A push to introduce damage compensation claims through group lawsuits under the Personal Information Protection Act — prompted by large-scale data breaches at companies including Coupang (CPNG, NYSE) and major telecom carriers — has been suspended due to disagreements between government ministries.
According to reporting by the Seoul Economic Daily on Sunday, the Personal Information Protection Commission (PIPC) had been pursuing reforms to group lawsuit provisions to provide relief for data breach victims. The discussions were recently put on hold after the Ministry of Justice raised objections.
Article 51 of the current Personal Information Protection Act contains group lawsuit provisions, but only allows claims seeking injunctions against rights violations. Damage compensation claims are excluded. As a result, victims of personal data breaches have had to file individual civil lawsuits to receive actual compensation.
An amendment to the Personal Information Protection Act passed by the National Assembly last month raised the ceiling on penalty surcharges from 3% to 10% of revenue. However, the introduction of damage compensation claims was left out, prompting growing demands from civic groups for substantive victim relief measures.
In response, the PIPC had been actively pursuing legislative revisions to expand the scope of group lawsuits from public interest actions such as injunctions to include damage compensation, and to link these with collective dispute mediation. PIPC Chairperson Song Kyung-hee stated in her New Year's address earlier this year, "We will add damage compensation to the scope of group lawsuits and open a path for affected citizens to receive substantive compensation."
However, the legislative effort hit a snag when the Ministry of Justice intervened. The ministry has been pushing to introduce a broad "class action law" covering both personal information and consumer sectors, effectively sidelining reforms to group lawsuit provisions in individual statutes.
The Ministry of Justice argued that "considering global standards, operating a dual system of class actions and group lawsuits is inappropriate," adding that "the new class action legislation the ministry is pursuing can be sufficiently applied to cases such as the Coupang incident."
The PIPC ultimately decided to suspend its push to include damage compensation in group lawsuits and align with the government-wide effort to introduce a class action system. A PIPC official said, "Discussions on introducing group lawsuits have not ended entirely," but added, "We also plan to accelerate the second round of amendments to the Personal Information Protection Act, which will include provisions strengthening corporate liability for damages."