Once Delivery Ends, Personal Information Is Immediately Masked... Establishment of Self-Regulation for Delivery Platforms

Personal Information Commission and 13 Order Delivery Platforms
Adopt 'Self-Regulation Agreement for Order Delivery Platform Sector'

[Asia Economy Reporter Seungjin Lee] Privacy protection measures used for delivery orders will be strengthened.

The Personal Information Protection Commission held its 3rd plenary meeting on the 22nd and approved and finalized the "Public-Private Cooperation Self-Regulation Agreement on Personal Information Protection in the Order Delivery Platform Sector."

The "Public-Private Cooperation Self-Regulation Agreement in the Order Delivery Platform Sector" is the third outcome of the "Public-Private Cooperation Self-Regulation" system promoted by the Personal Information Protection Commission. Thirteen order delivery platform companies, the Korea Internet Corporations Association, and the Delivery Service Mutual Aid Association jointly prepared the agreement (draft).

Order delivery services involve sharing and transferring personal information among various systems: the order brokerage platform where users order food, the integrated order management system where restaurants manage orders, and the delivery agency platform that intermediates between restaurants and delivery workers. In this process, various stakeholders such as restaurant owners and employees, delivery workers, and local delivery offices handle users' personal information, resulting in a complex personal information processing flow.

However, the Personal Information Protection Act and related notifications did not anticipate cases where various stakeholders and systems process personal information as in the order delivery sector, leaving some ambiguities. The "Public-Private Cooperation Self-Regulation Agreement in the Order Delivery Platform Sector" addresses these vulnerabilities by having businesses themselves establish enhanced personal information protection measures for order delivery platform services, which are difficult to regulate under the existing legal framework.

The Personal Information Protection Commission expects that with the participation of companies such as Woowa Brothers, WeMade, and Coupang, which account for over 80% of the order delivery platform market, the personal information of tens of millions of platform users will be safely protected.

Key points of the self-regulation agreement include applying additional authentication methods such as mobile phone verification when restaurants, delivery workers, etc., access or use users' (orderers') personal information on the platform. Access control will be strengthened by automatically blocking connections after a period of inactivity.

Agreements on API integration among order brokerage platforms, integrated order management systems, and delivery agency platforms will be established so that users' personal information is immediately masked once food delivery is completed. Viewing or downloading by restaurants and delivery workers will also be restricted. The platform will also play a role in supporting personal information protection education for restaurants and delivery workers who handle personal information.

Meanwhile, the plenary meeting also discussed supplementary measures for some operational deficiencies identified since the Personal Information Protection Commission began promoting public-private cooperation self-regulation in May last year.

Additionally, the Personal Information Protection Commission imposed a fine of 10.8 million KRW on Meokkebi, a delivery app company that directly collected users' personal information. Six companies that collected and stored personal information on behalf of franchisees such as restaurants and delivery agencies received corrective orders.

Ko Hak-su, Chairman of the Personal Information Protection Commission, said, "This public-private cooperation self-regulation agreement, prepared reflecting the characteristics of online platforms in the order delivery sector, is expected to improve the level of personal information protection in the order delivery field," adding, "We plan to firmly provide incentives such as significant reductions in fines and penalties and certification marks to ensure the establishment of the self-regulation agreement in the future."