PIPC: "Improvement Needed in Protecting Personal Information of Online Food Delivery Orderers"

[Asia Economy Reporter Seungjin Lee] It has been found that various stakeholders are involved in the process of handling personal information of orderers who order food and request delivery through mobile applications, indicating the need for some improvements.

The Personal Information Protection Commission (PIPC) announced on the 19th at the 17th plenary meeting that it reported the results of an analysis on how personal information is processed during the online food ordering and delivery process.

According to the PIPC's status analysis, when ordering food through mobile apps, not only the order brokerage platform but also platform operators such as the order integrated management system and delivery agency platforms, as well as restaurants and delivery personnel, can access the orderer's personal information.

The orderer's information checked by platforms, restaurants, and delivery personnel includes personal information such as delivery address and phone number, as well as order details like food ordered, price, payment information, and special requests from the orderer.

Due to the nature of the food delivery service, processing is completed in a short time, and personal information is collected, used, and managed mainly for essential information required for order reception and delivery. However, since various stakeholders participate in the personal information processing process, some areas for improvement have been identified as follows.

The PIPC explained that the identified areas for improvement include ▲ambiguity in the responsibilities and roles of personal information protection among participants, ▲access control and insecure data linkage, and ▲lack of awareness regarding personal information protection.

Among the analyzed companies, some exemplary cases were found where efforts to protect personal information are made, such as changing the phone number delivered to delivery personnel to a safe number, providing detailed delivery addresses only after delivery is confirmed, and masking phone numbers or delivery addresses after delivery completion to prevent detailed information from being viewed.

Earlier, in May, the PIPC selected seven major online platform sectors closely related to citizens' daily lives, analyzed the status of personal information processing by sector, and prepared a public-private cooperative self-regulation plan to strengthen personal information protection measures.

Among the seven sectors, the food delivery sector has rapidly grown since COVID-19. Following the approval of self-regulation rules through analysis of open markets held in July, the food delivery platform sector plans to promote public-private cooperative self-regulation based on the analysis results.

Yang Cheong-sam, Director of the Investigation and Coordination Bureau at the PIPC, said, “The PIPC is actively promoting a self-regulation system through public-private cooperation to strengthen personal information protection on online platforms closely related to citizens' lives. Based on the analysis results of the food delivery sector, we plan to form a working-level consultative body with the related industry to prepare self-regulation rules reflecting the characteristics of food delivery by the end of the year. We ask for the industry's active interest and participation.”