Personal Information Protection Commission Sanctions 5 Operators Including Coinone for Personal Data Protection Law Violations

[Asia Economy Reporter Eunmo Koo] The Personal Information Protection Commission confirmed violations of personal information protection regulations by five virtual asset operators, including Coinone, and imposed fines.

On the 23rd at 10 a.m., the Personal Information Protection Commission held the 11th plenary meeting at the Government Seoul Office and decided to impose a total fine of 45.4 million KRW and corrective orders on five operators who violated personal information protection regulations. The operators identified this time are ▲Coinone ▲Scoop Media ▲Siternet ▲Dr. Martens Airwear Korea ▲Timon, totaling five operators.

First, Coinone neglected safety measures by setting the access rights of application forms created through Google Forms, provided by Google, to 'public,' allowing third parties without viewing rights to see them during the member recruitment process. Scoop Media made it more difficult for users to withdraw membership than to collect personal information by allowing membership withdrawal only via email, neglecting the obligation to protect users' rights.

Siternet did not store users' passwords using one-way encryption, and Dr. Martens Airwear Korea did not include information about personal information processing consignment, which is a statutory notice item, in the privacy policy disclosed on its website and other channels. Timon delayed measures in response to users' personal information access requests by about 25 days, confirming violations of personal information protection regulations in each case.

The Personal Information Protection Commission added that especially the two companies, Coinone and Scoop Media, are virtual asset operators required to complete registration by September under the amended Act on Reporting and Using Specified Financial Transaction Information, and this action is expected to serve as an opportunity for the virtual asset industry to comply more thoroughly with personal information protection regulations.

Song Sang-hoon, Director of the Investigation and Coordination Bureau of the Personal Information Protection Commission, stated, “Companies that routinely handle citizens' personal information must take necessary technical, managerial, and physical measures to ensure safety throughout the entire process of personal information handling, including guaranteeing users' access rights and the collection and use of personal information, to prevent infringements.” He added, “The Personal Information Protection Commission will continuously inspect the personal information handling practices of virtual asset operators and promptly initiate investigations to minimize damage in case of personal information infringement incidents.”