The Personal Information Protection Commission Fines Kakao Mobility for "Insufficient Third-Party Provision Notice"

Failure to Clearly Inform Personal Information Usage
Optional Consent Items Structured as Mandatory Consent Items

Additional consent procedure related to Kakao Mobility autonomous taxi call service.

[Asia Economy Reporter Seungjin Lee] Kakao Mobility was fined for failing to clearly inform users of the purpose of using their personal information.

The Personal Information Protection Commission held its 2nd plenary session on the 8th and decided to impose a fine of 6 million KRW on Kakao Mobility for violating personal information protection regulations, along with corrective orders and improvement recommendations.

Kakao Mobility did not clearly inform the "purpose of use by the recipient of personal information" during the process of obtaining additional consent for third-party provision for its autonomous taxi calling service. Furthermore, it structured optional consent items as mandatory and refused to provide the existing taxi calling service if users did not agree.

Specifically, regarding Kakao Mobility's violations, during the process of obtaining third-party provision consent for the autonomous taxi calling service, the consent notification window for third-party provision appeared when selecting the existing taxi calling service. At the same time, the purpose of personal information use was stated as "user identification within the service, boarding management, and overall operation."

The Personal Information Protection Commission explained that from the user's perspective, this could easily be mistaken as consent necessary for using the existing taxi calling service. If consent is obtained with this notification phrase, users' personal information for the existing taxi calling service could be provided to third parties without legal issues. This violates Article 17, Paragraph 2 of the Personal Information Protection Act, which requires clearly informing and obtaining consent for the "purpose of use by the recipient of personal information."

Additionally, Kakao Mobility refused to provide the existing taxi calling service if existing users did not give additional consent for third-party provision or chose "Do it later." This violates Article 22, Paragraph 5 of the Personal Information Protection Act, which stipulates that service provision should not be refused simply because users do not consent to optional items.

Moreover, requesting third-party provision consent from users before launching the autonomous taxi calling service was also problematic.

Yang Cheong-sam, Director of the Investigation and Coordination Bureau at the Personal Information Protection Commission, stated, "When personal information processors obtain consent for collecting, using, or providing personal information for introducing new services or improving existing services, they need to clearly and easily inform data subjects of the purpose of use and carefully design the consent screen."