[Koo Tae-eon, General Counsel, Lin AI Industry Specialist Group] The average South Korean venture company has assets of 8.5 billion won, annual revenue of 6.7 billion won, and a staff of just over 23 employees. Among startups, barely more than one in three survives for five years. These companies are too small to afford a dedicated legal team or to sustain litigation that drags on for several years.

Last November, the Personal Information Dispute Mediation Committee proposed a settlement requiring SK Telecom—which caused a data breach involving subscribers’ SIM card information—to pay 300,000 won per person to the claimants. While there were 3,998 claimants, the Personal Information Protection Commission confirmed that the breach affected 23.24 million people. Multiplying the compensation per person by the total number of affected individuals yields a figure approaching 7 trillion won. Both the entity that set the compensation rate and the one that verified the number of affected individuals were government agencies.

Currently, a lawsuit filed by some victims does not automatically extend to all victims. This is because the system is structured such that only those who file a lawsuit are eligible for compensation—and even then, each must prove the damages they personally incurred. In the GS Caltex case, where a massive amount of personal information was leaked, not a single one of the 2,201 plaintiffs received compensation, and the same was true for similar data breach cases involving Auction and Nate.

The issue lies with the class-action lawsuit bill currently pending in the National Assembly. The bill proposed by Rep. Park Kyun-taek of the Democratic Party of Korea eliminates this proof requirement. Unless victims specifically opt out of the lawsuit, all victims of the data breach automatically become plaintiffs from the outset, and the calculated total damages are directly included in the complaint. This bill specifically incorporates three key provisions: it applies to all claims for damages regardless of sector; it automatically includes victims unless they file an exclusion request; and it applies retroactively without any time limit to incidents that occurred before the law takes effect.

No country among the Group of Seven (G7) has adopted all three of these provisions simultaneously. The United States and Canada, which use an “opt-out” system, do not apply the law retroactively; the United Kingdom is the only country with a precedent for retroactive application. Even the UK limited its retroactive application to a single area—competition law—and applied it only to court proceedings, leaving the statute of limitations untouched. When the system was introduced, five safeguards were also put in place, including a ban on preliminary hearings and contingency fees. The French Senate also noted in a report that it rejected retroactive application to avoid placing economic actors—who could not have foreseen the legal risks—in a difficult position.

When the U.S. Congress enacted the Private Securities Litigation Reform Act of 1995, it explicitly stated in a report that more than two-thirds of venture capital firms were so fearful of litigation that they were reluctant to even publicize their own performance. Investment does not stop only after a lawsuit has concluded; it stops the moment word spreads that a lawsuit is possible.