Coupang·SKT, tens of millions of personal information leaked, insurance coverage up to 1 billion KRW... Actual compensation for losses likely to be low

Despite the recent large-scale personal information leakage incidents, major information and communications companies such as Coupang and SK Telecom have only purchased personal information leakage compensation insurance for victim relief at the statutory minimum limit. This once again highlights the structural problem of being unable to obtain adequate compensation when actual damages occur.

According to the damage insurance industry on the 8th, Coupang currently holds personal information leakage compensation liability insurance from Meritz Fire & Marine Insurance, with a coverage limit of KRW 10 billion, and has not yet filed an insurance claim for the recent incident involving the leakage of around 33.7 million pieces of personal information. Not only Coupang, but SK Telecom, which leaked information of about 23 million users, was also found to have only purchased similar insurance from Hyundai Marine & Fire Insurance, with the same KRW 10 billion limit.

The current Personal Information Protection Act requires companies with sales above a certain threshold to purchase personal information leakage compensation insurance, but the mandatory insurance minimum limit, which is too low compared to the size of these companies, is seen as an issue. For example, even ultra-large enterprises with annual sales exceeding KRW 10 trillion or with more than 10 million information-holding customers are legally compliant as long as they have coverage of KRW 10 billion. This results in extremely limited substantive compensation through insurance even when large-scale damages occur.

The insurance industry argues that, given the scale of past incidents and the number of victims, it is necessary to raise the mandatory minimum insurance limit to around KRW 1 trillion. The reason is that, even if companies are required to pay damages through civil lawsuits, partial compensation through insurance is the only way to actually distribute the financial burden and ensure victim protection. Some point out that in certain cases, the low insurance limits have led to companies abusing this by evading responsibility or delaying compensation.

Against this backdrop, industry organizations such as the General Insurance Association plan to soon request that government agencies, including the Personal Information Protection Commission, revise the minimum insurance coverage requirements. In particular, they are considering requiring companies with annual sales over KRW 10 trillion or more than 10 million data subjects to purchase at least KRW 1 trillion in insurance. At the same time, there are growing calls for more active administrative measures, such as fines, against companies that do not purchase insurance.

Meanwhile, there have been no cases so far of companies being fined for failing to purchase insurance. Since the Personal Information Protection Commission has not taken substantive action due to difficulties in identifying the exact number of companies that should be insured, the insurance coverage rate is currently only 2%–8% of all companies that should be insured (estimated at around 83,000 to 380,000 companies).

Some opinions suggest that if this trend continues, the effectiveness of victim protection measures will be questioned when future personal information leakage incidents recur, and this is likely to eventually lead to a decline in corporate trust and stronger insurance and regulatory reforms. Therefore, the government and the National Assembly urgently need to improve the relevant system.