Privacy watchdog flags rise in suspected data-breach evidence destruction
Commission chair told a National Assembly audit that precise evidence for criminal referrals is rare, but suspected cases are likely more numerous.
The Personal Information Protection Commission said it expects more cases in which companies are suspected of hiding or destroying evidence tied to personal data breach incidents, according to digitaltoday.co.kr.
Speaking at the National Assembly's Political Affairs Committee audit on October 21, 2026, commission chair Song Kyung-hee said there are not many cases with evidence precise enough to warrant a criminal referral, but that suspected cases are likely more numerous.
The commission also acknowledged that current law lacks sufficient sanctions against evidence destruction carried out before an investigation begins.
Earlier enforcement actions
In July 2026, the commission decided to file a complaint against KT after confirming that the company did not report a 2024 malware infection and deleted logs from some servers or submitted false data.
In the LG Uplus case, the commission confirmed circumstances of evidence destruction, including reinstalling server operating systems and discarding servers before the investigation began, and referred the matter to investigative authorities. At the time of those measures, the commission said it would pursue system improvements within the year to address the institutional gap.
Quick answers
What did the Personal Information Protection Commission say at the National Assembly audit?
Chair Song Kyung-hee said there are not many cases with evidence precise enough for a criminal referral, but suspected cases of evidence concealment or destruction are likely more numerous.
Which companies faced commission action in 2026?
In July 2026, the commission decided to file a complaint against KT and referred the LG Uplus matter to investigative authorities over confirmed circumstances of evidence destruction.