[IT Cafe] Why Is the Personal Information Protection Commission Targeting "Namuwiki"?

Silent for Years Despite Data Requests
Difficult Withdrawal Process and Privacy Law Violations Detected
Reported to Police for Investigation... International Cooperation Possible

The Personal Information Protection Commission has set its sights on the reclusive company "Namuwiki," which has been operating in Korea for six years while consistently ignoring the Korean government's requests for data submission. The company has intentionally made it difficult for members to withdraw their accounts and has published its privacy policy in Spanish, causing significant inconvenience to many users. Despite this, it has consistently refused to comply with corrective measures.

Unable to tolerate the situation any longer, the Personal Information Protection Commission filed a complaint last month with law enforcement authorities against Umanle (umanle S.R.L.), which operates the Namuwiki site in Korea, as a penalty for refusing to submit the required data. This is the first time the Commission has filed a complaint against a company based on this particular legal provision, underscoring the seriousness with which it views this matter.

According to the Commission on January 13, Namuwiki has received numerous complaints because its operators have either refused requests for account deletion (membership withdrawal) or failed to provide a function for members to delete their accounts.

Namuwiki has provided responses to members wishing to withdraw such as, "It is not possible to withdraw an existing ID," "It is technically impossible," and "Withdrawal after registration is not possible"-statements that are difficult to understand from a common-sense perspective. Furthermore, while the privacy policy was published in Spanish, it did not contain proper information, revealing multiple issues.

Since 2020, the Personal Information Protection Commission has requested Umanle to submit related documents, including those concerning membership withdrawal and privacy policy. However, Umanle has repeatedly refused, citing reasons such as not being obligated to comply with Korean law. The company responded by requesting that any official documents be issued by judicial authorities or organizations "in the region where the company is located" or that requests for data submission be made through "judicial authorities with jurisdiction over the company." While the company is reportedly based in Asunci?n, the capital of Paraguay, this has not been definitively confirmed.

The Namuwiki website, which creates and publishes information relevant to Korea, collects personal information such as users' names, email addresses, and mobile phone numbers during the registration process. Most of the service is provided in Korean, and the majority of users are Korean. As a general rule, if a foreign business operator provides goods or services to Korean data subjects, that operator is required to comply with Korea's Personal Information Protection Act.

Accordingly, the Personal Information Protection Commission requested data submission four times the year before last and twice last year, but Umanle either refused or did not respond. As a result, in June of last year, a prior notice of disposition for violation of the protection law was sent, but there was again no response, leading to the filing of a complaint with the National Police Agency in December of last year.

At the plenary session in November of last year, where the decision to file a complaint was made, members of the Personal Information Protection Commission strongly criticized Umanle for disregarding Korean law and expressed their determination to pursue punishment. Vice Chairman Lee Jeongryeol stated, "We have requested data submission at least nine times, and the lack of response or evasion means the Commission must hold the company strictly accountable." Commissioner Yoon Youngmi argued, "If Namuwiki is earning advertising revenue through Google, we should take active measures, such as seizing the advertising payments made by Google to Namuwiki." Commissioner Kim Jinhwan also raised his voice, stating, "This seems to be a very problematic business operator."

With the complaint having been filed with the National Police Agency in December of last year, the Personal Information Protection Commission has announced its intention to fully cooperate once a formal investigation begins. The Commission is also aware that Namuwiki established a joint venture, "Namuwiki Biz Korea," with Electronic Times in 2019, and is prepared to contact Electronic Times and, if necessary, pursue international investigative cooperation to take active measures.