It was confirmed that 16 major overseas IT corporations, including Google, Meta, Microsoft, and OpenAI, have designated other entities as domestic agents even while maintaining Korean subsidiaries. The Personal Information Protection Commission said on the 25th that these corporations must change their designation under the revised Personal Information Protection Act, which takes effect in October.
The revised law requires an overseas business operator that has a Korean subsidiary to designate that subsidiary as its domestic agent. If this is not implemented within six months after enforcement, it may constitute a violation of the law.
The inspection found that AliExpress, Temu, Airbnb, BYD, and Oracle properly designated their Korean subsidiaries as agents. However, 16 corporations, including Google, Meta, Microsoft, OpenAI, PayPal, Roblox, Roborock, Shein, and Spotify, were still found to have law firms or separate entities as their agents.
The Personal Information Protection Commission will guide these corporations to change their designation to their Korean subsidiaries and will check whether follow-up measures are taken. It also plans to continuously verify overseas business operators that have not yet designated an agent and to induce them to fulfill their designation obligation.
Koh Hak-soo, Chairperson of the Personal Information Protection Commission, said, "Overseas business operators must thoroughly guarantee the personal information rights of domestic users," and added, "We will strengthen the publication of guidelines and publicity in line with the enforcement of the revised law so that corporations fulfill their responsibilities."