PIPC on Japan's 'Line Yahoo' Hacking Investigation Cooperation Request: "Unusual... No Response Yet"

Regarding the Line Yahoo personal information leak incident, Ko Hak-su, Chairman of the Personal Information Protection Commission of Korea, described as "unusual" the email inquiry from the Japanese Personal Information Protection Commission asking the Korean government about the possibility of cooperating in an investigation of Naver.

At a press briefing held on the 14th, Chairman Ko said, "A staff member from the Japanese Personal Information Protection Commission casually sent an email to our staff, and considering the nature of the matter, I thought it was unusual," adding, "Since this issue is a matter of national interest, I judged that it is necessary to consult and coordinate with other ministries."

He continued, "The inquiry email contained two questions: whether the Korean Personal Information Protection Commission has ever investigated Naver Cloud, and how we would respond if the Japanese commission requested cooperation for a reinvestigation," and said, "We have not responded to these questions yet, and we will coordinate with other ministries and monitor the situation to decide how to respond."

Chairman Ko also stated, "If an official letter had been sent requesting cooperation, we could have reviewed it in detail, but since it was a casual email, we are keeping various possibilities open, such as not responding, responding vaguely, or responding in detail," adding, "Although we are not in continuous communication with Naver, there was one communication to grasp the outline after receiving the email from Japan."

Earlier last month, the Japanese Personal Information Protection Commission staff sent an email to the Korean commission asking whether it would be possible to cooperate in an investigation of the Naver Cloud system, which manages the Line Yahoo servers. The Japanese government, regarding the leak of about 510,000 personal information records from Line in November last year, criticized Line Yahoo's excessive dependence on Naver, conducted two administrative guidance sessions, and demanded improvements in the management system, including a review of the capital relationship with Naver. Naver and SoftBank each invested 50% in A Holdings, which holds about 65% of Line Yahoo's shares.

Additionally, the Personal Information Protection Commission announced its intention to soon release findings on violations of personal information laws by Chinese online shopping sites such as AliExpress, Temu, and Shein, which are currently under investigation.

The commission began an investigation in February to determine whether these direct purchase companies manage personal information safely. They are checking the adequacy of personal information processing policies, overseas transfer, and safety measures under the Personal Information Protection Act, and plan to take action according to relevant laws if violations are found. Chairman Ko said, "The investigations into Ali and Temu are expected to be concluded around next month."

Meanwhile, it has been identified that fines exceeding 120 billion KRW have been imposed on companies and institutions that violated the Personal Information Protection Act during the two years since the current government took office.

According to the "Personal Information Policy Achievements on the 2nd Anniversary of the Yoon Government" announced by the commission that day, from May 2022 to April this year, fines and penalties imposed on private companies and public institutions that violated the Personal Information Protection Act, such as illegal collection of user information or negligence in protection measures, amounted to 126.3 billion KRW and 1.8 billion KRW respectively. During the same period, 225 corrective orders and 22 corrective recommendations were issued.

In particular, in September 2022, a record fine of 100 billion KRW was imposed on Google and Meta for collecting personal information without user consent and using it for online personalized advertising.