*The views expressed in this article do not represent the views of Santa Clara University.
Credit: Wikimedia Commons
South Korea’s Personal Information and Protection Commission announced on Wednesday, September 14, 2022, that Google and Meta will be fined a total of $72 million USD (₩100 billion KRW). Google faces a fine of (₩69.2 billion KRW) and Meta, which operates Facebook and Instagram, was given a fine of $22 million USD (₩30.8 billion KRW). (AP News). These fines set a record for the highest ever issued by South Korea for privacy violations.
The commission stated that the fines were due to the companies failing to clearly inform their users about their data being collected and did not obtain users’ consent to collect the data, which was used for targeted advertisements. The companies tracked their consumers’ usage of other websites and applications, which users were not clearly made aware of and had not consented to. The commission noted that, according to their investigation, over 82% of South Koreans using Google and 98% of South Koreans using Meta’s services had their privacy rights threatened. Id.
Google has stated that they have
“always demonstrated [their] commitment to making ongoing updates that give users control and transparency.”
(Reuters). Meta has indicated that they are considering seeking a court ruling on the fines. Id.
Privacy Protections in South Korea
The South Korean Personal Information Protection Act (PIPA) governs the collection, processing, and protection of South Korean citizens’ personal information, and has been updated as recently as 2020. (Personal Information Protection Act (Act No. 16930) (S. Kor.), translated in Korean Legislation Research Institute’s online database). Under PIPA, data controllers that collect typical personal information such as names, identification numbers, or images of people must comply with certain regulations with the collection and handling of the information. (Data Protection in South Korea: Overview, Practical Law Country Q&A w-008-4933). PIPA is sufficiently comprehensive to also over more sensitive personal information, such as religious beliefs or political opinions. Id. PIPA even regulates personal information even when it is outsourced to a third party. Id.
Under PIPA, entities that collect personal data do not have to report their data collection to a government agency, but they need to obtain users’ consent before processing their personal information. Entities must notify users before obtaining their consent, informing them of what information is being collected and how it is intended to be used. Id.
In 2021, Google reported an annual revenue of $256 billion USD and Meta reported an annual revenue of $117 billion USD. (Statista).
Comments