Personal Information Protection Commission, sanctions on 3 companies including Hanwha Hotel & Resort and Hyundai Motor.

Goh Hak-soo, chairman of the Personal Information Protection Commission, is banging the gavel at the 14th meeting of the Personal Information Protection Commission in 2024 held at the Government Seoul Complex on the 28th. Personal Information Protect,
,
, ‘Hanwha Hotel & Resort, Thinksflow, and Hyundai Motor, which violated the Personal Information Protection Act, were sanctioned by the Personal Information Protection Commission.’,
,
, ‘On the 28th, the Personal Information Protection Commission held its 14th full meeting and decided to impose a total of 215.92 million won in fines and 15.6 million won in penalties on the three businesses.’,
,
, ‘They violated the obligation of safety measures, consent obligation, and obligation to report and notify personal information leaks under the Personal Information Protection Act while providing online services.’,
,
, ‘Hanwha Hotel & Resort changed its online reservation process for an event where online members could make accommodation reservations using coupons. During this process, due to system development issues and lax pre-testing, an error occurred where up to 1,818 pieces of information of people other than the reservation holders were accessed.’,
,
, ‘The Personal Information Protection Commission determined that the change in the login process did not properly verify the possibility of accessing other people’s personal information, resulting in a violation of the obligation of safety measures. As a result, a fine of 185.31 million won and a penalty of 3 million won were imposed.’,
,
, ‘Thinksflow’s subsidiary, Bitweeners, operates the social media platform “Bitwin” targeting couples. This company collected personal information of 38,633 children under the age of 14 without the consent of legal guardians. The company failed to retain records of personal information handlers accessing the personal information processing system and did not respond within the stipulated time to requests to view the personal information.’,
,
, ‘The Personal Information Protection Commission imposed a fine of 27.32 million won and a penalty of 3.6 million won on Thinksflow, stating that the indiscriminate collection of personal information of children under 14 years of age constituted a serious violation and decided to disclose the enforcement results on the Personal Information Protection Commission’s website.’,
,
, ‘Hyundai Motor refused to provide new car test drive event services to users who did not agree to the collection and use of personal information for marketing and promotional purposes. The company did not immediately apply security patches to the commercial software used in the customer support app (MyHyundai), resulting in the exposure of other people’s personal information and delaying reports and notifications. The Personal Information Protection Commission imposed a fine of 3.29 million won and a penalty of 9 million won, deciding to disclose the enforcement results on its website.’,
,
, ‘An official from the Personal Information Protection Commission stated, “All businesses that collect and process personal information must periodically check and improve the operating environment and vulnerabilities of personal information processing systems through websites or other means.” They also emphasized that when collecting personal information of children under 14 years old, legal guardians’ consent must be obtained, and refusing to provide goods and services for not agreeing to the collection and use of personal information for marketing and promotional purposes is unacceptable.’
,
,