[정보보호 규제 전환]〈상〉징벌 만능주의 경계해야

South Korea's data protection regulators are shifting toward punitive enforcement in response to recent breaches, but experts warn this approach risks encouraging companies to conceal incidents rather than invest in security. Excessive fines and ambiguous standards create perverse incentives where organizations prioritize damage control through concealment over proactive prevention—with industry data showing 58% of IT professionals receive directives to hide breaches and 70% of Korean incidents go unreported. A balanced regulatory framework that evaluates comprehensive risk management, incentivizes security investment, and rewards preventive measures is essential to align enforcement with actual cybersecurity outcomes.