If the State Pays Relief First for Leak Damage That Has Gone Uncompensated, Who Opens That Door, and When

The Bill Read and the Status Confirmed

This piece reads Bill No. 2221865, the Partial Amendment Bill to the Personal Information Protection Act. The bill was introduced by Rep. Cho Jung-hun and nine other members on October 12, 2026, and the session is shown as the 439th National Assembly (Regular Session). As of the verification date, October 16, 2026, the National Assembly progress screen records referral to the National Policy Committee, the committee with jurisdiction, on October 13, 2026, and referral to the Finance, Economy and Planning Committee, the related committee, on the same day. Committee tabling and resolution, plenary deliberation, and transmission to the Government were not shown on the screen that day.

The parts read are the reasons for the proposal and main contents, the amended provisions, the addenda, and the comparison table of new and old provisions in the PDF of the original text of the bill. The reference note in the reasons for the proposal states that this bill presupposes the passage of the Partial Amendment Bill to the National Finance Act (Bill No. 21864), also introduced by the same member as lead sponsor. As this piece did not open and read the original text of that National Finance Act bill, it does not address what arrangements under the National Finance Act are required to establish the fund.

Sources for this section: National Participatory Legislation Center, National Assembly Legislative Status: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865) · PDF of the Original Text of the Bill: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865)

The Routes to Recovery of Damage Under the Current Act

The current Personal Information Protection Act as of the verification date is Act No. 21445, in force from September 11, 2026. Article 39 (1) provides that a data subject who suffers damage as a result of a personal information controller's violation of the Act may claim damages, and that the controller cannot be relieved of liability unless it proves the absence of intent or negligence. Paragraph (3) of the same Article provides that, where a leak, etc. occurs through intent or gross negligence, the court may determine the amount of compensation within a range not exceeding five times the amount of damage, and paragraph (4) lists, as matters to be considered in doing so, fines and surcharges, the controller's financial condition, and its efforts to remedy the damage, among others.

Article 39-2 (1) provides that, where a leak, etc. occurs through intent or negligence, compensation may be claimed in a reasonable amount not exceeding KRW 3 million as the amount of damage. Article 39-7 (1) requires controllers meeting the criteria prescribed by Presidential Decree to take out insurance or mutual aid coverage, or to set aside reserves, among other measures, in order to fulfil their liability for damages. Article 49 provides for collective dispute mediation where damage of the same or a similar type arises for multiple data subjects. All of the means of recovery under the current Act are compensation or mediation against the controller, and no provision under which the State pays money first was found within the scope examined.

Article 64-2 (1) provides that the Protection Commission may impose a surcharge of up to 3/100 of total sales in any of the cases listed in the subparagraphs of that paragraph, and subparagraph 9 lists the case where personal information processed by the controller is subject to a leak, etc. Paragraph (2) raises the ceiling to 10/100 in cases such as repeated violations or damage affecting 10 million or more persons, and paragraph (11) requires payment of an additional amount on refund when a surcharge is refunded by reason of a court judgment, etc. The current provisions do not link the destination of surcharges to relief for victims.

Sources for this section: Korea Law Information Center, Current Personal Information Protection Act (Act No. 21445, in force September 11, 2026)

What the Bill Seeks to Change

Article 39-16 (1) of the bill would provide that the Protection Commission may pay relief payments where it has confirmed, in respect of a leak, etc., the fact of a violation of the Act and the fact of the leak, and the affected data subject does not obtain compensation for all or part of the damage from the controller. Paragraph (2) provides that the amount is to be calculated under criteria set by Presidential Decree, taking into account the type and sensitivity of the leaked information, the scale of the leak, the likelihood of damage occurring, and the age and vulnerability of the victim, and that an additional amount may be added where information of children or juveniles has been leaked. Payment is expressed in discretionary terms ("may pay").

Article 39-17 of the bill provides that, where a data subject has received compensation for damage, relief payments are not to be paid to that extent; that the Protection Commission is subrogated to the data subject's claim for damages to the extent of the relief payments made; and that, in subrogation, the relief payments are deemed to be damages under the Civil Act. Article 39-18 of the bill provides for recovery of payments received by false or other wrongful means and of payments made in error; recovery is to be made in the same manner as the collection of national taxes, and its priority ranks after national and local taxes.

Article 39-19 of the bill establishes the Personal Information Infringement Damage Relief Fund and lists as its sources Government contributions, surcharges under Article 64-2, reimbursement amounts acquired through subrogation, and investment income, among others. Articles 39-20 through 39-22 of the bill provide for the management and operation of the Fund, entrustment, accounting officers, and the reserving of profits and treatment of losses. Article 1 of the Addenda provides that the Act enters into force six months after the date of its promulgation, and Article 2 provides that the provision on surcharges as a funding source applies from surcharges collected after its entry into force.

Sources for this section: PDF of the Original Text of the Bill: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865) · Korea Law Information Center, Current Personal Information Protection Act (Act No. 21445, in force September 11, 2026)

Does the Protection Commission's Confirmation of a Violation Mean the Point at Which the Disposition Becomes Final?

Article 39-16 (1) of the bill sets the starting point for payment as the case where the Protection Commission has confirmed the fact of a violation of the Act and the fact of the leak. The provision does not specify whether confirmation means the conclusion of an investigation, a corrective order or surcharge disposition, or the point at which that disposition becomes final through litigation. Just as current Article 64-2 (11) separately provides for the refund of surcharges by reason of a judgment, a disposition may be altered at the end of a dispute.

Article 39-18 (1) subparagraph 2 of the bill provides for recovery where payment was made in error. The provision does not determine whether relief payments already made fall within the case of payment made in error if the disposition is revoked after confirmation, or whether recovery is to be made even where the data subject who received payment is not at fault. Further, as with the proviso to Article 64-2 (1) subparagraph 9, there may be leaks that do not constitute grounds for a surcharge because the controller has taken all measures to ensure safety; the provision also does not say whether, in such a case, the fact of a violation of the Act is regarded as unconfirmed so that no payment is made. By what are the time of confirmation of the payment requirements and the treatment after revocation of a disposition to be determined?

Sources for this section: PDF of the Original Text of the Bill: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865) · Korea Law Information Center, Current Personal Information Protection Act (Act No. 21445, in force September 11, 2026)

Does Not Obtaining Compensation Mean After Going Through Litigation or Mediation?

The bill makes it a requirement that the data subject does not obtain compensation for all or part of the damage. The reasons for the proposal cite the protracted nature of litigation, the difficulty of proof, and the burden of litigation on victims with small losses. The provision, however, does not state, and leaves to Presidential Decree, whether data subjects who have not gone through litigation or dispute mediation are also eligible, whether it suffices that the controller has refused compensation or cannot be contacted, or whether the controller's bankruptcy or insolvency is required.

Nor does the provision address whether relief payments may be made first where collective dispute mediation under current Article 49 is in progress, where the controller has submitted a compensation plan under Article 49 (5), or where insurance proceeds under Article 39-7 are expected to be paid. Since Article 39-17 (1) of the bill provides only that no payment is made to the extent that compensation has already been received, there is no provision for settlement where compensation or insurance proceeds are received after relief payments. As the outcome of what procedure should the state of not having obtained compensation be determined?

Sources for this section: PDF of the Original Text of the Bill: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865) · Korea Law Information Center, Current Personal Information Protection Act (Act No. 21445, in force September 11, 2026)

Does the Claim to Which Subrogation Applies Through Relief Payments Include Statutory Damages and Compensation of Up to Five Times?

Article 39-17 (2) of the bill provides for subrogation to the data subject's claim for damages to the extent of the relief payments made, and paragraph (3) provides that, in subrogation, the relief payments are deemed to be damages under the Civil Act. Under the current Act, claims for damages divide into the claim for actual loss under Article 39 (1), compensation of up to five times under paragraph (3) of the same Article, and statutory damages of up to KRW 3 million under Article 39-2. The provision does not distinguish which claim is subject to subrogation.

Nor does the provision state, where a data subject claims remaining damage from the controller after receiving relief payments, in what order the Protection Commission's subrogated claim and the data subject's residual claim stand against the controller's limited assets. Article 39 (4) subparagraph 4 makes surcharges a matter to be considered in calculating the amount of compensation; the provision does not address whether, in a structure in which surcharges become a source of the Fund, the Fund in turn is paid out as relief payments, and those return as subrogated claims, the same circumstance is counted twice. How are the claims subject to subrogation, and their ranking relative to the data subject's residual claims, to be determined?

Sources for this section: PDF of the Original Text of the Bill: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865) · Korea Law Information Center, Current Personal Information Protection Act (Act No. 21445, in force September 11, 2026)

If Surcharges Flow into the Fund, How Much of the Calculation Criteria Must Be Set Out in the Act?

Article 39-19 (2) subparagraph 2 of the bill lists surcharges under Article 64-2 as a source of the Fund. Current Article 64-2 (11) and (12) require the return of the surcharge and the additional amount on refund where a disposition is revoked by a judgment. The provision does not determine whether, when refunding a surcharge that has already entered the Fund and been paid out as relief payments, the source of the refund is the Fund or the general account.

Article 39-16 (2) of the bill sets out the factors to be considered in calculation, but does not provide for a cap on the amount, apportionment where total payments exceed the Fund, or multiple applications arising from the same incident, leaving these to Presidential Decree. It is unclear whether listing the likelihood of damage occurring as a factor means that payment may be made even to data subjects whose actual damage has not materialised, and how this fits with paragraph (1), which makes damage a requirement. Must the cap, apportionment, and their relationship with the damage requirement be set out in the Act?

Sources for this section: PDF of the Original Text of the Bill: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865) · Korea Law Information Center, Current Personal Information Protection Act (Act No. 21445, in force September 11, 2026)

Commencement and remaining issues

Article 1 of the Addenda proposes that the Act enter into force six months after the date of its promulgation. This is a proposed condition, not a fixed date, and this piece does not calculate a date from the date of introduction. Article 2 of the Addenda provides that only the provision on surcharges as a funding source applies from surcharges collected after entry into force, and contains no application rule for the payment of relief payments itself.

Accordingly, the Addenda do not state whether victims of leaks that occurred before entry into force may apply for relief payments after entry into force, or whether incidents in which a violation was already confirmed before entry into force are also covered. If funding comes in only from amounts collected after entry into force while eligibility for payment extends to past incidents, initial funding will depend on Government contributions. The reference note that the bill may be adjusted depending on the outcome of the National Finance Act bill on which it is premised also remains. Should whether payment is made for incidents before entry into force be determined in the Addenda?

Sources for this section: PDF of the Original Text of the Bill: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865)

What This Piece Did Not Verify

This piece did not read the review report, the meeting minutes, subordinate legislation, the original text of the Partial Amendment Bill to the National Finance Act (Bill No. 21864), or other amendment bills to the Personal Information Protection Act in the same session. It did not compare the bill with relief payment schemes under other Acts, such as crime victim relief payments, and did not verify any fiscal estimate of the scale of relief payments. Middle dots in quotations from the original text have been rendered in adjusted notation.

This piece neither supports nor opposes the bill and does not recommend legislation. It does not predict the outcome of further proceedings and contains no assessment of the prospects of compensation for any individual leak incident.

Sources for this section: National Participatory Legislation Center, National Assembly Legislative Status: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865) · PDF of the Original Text of the Bill: Partial Amendment Bill to the Personal Information Protection Act (No. 2221865) · Korea Law Information Center, Current Personal Information Protection Act (Act No. 21445, in force September 11, 2026)