The Personal Information Protection Commission said on the 16th that the "2025 privacy policy assessment," conducted across seven sectors closely tied to daily life, found the average score rose sharply to 71 points from 57.9 points a year earlier.
The privacy policy assessment system, introduced in 2024, is designed to strengthen transparency and accountability in personal information processing by checking the policies established and disclosed by personal information controllers.
This year's assessment covered 50 representative services across seven sectors where new technologies are used or large-scale personal information processing occurs, including connected cars, Edtech, smart homes, generative artificial intelligence (AI), telecommunications, reservation and customer management services, and health care apps.
The assessment indicators consisted of whether the items required under the Personal Information Protection Act were properly reflected in the policy (adequacy), how easily users could understand the policy (readability), and how easily it could be found (accessibility). The adequacy assessment was conducted by a committee of experts, while readability and accessibility were evaluated by a user panel of 100 members of the public.
In the results, Samsung C&T's smart home service "Homeniq" was rated by both the evaluation committee and the user panel as having the highest level of policy documentation. Domestic connected car operators such as Kia and Hyundai Motor also received the highest scores in adequacy for presenting relatively clear standards for collection and use, provision and outsourcing of personal information, and for efforts to guarantee data subject rights.
By contrast, some overseas operators used different titles instead of "privacy policy," or provided guidance on exercising data subject rights only in English, leading to lower scores in readability and accessibility compared with domestic corporations.
The consistency rate between the purposes, items, and retention periods for personal information notified during actual service use and those in the policy stood at 53%. While improved from 28% a year earlier, the Personal Information Protection Commission noted that policies still do not sufficiently reflect actual personal information practices.
In handling privacy-related inquiries, phone calls were processed relatively quickly, but some email inquiries were delayed or went unanswered.
Some mobile apps were assessed as needing to simplify access paths, such as requiring login to view the policy or requiring more than three steps to reach it.
During the assessment period, 26 corporations (52%) voluntarily improved items such as processing categories, legal grounds, and the status of third-party provision and consignment by reflecting the committee's opinions.
Greencar and Hotel Shilla institutionalized approval procedures for personal information processing when introducing or changing services to enhance consistency, and 17 corporations including KB Kookmin Bank and LG Electronics were found to have improved comprehension through plain language and various formats such as videos. SK Telecom and Media Log received high marks for providing separate policies in comic format.
KG Mobility introduced a Highlight feature that shows key points at a glance, and BMW Korea and LG Electronics provided a separate tab for major changes. ㅜKT was evaluated as standing out for efforts to ensure transparency and trust by clearly specifying the purposes and scope of personal information used for AI training in connection with AI services.
The Personal Information Protection Commission said, "We will continue cooperation to raise the quality of policy drafting by providing on-site feedback and roundtables for underperforming corporations," adding, "For corporations whose improvements are insufficient, we will consider recommending corrective measures and will check implementation through a reassessment in 2027."