South Korea’s PIPC Fines Woori Card KRW 13.45 Billion for Unauthorized Data Use

The Personal Information Protection Commission (PIPC) of South Korea has imposed a KRW 13.45 billion (~$9.2 million) fine on Woori Card Co., Ltd. for unauthorized use of personal data, marking one of the largest penalties under the Personal Information Protection Act (PIPA). The decision, finalized during the PIPC’s seventh plenary meeting on March 26, 2025, includes corrective measures and a publication order requiring Woori Card to disclose the sanctions publicly¹².

Details of the Violation

Woori Card, a major South Korean credit card issuer, was found to have used franchise owners’ personal data for marketing purposes without obtaining proper consent. The PIPC investigation revealed systemic failures in data handling practices, including inadequate safeguards against unauthorized access⁵⁷. The fine reflects the severity of the breach, which involved sensitive personal information and violated multiple provisions of PIPA.

Sanctions and Corrective Measures

In addition to the financial penalty, the PIPC mandated:

• A publication order requiring Woori Card to post the sanction results on its website for transparency¹.
• Implementation of corrective measures to overhaul data protection protocols, including stricter access controls and employee training².

The PIPC emphasized that the sanctions aim to deter similar violations by other organizations, particularly in the financial sector, where data sensitivity is high⁴.

Context and Broader Implications

This case parallels recent actions by the PIPC, including a KRW 757.2 million fine against Modetour Network for similar breaches³. It also aligns with global trends, such as T-Mobile’s $350 million settlement for a 2021 data breach⁶. South Korea’s stringent enforcement of PIPA underscores its commitment to data privacy, with penalties escalating for repeat offenders⁷.

Relevance to Security Professionals

The Woori Card case highlights critical lessons for organizations handling sensitive data:

• Consent mechanisms must be explicit and verifiable, especially for secondary data uses like marketing.
• Internal audits of data access logs can preempt unauthorized use.
• Regulatory compliance frameworks (e.g., PIPA, GDPR) require proactive monitoring to avoid penalties.

For incident responders, the publication order serves as a precedent for transparency in breach disclosures, a growing expectation in regulatory environments worldwide¹.

Conclusion

The PIPC’s sanction against Woori Card sets a benchmark for data privacy enforcement in South Korea. Organizations globally should note the financial and reputational risks of non-compliance, particularly as regulators adopt stricter stances on data misuse. Future amendments to PIPA may further increase penalties, reinforcing the need for robust data governance⁴.

References

1. “The PIPC Sanctions Woori Card for Data Breaches, Imposing KRW 13.45 Billion,” DataBreaches.net, Mar. 30, 2025.
2. “The PIPC Sanctions Woori Card for Data Breaches,” Malware News, Mar. 30, 2025.
3. PIPC Official Site, accessed Apr. 2025.
4. “PIPC Imposes KRW 13.45 Billion Fine on Woori Card,” Business Korea, Mar. 28, 2025.
5. Nate News, Mar. 28, 2025.
6. “South Korea’s Woori Card Fined $9.2 Million for Unauthorized Data Use,” MLex, Mar. 2025.
7. DataGuidance, Mar. 2025.