Personal Information Compliance | Personal Information Protection Commission Imposes a Penalty Surcharge of 624.6 Billion Won on Coupang, Expanding the Scope of Corporate Personal Information Management

It is worth first examining the fact that this sanction recognized multiple violations together, rather than a single act of violation.

The Personal Information Protection Commission found that a large-scale personal information leak occurred due to violations of safety measure obligations, such as authentication signing key management and access control.

Separately, it also found that the act of collecting and storing users' online activity records likewise constituted a violation of the Personal Information Protection Act.

What draws attention more than the size of the penalty surcharge itself is that the personal information leak and the data utilization issue were each assessed as independent violations.

This also means that, even had no personal information leak incident occurred, the manner of processing online activity records alone could give rise to a separate sanction.

The Personal Information Protection Commission found that Coupang collected its members' online activity records and stored them in a database in a personally identifiable state.

The subjects of investigation included URL information, access date and time, access IP, and app usage information.

Article 15 of the Personal Information Protection Act sets out the legal basis for the collection and use of personal information, and a personal information controller must clearly define the purpose of processing and the scope of collection.

In this case, the Personal Information Protection Commission reviewed whether the process of collecting and storing online activity records conformed to the standards of the relevant statutes, and it imposed a penalty surcharge of approximately 201.1 billion won for that violation.

Within a personal information compliance system, the personal information protection officer (CPO) performs the role of overseeing personal information protection duties.

Article 31 of the Personal Information Protection Act requires a personal information controller to designate a personal information protection officer and to have that officer carry out duties such as reviewing the status of personal information processing and establishing and operating an internal management plan.

In this investigation, the Personal Information Protection Commission found that the independence of Coupang's personal information protection officer was not sufficiently guaranteed. It also reviewed whether a system was appropriately operated under which the personal information protection officer could substantively perform the function of managing and supervising the personal information processing process.

Accordingly, in this case, the operating system of the personal information protection organization was included as a subject of investigation, in addition to the personal information leak and the issue of processing online activity records.

The Personal Information Protection Commission stated that it confirmed that, in the course of operating Coupang's advertising partners, service usage records were collected regardless of the users' intentions.

The results of the investigation also included the process by which advertising partners collected users' website visit records and app usage records.

The Personal Information Protection Commission investigated whether Coupang had appropriately managed and supervised the processing of information collected through its advertising partners, and as a result it determined that improvement was needed in terms of securing transparency in personal information processing and guaranteeing users' right to choose, and accordingly issued a related corrective order.

In addition, the process by which Coupang Fulfillment Services (CFS) utilized workers' weight information was also included as a subject of investigation.

The Personal Information Protection Commission confirmed that CFS had utilized weight information, which it had collected and stored for the purpose of employee health management, in the course of litigation related to an industrial accident.

It accordingly regarded such information as sensitive information related to health status, and reviewed whether it had been utilized beyond the scope of the purpose of collection.

Article 23 of the Personal Information Protection Act requires that, where sensitive information such as health information is processed, there be a separate legal basis or that separate consent be obtained from the data subject.

The Personal Information Protection Commission found that the process of utilizing the weight information did not conform to these requirements for processing sensitive information, and it imposed a separate penalty surcharge in respect of this.

In this case, the Personal Information Protection Commission found that a separate violation was established not only for the leak of personal information of approximately 37.5 million people but also for the process of handling online activity records.

It is also worth noting that, of the total penalty surcharge of 624.6 billion won, approximately 201.1 billion won was imposed in respect of violations related to the collection and utilization of online activity records.

In addition, the Personal Information Protection Commission did not merely confirm the fact of the personal information leak; it also investigated the operating system of the personal information protection officer, the management and supervision system for advertising partners, and the process of utilizing sensitive information.

This shows that not only the results of personal information processing but also the process of collecting and using personal information, as well as the operating status of the internal management system, may become subjects of investigation.

Following this case, the need has grown for companies to review, together, not only the security system for preventing personal information leaks but also the operating status of the personal information processing policy, the manner of utilizing online activity records, whether sensitive information is held, the operating system of the personal information protection officer, and the management status of entrusted parties and affiliated partners.

In particular, companies operating online services need to verify how the data utilized in the advertising and marketing process is collected and used, and whether the relevant information is appropriately disclosed to users.

Personal information issues are not a matter for the information protection department alone.

Where violations are identified in the personal information processing process, multiple departments, including legal, marketing, IT, and human resources, may be affected simultaneously, and in some cases the company may need to address the imposition of a penalty surcharge, compliance with a corrective order, and a response to claims for damages.

Accordingly, companies need to put in place a system for periodically inspecting the personal information processing process as a whole and to verify whether the personal information processing policy matches the actual operating status.

It is also advisable to identify potential risk factors in advance through legal review of matters such as the manner of utilizing online activity records, the procedures for processing sensitive information, and the management status of entrusted businesses.