Personal Information Protection Commission

PIPC Sanctions AliExpress for Violating PIPA, Imposing Penalty Surcharge of 1.978 billion KRW 

- PIPC imposed corrective orders and recommendations as well on the e-commerce platform to ensure data protection equivalent to that of domestic business operators 

(This is an unofficial translation of a press release, originally prepared in Korean.) 

The Personal Information Protection Commission (“PIPC”) held the 13th plenary meeting and reached a resolution to impose a penalty surcharge of 1.978 billion KRW (USD 1.43 million) and an administrative fine of 7.8 million KRW (USD 5,631) against Alibaba.com Singapore ECommerce Private Limited (“AliExpress”) for violations of the Personal Information Protection Act (“PIPA”) with corrective orders and recommendations for improvement on Wednesday, July 24 2024. 

1. Background

As concerns over infringement of privacy were raised at the inspection of state administration organized by the National Assembly in October 2023 and media outlets have covered privacy risks posed to the people due to aggressively expanding overseas ecommerce platforms in the country, including AliExpress, the PIPC has been initiating its investigations of foreign business operators offering related services. 

2. Results

AliExpress is an ‘Online Marketplace’ to provide a platform to connect sellers and buyers globally. It receives commissions from sellers for each product they sell based on a certain rage of percentages depending on the product category. When a buyer places an order, this e-commerce marketplace transfers the buyer’s personal data to a seller located in the third country to ship the product. The number of Chinese buyers who received the personal data of Korean data subjects from AliExpress has amounted to over 180,000.  

Meanwhile, it is hard to maintain the same level of data protection and safeguards as required by the Personal Information Protection Act (PIPA) for the data transferred overseas. In this regard, the PIPA stipulates that personal data processors are required to gain explicit consent from the data subjects and put safeguards, redress mechanisms, and dispute resolution measures for privacy infringement in place in the contract between the entity and the recipient for cross-border data transfers. 

AliExpress, however, failed to inform its users of necessary notifications, including the country to which the personal information was transferred and the name and contact information of the recipient or corporation, and incorporate necessary safeguards for privacy into terms and conditions with buyers. It also undermined users’ exercise of rights by making it difficult to locate the menu to unregister from the membership and providing the page to delete account in English.  

3. Administrative Sanctions 

As a result of the investigation, the PIPC decided to levy a penalty surcharge and an administrative fine on the online marketplace for non-compliance with legal requirements regarding cross-border transfer of personal information under the PIPA. The supervisory authority also issued corrective orders on the e-commerce platform to incorporate necessary measures into contract provisions and other documents to prevent possible misuse and abuse by the recipients of cross-border transfers of personal data and take measures to streamline the procedures for membership withdrawal to allow its users to exercise their rights with ease.

Violations & Sanctions:

● Legal requirements for cross-border data transfers (Article 28-8 (1)) -> Penalty surcharge of 1.978 billion KRW

● Safeguards for cross-border data transfers (Article 28-8 (4)) -> Administrative fine of 7.8 million KRW

● Disclosing the information on a domestic agent (Article 31-2 (1)) -> Corrective orders

● Exercising the data subjects’ rights (Article 38 (4)) -> Recommendations for improvement 

During the investigation, AliExpress voluntarily took measures to redress non-compliance, including obtaining informed consent from users on cross-border data transfers as a legal basis, improving the procedures to designate a domestic agent for handling personal information, and updating its privacy policy to meet the legal requirements stipulated in the PIPA. 

In order to advance privacy protection of Korean data subjects, the PIPC also issued recommendations for improvement as follows: 

● Informing Korean users of the procedures for processing personal data with transparency and readability and updating any changes promptly;

● Endeavoring to operate the scheme to designate a domestic agent to promote privacy and implementing redress mechanisms associated with personal data processing; and

● Minimizing personal data collected to align with the PIPA, joining public-private coregulation run by domestic e-commerce entities, or offering an equivalent level of data protection. 

The PIPC is set to continuously keep an eye on the implementation of corrective action by AliExpress to protect the personal data of the people. 

The sanction holds significance that foreign e-commerce operators are also subject to the legal requirements of the PIPA when they provide goods or services to Korean data subjects, and they are required to exert efforts to ensure data protection and management equivalent to that of domestic businesses. The PIPC hopes this disposition can provide an opportunity for overseas business operators to make every effort to be in full compliance with the legal requirements prescribed in the PIPA for cross-border data transfers of Korean data subjects to the third country in particular, and take sufficient safeguards with overseas sellers for the data transferred, contributing to upholding the data subjects’ rights to selfdetermination. As for Temu, another Chinese online marketplace subject to investigation, the PIPC will deliberate on and reach a resolution after reviewing and requesting additional documents. 

* A PDF file, for better readability, is attached