Personal Information Protection Commission Imposes 360 Million KRW Fine on W Concept

[Asia Economy Reporter Lee Seung-jin] On the 14th, the Personal Information Protection Commission decided at the 20th plenary meeting to impose a total fine of 360.84 million KRW and a penalty of 13.2 million KRW on three businesses that violated personal information protection regulations, along with corrective orders.

The Commission initiated an investigation following reports of personal information leaks and confirmed violations such as negligence in safety measures and delayed reporting of personal information leaks.

Gmarket, while responding to user complaints via email at Auction’s customer center, mistakenly replied with another person's complaint content, resulting in the leakage of one individual's personal information.

TRN, while handling responses to user inquiries at its customer center, publicly posted answers containing users' personal information, causing a leak.

Both Gmarket and TRN were found to have violated the protection law by notifying or reporting the leaks more than 24 hours after becoming aware of the incidents. Accordingly, Gmarket was fined 3.6 million KRW and TRN was fined 3 million KRW in penalties.

W Concept Korea, operating an online shopping mall, sent KakaoTalk notifications to recipients who received gifts via the ‘Gift’ function, but mistakenly sent the gift box link incorrectly, resulting in the leakage of 2,583 personal information records. Additionally, the notification and reporting of the leak were delayed beyond 24 hours after discovery.

The Commission judged that W Concept Korea violated obligations regarding safety measures and leak notification/reporting. Consequently, it imposed a corrective order along with a fine of 360.84 million KRW and a penalty of 6.6 million KRW.

Kim Hae-sook, head of the Investigation Team 3 at the Personal Information Protection Commission, stated, “Recently, cases of personal information leaks due to mistakes by customer center staff have frequently occurred while outsourcing customer complaint consultations to external companies. Businesses need to take proactive measures, including educating outsourced companies on precautions for personal information protection during work processing and procedures for leak notification and reporting.”