PIPC Imposes 854.1 Million KRW Fine on 'SamzzumSam' for Personal Data Violation

On the 28th, the Personal Information Protection Commission held a plenary meeting and announced that it decided to impose corrective orders such as 'prohibition of simple transmission and destruction and retention of resident registration numbers' on the operator of the SamzzumSam application (Javis & Villains), along with a fine of 854.1 million KRW and a penalty of 12 million KRW.

The Commission investigated SamzzumSam from May last year following public interest and civil complaints from organizations such as the Korea Consumer Federation, focusing on ▲the legal basis and process for handling resident registration numbers and ▲whether proper consent was obtained regarding the collection, use, and provision of personal information to third parties.

The investigation revealed that SamzzumSam used resident registration numbers collected from users to log in to Hometax, collect income-related information, obtain consent for tax agent engagement, and act on refund filing. During the investigation, procedures were improved, and currently, resident registration numbers are collected and used only during refund filing agency services and are stored and retained until the user withdraws membership. The Commission judged that SamzzumSam's acts of collecting and storing resident registration numbers without legal grounds violated Article 24-2 of the Personal Information Protection Act.

Furthermore, the Commission confirmed that SamzzumSam ▲obtained broad consent through processing policies during the collection of personal information such as income information but omitted collection items and provided unclear notices regarding collection purposes and retention periods, ▲collected information on users' (including dependents) disability status included in wage and salary statements without obtaining separate consent for sensitive health information, and ▲did not explicitly inform users about the provision of information to tax agents (third parties) when allowing tax agents to file on behalf of users in cases requiring additional review. Accordingly, fines and penalties were imposed under the Protection Act.

Nam Seok, Director of the Investigation and Adjustment Bureau, stated, “In the era of the data economy, the Personal Information Protection Commission will strictly sanction legal violations but will also encourage startups and others to plan and improve services from a personal information protection perspective when designing new services, thereby striving to create an environment where the public can safely use various services.”