The Personal Information Protection Commission imposed a 210 million won penalty surcharge on Bithumb for transferring personal information overseas without user consent.
The Personal Information Protection Commission said on the 25th that at a full commission meeting held the previous day, it decided to impose a 210 million won penalty surcharge on Bithumb for violating rules on overseas transfers of personal information and adopted a corrective order requiring the company to meet lawful conditions for overseas transfers.
Earlier, the Personal Information Protection Commission launched an investigation into the legality of overseas transfers of personal information in Bithumb's "order book (quote board) sharing" process, which was raised during the National Assembly audit last year. The investigation found that from September to November last year, personal information was transferred overseas while sharing order books with overseas exchanges in the Tether (USDT) market.
In this process, users were asked to give separate consent for transferring personal information to the Stellar exchange, but it was found that member numbers and order information were actually sent to a system (bingx.com) operated by another exchange.
In addition, when users transferred virtual assets to overseas exchanges, the company provided the sender's and recipient's names, wallet addresses, and other details to 13 overseas exchanges for anti-money laundering (AML) purposes, but it was found not to have met some legal requirements for overseas transfers under the privacy law, such as obtaining separate consent from data subjects.
The Personal Information Protection Commission said, "While we recognize the need to provide personal information for anti-money laundering, overseas transfers of personal information are closely tied to data subjects' right to self-determination and therefore the legal requirements and procedures must be strictly observed."
Accordingly, the Personal Information Protection Commission imposed a 120 million won penalty surcharge on Bithumb for violating rules on overseas transfers of personal information during the order book sharing process, and a 90 million won penalty surcharge for violating rules on overseas transfers of personal information during virtual asset transfers.
Meanwhile, reflecting the characteristics of blockchain technology identified during the investigation, the Personal Information Protection Commission prepared "blockchain service personal information protection guidelines." The guidelines include measures to prevent disclosure and tracking of on-chain (information recorded on blocks of the blockchain network) information due to transparency, measures to manage information sharing among participants due to decentralization, and measures to destroy personal information due to immutability, tailored to each characteristic of blockchain.