South Korea’s Personal Information Protection Commission (PIPC) has audited privacy practices of tech companies and has announced it found that three giants have been coming up short in this area and violating the country’s laws.
To nobody’s surprise, they are Facebook and Google, but also Netflix. Two of the three have received fines that total $5.7 million – no doubt a slap on the wrist for these tech heavyweights – but they have also been ordered to fix the problems that led to privacy rules violations.
Although the $5.5 million penalty that goes with it might be paltry from Facebook’s perspective, it is the second largest fine the Korean commission has imposed to date.
Facebook is in trouble for stepping out of bounds of South Korea’s personal information act when the company made and kept facial recognition templates of some 200,000 users, from April 18 until September 2019. This was happening without those users’ consent.
The first time Facebook was hit with a fine in this country was in late 2020 when it also didn’t bother to secure users’ consent for giving their personal information to third parties. Facebook, however, denies this accusation.
This time, Facebook will have to pay a further $22,000 for collecting residential registration numbers illegally and failing to inform users about changes in personal information management policy.
As for the facial recognition templates, Facebook will have to destroy them, as well as data that has been transferred internationally. The company will also have to introduce an easier way for people to learn about legal notices concerning personal information.
Netflix will have to pay $188,000 for harvesting data from five million users, once again without consent, and $2,700 for not making it public that this data was subject to international transfer out of South Korea. Local media in Korea report that the collection of personal data was done even before Netflix users completed their registration.
Google, meanwhile, will not have to pay any fines, but has received a recommendation to improve the process of handling personal information and fix its vague legal notice pertaining to collection of personal information, making sure it is clear to its users.
