CONTENTS
- 1. Company M, Which Objected to the Administrative Disposition
- - The Arguments of Company M, Which Filed a Lawsuit to Revoke the Penalty Surcharge
- - The Commission's Position That the Penalty Surcharge Is Lawful
- 2. The Supreme Court's Conclusion That the Administrative Disposition Is ‘Lawful’
- - The EU Also Imposes a Fine of 324.9 Billion Won on Company M
- 3. Daeryun's Strategy for Responding to Administrative Dispositions
1. Company M, Which Objected to the Administrative Disposition
Company M, a global big tech company that objected to the administrative disposition, provided the personal information of users of the SNS it operates to other businesses without authorization and received a penalty surcharge of 6.7 billion won from the Personal Information Protection Commission (hereinafter the Commission).
In November 2020, the Commission confirmed that Company M had transferred the personal information of 3.3 million domestic users of its SNS, such as their education, career, place of origin, family, and marriage or relationship status, to approximately 10,000 other businesses without consent, and on that basis it issued this administrative disposition.
Company M argued that the information provided to other businesses was information that the users had already voluntarily disclosed and therefore did not constitute personal information, and that it had not violated the domestic Personal Information Protection Act. However, the final appeal before the Supreme Court was also dismissed.
The Arguments of Company M, Which Filed a Lawsuit to Revoke the Penalty Surcharge
1. Company M Was Not the Entity Collecting the Personal Information
Company M argued that the behavioral information collected on other companies' websites or apps was collected by those businesses and then provided to Company M or entrusted to it for processing, and that the entity collecting the personal information was therefore not Company M.
Accordingly, it argued that consent to the collection and use of personal information had to be obtained by those businesses, and that Company M had no obligation to obtain consent.
2. Argument That There Was No Problem With the Consent Procedure
Company M stated that, upon registration for its SNS service, it had obtained consent to its ‘Data Policy,’ that this policy included the details of the collection and use of information, and that it therefore satisfied the requirements imposed by law.
3. Argument That the Imposition of the Penalty Surcharge Was Unlawful
Company M stated that the Commission had imposed an excessive amount, and argued that the method of calculating the penalty surcharge was also unlawful.
The Commission's Position That the Penalty Surcharge Is Lawful
The position of the Commission, that the penalty surcharge is lawful, is as follows.
1. Argument That the Substantive Entity Collecting the Personal Information Was Company M
Company M directly generated online identifiers and assigned them to users, and on that basis collected, stored, and analyzed behavioral information from other companies.
The Commission argued that, because the websites and users did not hold this information, the obligation to obtain consent rested with Company M.
2. Argument That There Was No Lawful Consent
The Commission pointed out that Company M had merely presented a voluminous data policy and had not clearly specified the legally required notice matters (the purpose of collection, the items, the retention period, and so forth).
It also emphasized that, while Company M provided a proper consent procedure to European users, it did not properly give notice to domestic users.
It further pointed out that processing consent as automatically checked upon registration (an opt-out method) was also problematic.
The Commission determined that this conduct by Company M did not satisfy the clear notice and prior consent requirements demanded by the Personal Information Protection Act.
3. Argument That the Imposition of the Penalty Surcharge Was Appropriate
The Commission determined that, because Company M had not obtained lawful consent for the collection and use of personal information, it was subject to the imposition of a penalty surcharge.
It also stated that the penalty surcharge was calculated by reflecting factors such as revenue, gravity, and the duration of the violation, and that, because there was a record of a prior violation, no mitigation was necessary.
It argued that the amount of the penalty surcharge had been justly determined within the statutory upper limit, and that the public interest served by the disposition was also very significant in terms of protecting the right to informational self-determination.
2. The Supreme Court's Conclusion That the Administrative Disposition Is ‘Lawful’
With respect to Company M, which filed a revocation lawsuit against the administrative disposition, the Supreme Court followed the determinations of the first- and second-instance courts and rendered a judgment dismissing Company M's claim.
Company M filed suit in 2021 on the ground that the administrative disposition was improper, but it lost at the first instance in 2023 and the second instance in 2024, and the final appeal before the Supreme Court was also dismissed, so its final loss of the case was confirmed.
The Supreme Court determined that the information in question constituted personal information, and that Company M's act of providing it to a third party without the users' consent violated the Personal Information Protection Act.
It followed the lower judgment, which held that, because users could neither know nor foresee the legally required notice matters for consent to personal information, they could not be deemed to have consented.
It also determined that, even if the users had disclosed the information, Company M bore responsibility as the service provider.
The Commission stated that, because the effect of the disposition, which had been stayed due to the lawsuit, was reinstated following the final determination, it would urge Company M to comply with the corrective order and would also inspect whether it had complied.
The EU Also Imposes a Fine of 324.9 Billion Won on Company M
This past April, the EU also imposed a fine of 200 million euros (approximately 324.9 billion won) on Company M.
The issue was that, where users of Company M's service did not pay the service fee, they were in effect compelled to consent to the collection of data for advertising purposes.
This measure is the first sanction issued under the ‘Digital Markets Act (DMA),’ which sought to regulate the market power of global big tech companies and to create a fair and competitive market.
There are also remarks that it appears to be a retaliatory move in the EU's tariff war against the Trump administration.
3. Daeryun's Strategy for Responding to Administrative Dispositions
Following the Supreme Court's judgment that the administrative disposition is lawful, this administrative disposition lawsuit appears likely to become a precedent emphasizing the personal information protection responsibility of large-scale platform businesses.
Matters such as who the entity collecting the information is, in what cases a user's explicit consent must be obtained, and the appropriateness of the calculation of a penalty surcharge are areas that are difficult to assess without a deep understanding of the relevant statutes and precedents.
Accordingly, if a company is in a situation where it collects or uses personal information or must contest an administrative disposition, it may be advisable to receive the assistance of an attorney with specialized knowledge of and practical experience in the Personal Information Protection Act.
In particular, a company operating a platform-based service should review the legal risks regarding its personal information collection and use structure from the early stages of service design, and should also receive legal advice that can enable a strategic response if a dispute later arises.
Daeryun Law Firm LLP brings together attorneys experienced in numerous 🔗Personal Information Protection Act violation matters and 🔗attorneys handling corporate matters in a team, and does its utmost to manage businesses' commercial risks.
