Personal Information Protection Commission

(unofficial translation)

Press release

Published on March 9

This is an unofficial translation of a press release, originally prepared in Korea.

On Wednesday, February 8, 2023, the Personal Information Protection Commission (“PIPC”) held its second plenary meeting of 2023 and sanctioned Meta for violating the Personal Information Protection Act (“PIPA”). 

The PIPC found that behavioral information that Meta collected through its business tools from non-Meta websites/apps (“third-party behavioral information”) exceeds the legitimate personal information necessary for Meta to provide Facebook and Instagram services. 

The PIPC also found that Meta violated the PIPA by refusing to provide services to customers who did not agree to Meta’s collection of third-party behavioral information.

To remedy this violation, the PIPC issued a corrective order against Meta and levied an administrative fine of KRW 6.6 million. With the corrective order, Meta would be required to modify its illegitimate business practices. The PIPC also made public on its website the specifics regarding Meta’s violation of the PIPA. 

In September 2022, the PIPC sanctioned Meta for collecting and using users’ third-party behavioral information without their due consent. The PIPC continued its investigation focusing on whether the third-party behavioral information, such as users’ internet activities showing the users’ access and usage history for various websites and apps operated by third-party businesses, constituted part of the minimum personal information necessary for Meta to provide its services.

The PIPC reasoned that the primary use of Facebook and Instagram by individuals is for socializing and communicating with their friends, not for viewing targeted advertisements. The PIPC, then, concluded that it cannot legally be justified for Meta to make it necessary for users to agree to the collection of a vast amount of behavioral information from third-party sources for the purpose of providing targeted advertisements. 

Some of the findings from the investigation are as follows:

Meta already collects a wide range of personal information of its users on Facebook and Instagram, without regard to the collection of third-party behavioral information for targeted advertising purposes.

There are other online social media services that provide targeted advertisements without linking their user’s accounts to their activity logs to other websites/apps.

It is actually feasible to use Meta’s social media services without any difficulties, even after one refuses to provide third-party behavioral information.

Meta collects third-party behavioral information on a real-name basis in a manner that is hard for users to understand, a data collection practice that is difficult for users to foresee and that could severely infringe upon users’ privacy and freedom.

As a result, the PIPC concluded that users’ third-party behavioral information is not the minimum personal information necessary, as defined in Article 39-3(3) of the PIPA, for Meta to provide its services. The PIPC thus ordered Meta to remedy this statutory infringement, by issuing a corrective order.

The PIPC clarified that this decision does not imply that targeted advertisements or the collection of behavioral information is prohibited in their entirety. The PIPC’s intention is to enable the users of Meta’s services to sign up for and use its services, even if they refuse to agree to the collection of third-party behavioral information, as this information is not the minimum necessary for Meta to provide its services.

Haksoo Ko, the chairperson of the PIPC, highlighted “The PIPC’s decision will serve as an opportunity for Meta to review and modify its business model in compliance with Korea’s data privacy law. And we hope the right of the data subject to self-determination will be respected accordingly.”

 Contact Information

 Jeongeun Lee 

 Director of Investigation Division 1

 +82-2-2100-3111, unionway@korea.kr