Personal Information Protection Commission Fines Korbit for Violating 'Minimum Collection Principle' of Personal Data

[Asia Economy Reporter Eunmo Koo] On the morning of the 14th, the Personal Information Protection Commission held the 12th plenary meeting at the Government Seoul Office and announced that it had decided to impose a fine of 4.8 million KRW and issue a corrective order to the virtual asset operator Korbit for violating the “minimum collection principle” of personal information.

The Commission began an investigation in May last year following a user infringement report. The investigation revealed that Korbit initially allowed membership registration with only email verification, but when users whose accounts had been dormant requested reactivation, Korbit demanded “a photo of the ID card and a photo holding the ID card,” and refused to provide the dormant account reactivation service if these were not submitted.

In response, Korbit argued that since trading is possible immediately after reactivating a dormant account, enhanced procedures requiring collection of ID photo information were necessary to prevent financial crimes such as voice phishing.

Upon verifying Korbit’s claim, it was confirmed that even after reactivating a dormant account, users are additionally required to verify their mobile phone number for trading and deposits/withdrawals, indicating that ID photo information is not necessarily required for dormant account reactivation.

The Commission judged that Korbit’s act of requesting ID photo information and refusing dormant account reactivation if not provided, despite only allowing “login and inquiry services” after reactivation, violated the “minimum collection principle” under the Personal Information Protection Act. According to the Act, when processing personal information, the minimum amount of personal information necessary should be collected within an appropriate scope proportional to the processing purpose.

Further checks confirmed that the three major domestic virtual asset operators?Upbit, Bithumb, and Coinone?do not require ID photo information when reactivating dormant accounts.

Song Sang-hoon, Director of the Investigation and Coordination Bureau at the Personal Information Protection Commission, stated, “Going forward, the Commission will continue strict law enforcement to ensure the minimum collection principle of personal information is well observed, and will also strive to raise awareness among operators.”