Global big tech companies, platform companies’ violation of personal information protection law.
Article posted in 2025-02-03 15:06:52 | VEAT
Recently, both domestically and internationally, the importance of personal information protection is increasingly highlighted. In particular, legal and ethical issues have arisen from massive global platform companies processing personal information or transferring it abroad, and court decisions regarding these issues are receiving much attention. Focusing on the Seoul Administrative Court’s rejection of the fine cancellation lawsuit against Google & Meta and the Personal Information Protection Committee (hereinafter “the Personal Information Protection Committee”)’s sanction against KakaoPay & Apple’s unauthorized overseas transfer of personal information, we will examine the legal importance of personal information protection.
1. Rejection of Google & Meta Fine Cancellation Lawsuit
Recently, the Seoul Administrative Court sided with the Personal Information Protection Committee in the fine cancellation lawsuit filed by Google and Meta against the Committee’s fine imposition decision. This ruling is significant as it establishes an important standard for protecting personal information and clearly requiring user consent.
Starting in 2021, the Personal Information Protection Committee discovered that Google and Meta were collecting online activity data, such as website visit history and app installation and usage history, without user consent and using it for customized advertising, and imposed fines of approximately 69.2 billion KRW (Google) and 30.8 billion KRW (Meta). Google and Meta argued that they received user consent through their privacy policies, claiming that their actions were justified, but the court did not recognize this.
The court ruled that simply obtaining consent to the privacy policy was not sufficient to determine that users fully understood how their data would be used and consented to it. This decision reaffirmed the importance of the right to self-determination of personal information and strengthened the standard requiring large-scale platform companies to obtain clear consent when processing personal information. This is expected to be a catalyst for raising the level of personal information protection not only in Korea but also internationally.
Law firm Veat provides professional advice on personal information protection law issues faced by global platform companies. As seen in the case of Google and Meta, clear user consent procedures and the legality of privacy policies are critical factors that can affect a business's credibility when collecting and utilizing large amounts of data. Law firm Veat assists global companies providing domestic services in drafting personal information collection consent procedures and privacy policies that comply with Korea’s personal information protection law, and particularly supports ensuring the rights of information subjects and the legality of the service by providing clear explanations regarding the overseas transfer of personal information.
2. Administrative Actions against KakaoPay, Alipay & Apple: Limits of Overseas Transfer of Personal Information In January 2023, the Personal Information Protection Committee confirmed that KakaoPay, Apple, and Alipay violated the personal information overseas transfer regulations and imposed fines of 59.68 billion KRW (KakaoPay) and 24.5 billion KRW (Apple), respectively, and ordered Alipay to dismantle the unfairly constructed personal information processing model (NSF score).
KakaoPay provided the personal information of approximately 40 million users to Alipay, a third party, through the Apple in-app payment system process, without obtaining separate consent. The fact that this included information of users who were not integrated with the Apple payment system caused even greater controversy. Apple was also criticized for failing to notify users of the delegation of personal information processing and overseas transfer.
This case once again highlighted the importance of "explicit consent from users when transferring information overseas" and "transparent notification through the privacy policy," as required by the Personal Information Protection Act. It was emphasized that if the responsibilities of businesses are not clearly defined when providing or delegating personal information abroad, serious disadvantages may occur to users who are information subjects.
The Personal Information Protection Committee imposed fines and corrective orders on both KakaoPay and Apple, and ordered Alipay to completely dismantle the unfairly constructed NSF score calculation model. This action serves as a strong reminder that businesses must have clear legal grounds for transferring personal information overseas and make them transparently public.
Law firm Veat supports companies to ensure that they fully meet the legal requirements for transferring personal information overseas or delegating processing. Specifically, we provide professional advice on reviewing the specific requirements for user consent and the transparent disclosure standards for privacy policies, and on clearly distinguishing legal responsibilities in the process of concluding contracts with overseas delegates. This customized support helps global companies providing services to prevent fines and loss of credibility due to violations of personal information protection laws.
Key Personal Information Protection Guidelines for Global Platform Companies 1) Clear Consent is Essential 2) Transparent Information Provision 3) Compliance with Global Standards Law firm Veat has extensive experience and expertise in legal advice related to personal information protection. We provide customized legal services to domestic startups and global companies, including reviewing privacy policies, assessing the legality of overseas transfers, and developing personal information breach response strategies. In particular, we provide specialized support to IT and data-based startups to minimize legal risks.
Personal information protection has become a core element that goes beyond mere regulatory compliance and determines a company’s credibility and sustainability. Law firm Veat will provide the best possible legal advice to ensure that all companies uphold this important value.
This case study can be checked on the Law firm Veat blog below.
- Violation of Personal Information Protection Law by Global Big Tech and Platform Companies
Thank you.
When businesses process or transfer personal information overseas, explicit and specific consent from the information subject is essential. Legal requirements cannot be met simply by obtaining consent to a comprehensive privacy policy.
Users must be clearly notified of what information is being processed and transferred overseas. The privacy policy must be kept up-to-date, and the content of the delegation must be specifically stated.
As confirmed by the fine imposition against Google & Meta, failing to comply with the standards of the country in which services are provided can lead to substantial fines and a serious loss of business credibility. Global businesses must thoroughly review and reflect the personal information protection regulations of each country.
Law firm Veat