2024.07.25. The Fair Economy — AliExpress, which failed to notify users of information required by the Personal Information Protection Act, such as "the country to which personal information is transferred" and "the name (corporate name) and contact information of the recipient of the personal information," has been fined nearly 2 billion won. It was also found that AliExpress did not reflect necessary privacy protection measures in seller terms, made it difficult for users to find the membership withdrawal menu, and displayed the account deletion page in English, hindering users' exercise of their rights.
The Personal Information Protection Commission (PIPC) said on the 24th that it had resolved, at its 13th plenary session, to impose a fine of 1.978 billion won and an administrative fine of 7.8 million won on AliExpress for violating personal information protection regulations in this manner, along with a corrective order and an improvement recommendation.
According to the commission, it had been conducting related investigations following National Assembly audit criticisms and media reports that "the surge in cross-border direct purchase services has raised significant concerns about privacy infringement of our citizens."
AliExpress is a typical "open market" that provides a platform for registered sellers to sell products to users and takes a certain percentage of sales as brokerage fees. When users purchase products, AliExpress provides (transfers) their personal information to overseas sellers so the sellers can ship the goods. It was confirmed that roughly 180,000 Chinese sellers have received Korean users' personal information this way.
Since personal information transferred overseas in this way is difficult to cover under protective measures required by the Act, Korea's Personal Information Protection Act requires businesses to obtain consent after clearly informing data subjects of this fact, and to reflect measures such as safeguards for data security and procedures for handling complaints and resolving disputes related to personal information infringement in their contracts with sellers.
However, AliExpress failed to notify users of information required under the Act — including "the country to which personal information is transferred" and "the name (corporate name) and contact information of the recipient of the transferred personal information" — and failed to reflect necessary personal information protection measures in its seller terms and conditions. It also made it difficult for users to exercise their rights by making the membership withdrawal menu hard to find and displaying the account deletion page only in English.
Accordingly, the PIPC imposed a fine and an administrative fine on AliExpress for violating provisions of the Act related to the overseas transfer of personal information, and issued a corrective order requiring the company to reflect measures required under Korea's Personal Information Protection Act in its contracts in order to prevent misuse by overseas sellers who receive the transferred personal information, and to take steps — such as simplifying the membership withdrawal process — to make it easier for users to exercise their rights.
In addition, to raise the level of personal information protection for domestic users, the PIPC recommended that AliExpress: ▲ disclose its personal information processing flow to data subjects as transparently and clearly as possible, and promptly update it whenever changes occur; ▲ go beyond simply designating a domestic representative and make substantive efforts to operate personal information protection measures, in particular by establishing and implementing concrete plans to resolve complaints and remedy damages related to personal information processing; and ▲ minimize the personal information it collects in line with the principles of the Act, and either join the public-private cooperative voluntary code operated by domestic e-commerce companies or provide a comparable level of personal information protection.
The PIPC plans to continuously monitor compliance with the corrective order and improvement recommendations to prevent infringement of citizens' personal information.
Regarding this investigation and sanction, the PIPC said, "This is significant in that it makes clear that even overseas e-commerce operators are subject to Korea's Personal Information Protection Act if they provide services targeting domestic users, and are required to protect and manage personal information at a level comparable to domestic businesses. In particular, we hope this will serve as an occasion for the company to faithfully fulfill its obligations under the Act when transferring personal information overseas, while also taking appropriate protective and safety measures in its relationships with registered sellers, thereby fully ensuring data subjects' right to self-determination over their personal information."
Meanwhile, the PIPC plans to deliberate and resolve the case against Temu, which faces similar suspicions, after additional verification of facts and requests for supplementary document submission.
0 Comments
No comments yet.