PIPC Imposes 800 Million KRW Fine on Samsung Electronics for Personal Data Leak

On the 28th, the Personal Information Protection Commission held its 11th plenary session and decided to impose a total fine of 886.12 million KRW and a penalty of 25.4 million KRW on two businesses, Samsung Electronics and TaoWorld, for violating personal information protection regulations and leaking users' personal information.

The Commission investigated Samsung Electronics following six reports of personal information leaks from January 2020 to May 2021. Among these, four cases were reviewed and resolved.

Specifically, when changing the DB product of the Samsung account system, a system error occurred due to failure to consider differences in data processing methods by product, resulting in the leakage of users' personal information. The Samsung Cloud service experienced cyberattacks between February and May 2020, leading to the leakage of images and videos from 76 accounts. Additionally, a development error in the Samsung.com online store system allowed users to view other people's delivery information, causing personal information leakage.

The Commission imposed a fine of 875.58 million KRW and a penalty of 14 million KRW on Samsung Electronics for inadequate fulfillment of safety obligations under the Personal Information Protection Act due to continuous personal information leaks. At the same time, it ordered corrective measures including a comprehensive review and improvement of the overall protection system and the establishment of company-wide recurrence prevention plans.

Meanwhile, TaoWorld was found negligent in introducing and operating intrusion prevention systems and conducting vulnerability checks, resulting in hackers stealing information of 13,470 users. It was also revealed that sensitive information, such as 'health-related information,' was collected and stored without specific guidance or separate consent. Consequently, a fine of 10.54 million KRW and a penalty of 11.4 million KRW were imposed.