본문 바로가기
  • Home

A Policy and Legal Analysis of Reforming Compensation Mechanisms for Victims of Personal Information Breaches - The Case of Australia -

  • Legal Theory & Practice Review
  • Abbr : LTPR
  • 2026, 14(2), pp.361~386
  • Publisher : The Korea Society for Legal Theory and Practice Inc.
  • Research Area : Social Science > Law
  • Received : April 27, 2026
  • Accepted : May 23, 2026
  • Published : May 31, 2026

Kwon O Min 1 Junho Hong 2

1ETRI부설국가보안기술연구소
2성신여대

Accredited

ABSTRACT

A series of large-scale personal data breaches in the private sector has exposed structural limitations in existing victim compensation mechanisms. Although regulatory authorities have responded with investigations, corrective measures, and administrative sanctions, remedies for affected individuals remain largely symbolic, typically limited to service-level compensation. In practice, victims must rely on civil litigation to obtain damages, yet high procedural costs and evidentiary burdens significantly constrain access to justice, resulting in under-enforcement of rights. This paper argues that the current reliance on private law remedies is insufficient to address data breach harms characterized by scale, asymmetry of information, and technical complexity. Despite the constitutional recognition of the right to informational self-determination, the institutional framework for its enforcement remains underdeveloped. The study conceptualizes this gap as a structural misalignment between rights recognition and remedial accessibility, and calls for a reconfiguration of damages principles in the context of personal data protection. Drawing on the complaint and determination practices of the Office of the Australian Information Commissioner (OAIC), this paper identifies an alternative model of administrative redress that complements traditional civil litigation. It then proposes policy directions for strengthening the remedial role of the Personal Information Protection Commission, with a view to enhancing accessibility, effectiveness, and systemic enforcement of data protection rights.

Citation status

* References for papers published after 2024 are currently being built.