The Personal Information Protection Commission said on the 24th that it recommended strengthening safety measures in the transfer and sharing of personal information for five so-called 'super apps': KakaoTalk, Naver, Coupang, Baemin, and carrot, as well as improving the practice of requesting unnecessary consent.
The Personal Information Protection Commission convened its 16th plenary session the day before and deliberated and voted on the results of a preliminary inspection that included this information. A super app refers to an online platform that provides various services in a department store style, including search, shopping, finance and payment, and other daily life-related functions within a single app.
The Personal Information Protection Commission demanded that super apps strengthen the management of transfer and linkage points for personal information.
Super apps are transferring or sharing customer personal information between processors using two methods: API (Application Programming Interface) and DW (Data Warehouse). In response, the Personal Information Protection Commission recommended enhancing internal controls to ensure that important matters, such as the creation and distribution of external transfer pathways for personal information like APIs and granting access rights to personal information processing systems like DW, are decided with the participation of the department responsible for data protection.
It also requested that access records for DW be managed and inspected for two years as stipulated by the Personal Information Protection Act.
It raised concerns that most businesses are collecting essential information needed for contract fulfillment while still requiring separate 'consent.' Even though some information can be collected without consent under the law, the excessive increase in consent items could lead to user confusion.
The Personal Information Protection Commission recommended improving the process so that only items requiring user consent are collected after essential matters such as contract fulfillment are disclosed through the privacy policy upon service subscription.
Furthermore, it recommended clearly informing users of the list of services offered by the super app in the terms of service to guarantee the right to personal data self-determination and implementing a feature that allows users to opt out of individual services. It also required that procedures for requests to stop or delete personal data be communicated in an easy-to-understand manner.
The Personal Information Protection Commission noted, 'This preliminary inspection is significant as it proactively examines the entire process of handling personal information in super app services to preemptively block the risk of infringing upon the right to personal data self-determination,' and added, 'We plan to continue to verify whether the recommended improvements are properly complied with.'