Personal Information Committee Fines TikTok and Apple $10.5 Billion for Unauthorized Data Collection

The Personal Information Protection Commission has fined TikTok and Apple a total of 10.558 billion Korean won. The two companies are accused of collecting domestic users' personal information and transferring it overseas without following proper legal procedures. This measure aims to rectify the practices of foreign companies that illegally collect data in violation of Korean law and protect the rights of domestic users.

TikTok was found to have embedded advertising tracking codes on the websites and apps of over 71,000 domestic businesses, collecting specific activity information such as users' click and purchase history. As a result, as of December last year, data from approximately 9.45 million active users in Korea was confirmed to have been collected without authorization. TikTok linked mobile device unique identifiers and its own cookie information with user accounts, then inferred users' interests and tendencies to utilize them for personalized advertising. In this process, it infringed upon users' freedom of choice by including the collection of information for personalized advertising in the consent items for essential service use, thereby forcing consent.

Until August 2019, Apple collected voice recordings of Siri users and their transcribed text data without consent, using them for service improvement. Furthermore, when transferring domestic users' personal information to overseas affiliates, including its U.S. headquarters, Apple did not clearly specify the types of information being transferred and their retention periods in its privacy policy. The Personal Information Protection Commission decided to impose a fine on ADI, an affiliate related to Apple's Korean corporation, and issued a corrective order to another affiliate, ASPL, to inspect the overseas transfer status and enhance protection levels.