[정보보호 규제 전환] 〈하〉 중대성 잣대 다듬고, 감경 요소 명문화해야

South Korea's expanded data protection penalties (maximum 10% of revenue) risk driving defensive compliance-focused spending rather than genuine security improvements. Clear enforcement standards and explicit mitigation mechanisms—following GDPR's precedent of severity-based differentiation—are essential to incentivize proactive security investments and incident response, ultimately strengthening the cybersecurity ecosystem.