Regulator to finalize penalties for SK Telecom over data leak as early as this month

Pedestrians walk past SK Telecom retail store in Seoul, June 24. Yonhap

Korea's data protection regulator is likely to finalize penalties against SK Telecom as early as this month over a major data breach that affected all of its 25 million users, officials said Tuesday.

The Personal Information Protection Commission (PIPC) was found to have given preliminary notice to SK Telecom late last month about the measures based on its investigation into the data leak, giving the company a period of at least 14 days to submit an opinion.

After SK Telecom files the opinion, the privacy watchdog will propose the finalized measures during a plenary session, which could take place as early as Aug. 27.

"While it's difficult to pinpoint an exact date, (we) seek to produce results as soon as possible," a PIPC official said.

The privacy watchdog is known to have focused its investigation on whether the company properly notified its users about the data leak and followed legally mandated security protocols.

Under the PIPC, companies can be fined up to 3 percent of their total sales, although sales from areas unrelated to the law violation can be excluded from the calculation.

SK Telecom belatedly reported the breach in April, in which universal subscriber identity module data was potentially leaked during an unidentified cyberattack on its servers.