The Personal Information Protection Commission imposed a total penalty surcharge of 10.5 billion won on TikTok and Apple for collecting and using the personal information of domestic users without a legal basis and for transferring it overseas.
On the 22nd, the Personal Information Protection Commission held its 14th plenary meeting and imposed a penalty surcharge of 10.36 billion won on TikTok for violating the Personal Information Protection Act, while issuing a corrective order and an order to make the disposition public. It also imposed a penalty surcharge of 252 million won on two Apple affiliates for violating the former Act on Promotion of Information and Communications Network Utilization and Information Protection and decided on corrective orders.
The investigation found that TikTok collected users' activity records left on other corporations' websites or apps but did not clearly inform them of this during sign-up.
As of December last year, TikTok provided behavior information collection tools to the web and apps of more than 71,000 domestic corporations for advertising and content performance analysis. Through these tools, it collected records such as clicks, searches, and purchases from 9.45 million domestic users and used them for personalized ads by linking them to its member account.
However, TikTok obtained consent for collecting and using third-party behavior information for advertising as mandatory consent together with other personal information processing consents necessary to provide the service. The Personal Information Protection Commission judged that by structuring the service so that it was difficult to use without consenting to the collection in question, it did not guarantee a genuine right to choose.
In addition, TikTok's app-tech platform TikTok Lite handed over users' personal information to affiliates in the process of providing a point cash withdrawal service, but it was found that it did not disclose or notify users of the personal information items being transferred, the purposes for which the transferees would use them, or the retention and use periods.
The Personal Information Protection Commission explained that TikTok's collection and use of third-party behavior information and its overseas transfer without a legal basis each constituted violations of Article 15 (Collection and Use of Personal Information), Paragraph 1, and Article 28-8 (Overseas Transfer of Personal Information), Paragraph 1, of the Protection Act.
The investigation into Apple began after reports on a lawsuit in the United States alleged that the voice assistant service "Siri" collected and used users' voice data without permission. At the time, claims were raised that Siri became active and collected conversation content even when users did not call it by voice, and that some information was shared with corporations so it could be used for personalized ads.
According to the Personal Information Protection Commission, until August 2019, when users used Siri, Apple collected voice recordings and transcripts converting them into text. While using this information to improve voice recognition features and search results, it did not obtain separate consent from users.
From October 2019, it obtained separate consent to use voice recordings for service improvement, but it was confirmed that transcripts were still used for service improvement without a lawful processing basis.
Problems also emerged in the process of overseas transfer of personal information. Apple transferred users' personal information to affiliates overseas, including in the United States, yet did not sufficiently specify in its privacy policy the personal information items, the purposes for which the transferees would use them, or the retention and use periods.
However, during the investigation, Apple improved procedures to allow users to choose whether transcripts would be collected and used and introduced a feature to filter out personal information contained in transcripts. It also revised its privacy policy and corrected the confirmed violations.
Accordingly, the Personal Information Protection Commission imposed a penalty surcharge of 252 million won on ADI, an Apple affiliate, for violating the Act on Promotion of Information and Communications Network Utilization and Information Protection. In addition, it issued a corrective order to another affiliate, ASPL, to strengthen personal information protection measures, including by reviewing the status of overseas personal information transfer.
The Personal Information Protection Commission said, "Going forward, we will continue to inspect how overseas business operators handle personal information and respond strictly to illegal acts without discrimination between domestic and overseas corporations, so that our people's personal information can be protected safely and transparently across borders in complex environments."