The Personal Information Protection Commission imposed a penalty surcharge of 10.36 billion won on TikTok and 252 million won on Apple. Both companies collected, used, and transferred personal data of users overseas without a lawful basis, but the penalty surcharges differed by more than 40 times. Whether personal data use led to revenue, the laws in force at the time of the violations, and corrective measures taken during the investigation determined the size of the penalty surcharges.
The Personal Information Protection Commission said on the 23rd that at a plenary meeting on the 22nd it resolved to impose penalty surcharges and issue correction and disclosure orders on TikTok and two Apple affiliates for violating the Personal Information Protection Act and the former Act on Promotion of Information and Communications Network Utilization and Information Protection, respectively.
The key factor that split the penalty surcharge amounts for the two companies was whether there was revenue directly tied to the violations. Under the current Personal Information Protection Act, penalty surcharges are calculated based on the amount obtained by excluding revenue unrelated to the violations from total sales.
In the name of advertising and content performance analysis, TikTok provided behavioral data collection tools to the websites and applications of about 71,000 corporations in Korea as of December last year. When a TikTok user accessed a website or app with this tool installed, records of activities such as clicks, searches, purchases, adding to cart, and viewing content were sent to TikTok.
Activity records of 9.45 million monthly active users in Korea collected this way were used to deliver targeted ads. However, in the process, TikTok bundled consent for collecting third-party behavioral data into other required personal data processing consents. This effectively failed to guarantee users a real choice to refuse data collection while still using TikTok's services.
The Personal Information Protection Commission said that because TikTok used user information it collected without authorization for targeted ads to generate revenue, ad revenue related to targeted ads directed at users in Korea was included in the basis for calculating the penalty surcharge. Revenue from unrelated services such as streaming and gifting was excluded.
The scope for reducing the penalty surcharge was also limited. The Personal Information Protection Commission deemed it a "very serious violation" that TikTok not only collected behavioral data but actually used it for targeted ads. In such cases, reductions can be excluded or the reduction range can be narrowed, and the commission said this assessment was reflected in the final penalty surcharge.
By contrast, the biggest reason Apple's penalty surcharge was relatively small is that the voice assistant "Siri" at issue is a free service. Until Aug. 2019, Apple collected voice recordings generated when users used Siri and the transcripts converting them to text without separate consent and used them to improve voice recognition and search results. From Oct. 2019, it obtained separate consent for using voice recordings, but it continued to use transcripts to improve the service without a lawful basis.
The Personal Information Protection Commission said it applied a flat penalty surcharge rather than a sales-based one because Siri carries no separate usage fee or directly related revenue. The fact that the violations occurred long ago also had an effect. Apple's collection of voice recordings and other actions occurred through 2019, so the former Act on Promotion of Information and Communications Network Utilization and Information Protection then in force applied. The flat penalty surcharge cap under the former act is 400 million won, one-fifth of the 2 billion won cap under the current Personal Information Protection Act.
Apple's correction of the unlawful status during the Personal Information Protection Commission's investigation also served as a mitigating factor. Apple allowed users to choose whether transcripts would be collected and used, and introduced measures to filter personal information contained in transcripts. The commission said it took these points into account when calculating the final penalty surcharge.
The Personal Information Protection Commission said, "We will continue to inspect how overseas operators handle personal information and respond strictly to illegal acts without discrimination between domestic and overseas corporations, so that the personal information of our people can be protected safely and transparently across borders even in complex environments."