On July 24, the Personal Information Protection Commission (PIPC) imposed a penalty surcharge of 1.978 billion won and an administrative fine of KRW 7.8 million on Alibaba.com Singapore E-Commerce Private Limited (“AliExpress”), which processes personal information of Korean data subjects, for violations of the provisions on cross-border transfers under the Personal Information Protection Act (PIPA).

This is the first case in which a penalty surcharge has been imposed on a foreign business for violating the overseas transfer procedures stipulated by the PIPA and the PIPC, which has been investigating overseas e-commerce companies on the collection and use of personal information since February, is expected to announce the results of its investigation into Temu, a Chinese direct purchase platform, next month. In addition, the issue of overseas transfer of personal information has become a hot topic in the industry as the PIPC has announced plans to conduct further investigations into overseas e-commerce companies that transfer personal information overseas.

Article 28(8) of the PIPA (Overseas Transfer of Personal Information) prohibits the overseas transfer (provision including viewing access, entrustment of processing, storage) of personal information  in principle, but makes an exception to allow overseas transfer if separate consent has been obtained from the data subject, and in this case, paragraph 2 of the same Article requires notifying the data subject of the items of personal information to be transferred, destination country, and timing and method of transfer, etc. and at the same time, mandates measures to ensure safety as specified in the Enforcement Decree, and measures for handling complaints and resolving disputes regarding infringement of personal information.

The PIPC imposed a penalty surcharge and an administrative fine on AliExpress for failing to comply with the abovesaid notice and protection obligations, respectively, and additionally issued a corrective order to take measures to make it easier for users to exercise their rights, as well as recommendations to improve the level of personal information protection for domestic users.

Regarding its investigation and disposition, the PIPC clarified that overseas e-commerce operators are also subject to the PIPA when providing services to domestic users and are required to protect and manage personal information at the same level as domestic operators.

[Legal Insights]

Although the PIPA does not explicitly provide for extraterritorial application, the PIPC has previously interpreted the Act as applying to foreign companies that process personal information of Korean data subjects through, for example, the 'Guide to the Application of the Personal Information Protection Act to Overseas Businesses'. It is necessary to pay attention to the specific scope of the extraterritorial application of the PIPA and how foreign companies will respond thereto in the future.
 

 

LIN’s TMT Team provides comprehensive one-stop legal services in the areas of privacy, fintech, blockchain, and other related fields. Please note that the contents and opinions published in our newsletters are for general information purposes only and do not represent the official views or legal opinions of the firm. If you have any inquiries about the above, please contact our TMT Team at (+82-2-3477-8695).