meta logo. Reuters Yonhap News
A fine of 21.6 billion won was imposed on Meta for violating the Personal Information Protection Act by collecting sensitive information such as religious and political views of Facebook users and using it for customized advertisements. In 2022, Meta was fined 30 billion won in fines, and will now have to pay a large amount of money for customized advertising issues.
The Personal Information Protection Committee announced on the 5th that it held a general meeting on the 4th and decided to impose a fine of 21.6232 billion won and a corrective order on Meta for collecting and using sensitive information without a legal basis for processing.
The Personal Information Commission began this investigation in November 2020 following the commission’s first sanction, Facebook’s decision regarding the unauthorized provision of personal information. It was confirmed that Meta collected sensitive information, such as religious views, political views, and same-sex marriage status, of about 980,000 domestic users through their Facebook profiles, and provided this information to advertisers, which was used by about 4,000 advertisers. Meta analyzed behavioral information, such as pages users liked on Facebook and advertisements they clicked, and created and operated advertising topics related to various sensitive information, such as specific religions, homosexuality, transgender people, and North Korean defectors, based on this information.
The Personal Information Protection Act restricts the processing of information on thoughts, beliefs, political opinions, sexual life, etc. by defining it as sensitive information that must be strictly protected, and processing can only be done with consent. However, while Meta collected this information and used it for customized services, it clearly stated it in its ‘data policy’ and did not receive separate consent. There were no additional protective measures taken. Meta stopped collecting sensitive information from profiles in August 2021, and destroyed advertising topics that were sensitive information in March 2022.
Additional illegal acts also came to light during the investigation. Meta refused the user’s request to view personal information on the grounds that it was not subject to the request for viewing under the Personal Information Protection Act, but the Personal Information Commission determined that there was no justifiable reason for Meta’s refusal. Homepages whose services are interrupted or unmanaged must be deleted or blocked, but it was also revealed that due to insufficient related measures, a hacker leaked the personal information of 10 Korean users using fake IDs.
Previously, in September 2022, the Personal Information Commission imposed the largest ever fines of KRW 69.2 billion and KRW 30.8 billion on Google and Meta, respectively, for violating the Personal Information Protection Act by collecting personal information without user consent and using it for online customized advertising. At the time, the problem was that third-party user behavioral information was collected and analyzed and used for customized advertising without consent.
Google and Meta, who objected to this decision, filed an administrative lawsuit claiming that it is not they, the platform operators, who must obtain consent to collect personal information, but website and app service providers, and the trial is in progress. In February of last year, Meta was fined 6.6 million won for mandatory consent to provide personal information, and in July of the same year, it was additionally fined 7.4 billion won for collecting user information. These matters are also awaiting court judgment.
The Personal Information Commission said, “This investigation and disposition is significant in that it ensures that overseas businesses operating global services also comply with their obligations when processing sensitive information stipulated by Korean law and sufficiently guarantee the rights of information subjects,” adding, “Meta’s correction “We will continuously check whether the order has been implemented and apply the Personal Information Protection Act to global companies without discrimination,” he said.
Meta said, “We will carefully review the written opinion once we receive it.”
