision, the maximum fine was 3% of sales. The commission also said fines may be reduced by up to 40% at its discretion if a company has made substantial investments in personal information protection and other security measures.