[Edaily Yun Junghoon· Reporter Ahn Yu-ri] With the dawn of the “punitive fines” era—where companies can face fines of up to 10% of total revenue in the event of a personal information leak—the CEOs of South Korea’s three major mobile carriers have expressed their commitment to making personal information protection a top management priority. Their policy is to assess personal information risks from the planning stage of artificial intelligence (AI) services and to prevent incidents proactively through large-scale investments in information security and a CEO-led management system.

On the 28th, Jeong Jae-heon, CEO of SKTelecom(017670); Park Yoon-young, CEO of KTCorporation(030200); and Hong Beom-sik, CEO of LG Uplus(032640), met with Song Kyung-hee, Chairwoman of the Personal Information Protection Commission, at the Korea Press Center in Jung-gu, Seoul, to discuss measures to strengthen personal information protection.

The amended Personal Information Protection Act, which took effect on the 11th, allows for the imposition of fines of up to 10% of total annual revenue for serious personal information breaches, such as repeated violations within three years due to willful misconduct or gross negligence, or breaches causing harm to 10 million or more people. The law also explicitly states that the CEO is the ultimate person responsible for the processing and protection of personal information. Conversely, companies’ investments in preventive measures and efforts to strengthen their protection systems may result in a reduction of the fine by up to 40% of the base amount.

The CEOs of the three major telecommunications companies expressed that they take these heightened responsibilities seriously and pledged to do their utmost to prevent personal information leaks. During the roundtable discussion, the conversation focused on awareness of these heightened responsibilities and proactive prevention efforts rather than specific mentions of the actual scale of potential fines.

SKTelecom CEO Jeong Jae-heon met with reporters immediately after the meeting and emphasized the need for preemptive measures, stating, “We must be more careful to prevent such incidents.”

In his opening remarks, CEO Jeong stated, “No matter how well we respond after a personal information incident occurs, it is difficult to fully restore the lost trust,” adding, “The best way to protect personal information is to block risks in advance.”

SKTelecom plans to invest 700 billion won in information security over the next five years. The company has adopted “Privacy First” as a guiding principle for all employees and treats personal information protection as the starting point for all operations, from service planning through development and operation. For AI as well, the company operates a governance system that proactively identifies risks related to personal information and AI throughout the entire process—from planning and development to launch and operation.

CEO Jeong emphasized, “Personal information protection is not a barrier to AI innovation, but rather an infrastructure of trust that supports the growth of the AI industry.”

KTCorporation has also made personal information protection its top management priority. Over the next five years, the company will invest 2.2 trillion won in security and IT modernization, with the CEO and board of directors personally reviewing major personal information risks and investment plans.

Park Yoon-young, CEO of KTCorporation, stated, “Since telecommunications are most closely intertwined with people’s daily lives and handle the largest volume of customer information, we are taking this responsibility seriously and overhauling our information security practices from the ground up.” Regarding last year’s data breach, he said, “As CEO, I once again apologize for causing concern to the public and the government,” adding, “We will devote all our resources to preventing such incidents from recurring.”

Hong Beom-sik, CEO of LG Uplus, also emphasized, “As AI and digital transformation accelerate, personal information protection transcends technical challenges and becomes a matter of corporate responsibility.” LG Uplus plans to have its CEO, senior management, and Chief Privacy Officer (CPO) continuously monitor personal information protection standards and embed Privacy by Design (PbD) throughout the entire service process.

CEO Hong stated, “In the age of AI, innovation and protection must go hand in hand,” and announced that the company would enhance transparency and accountability, safeguard user rights, and actively engage in public-private cooperation.

However, the three telecom companies also conveyed that there are practical difficulties in completely overhauling their personal information protection systems in the short term. Given the nature of the telecommunications industry, they explained that various generations of technology and systems—ranging from legacy systems built over 20 years ago to the latest AI technology—are operated simultaneously, making it difficult to improve all systems at once. Their point is that, while they are doing their utmost to improve the protection system, a realistic implementation timeline is also necessary.

A shortage of specialized information security personnel was also cited as a common challenge faced by all three companies. They explained that there are limits to what companies can do to train personnel in-house, and that securing and attracting specialized talent is also difficult.

Chairwoman Song Kyung-hee stated, “Personal information protection must become a core management priority that CEOs personally oversee and for which the entire company shares responsibility,” adding, “We must shift to a prevention-focused protection system that identifies risks and responds proactively before incidents occur.” She emphasized that the declarations made by the three telecom companies must translate into actual investment and on-the-ground changes.

On the same day, the three telecom companies signed a joint declaration pledging to make personal information protection their top management priority. The declaration outlines plans to establish a CEO- and board-led accountability framework, expand investment in personal information protection and increase the number of specialized personnel, and embed personal information protection throughout the entire AI service lifecycle.