People Power Party lawmaker Kang Min-kuk [Kang Min-kuk's office]
People Power Party lawmaker Kang Min-kuk [Kang Min-kuk's office]

By Jung Seok-jun, The Herald Business

People Power Party lawmaker Kang Min-kuk said Monday he is pushing legislation to block the unauthorized overseas transfer of personal data and sensitive information during mergers and acquisitions by foreign private equity funds, amid a prolonged period of high exchange rates that has made South Korean companies attractive acquisition targets.

According to data obtained by Kang's office from the Personal Information Protection Commission, the commission launched a preliminary inspection in January into RememberAndCompany — acquired by Swedish private equity fund EQT — to assess the impact of the change in majority shareholder and any overseas transfer of personal data. Six months on, the commission has yet to reach a conclusion.

SK Shielders, a major cybersecurity firm also acquired by EQT Partners, suffered a data breach last October in which personal information and internal documents were leaked through a hacking attack. The incident has fueled criticism that foreign private equity funds neglect security investment after acquiring domestic companies, focusing instead on short-term returns.

Existing M&A reviews have centered on the Korea Fair Trade Commission's assessment of monopoly risks and financial regulators' evaluation of capital adequacy. The Personal Information Protection Commission, recognizing the data-leak risks posed by large foreign private equity funds acquiring data-heavy companies, included follow-up measures in its 2026 ministerial work plan and said it aims to finalize proposals before the regular National Assembly session in September.

Calls for action were also raised during last October's national audit. Some critics, however, say the commission and the government have been slow to develop concrete policy responses or draft legislation.

Kang said he shares the sense of urgency and is preparing a bill that would require mandatory prior review by the Personal Information Protection Commission — similar to the merger review process under the Fair Trade Act — whenever an M&A transaction raises concerns about large-scale overseas transfers of personal data.

"Foreign capital is exploiting the favorable exchange rate to swallow up promising domestic platforms and the precious data assets of our citizens without any safeguard, while the government has taken no meaningful action — this is no different from surrendering our 'data territory' wholesale to global capital," Kang said.

"The government has acknowledged the seriousness of the issue and pledged to introduce a regime, so the National Assembly will move swiftly to complete effective legislative reform and defend our citizens' right to informational self-determination and the nation's data sovereignty without any gaps," he added.


mp1256@heraldcorp.com