On July 25, 2024, the Personal Information Protection Commission (PIPC) published its decision as issued on July 24, 2024, in which it imposed a penalty of KRW 1.97 billion (approx. $1.43 million) and a penalty surcharge of KRW 7.8 million (approx. $5,640) on Alibaba.com Singapore E-Commerce Private Limited (AliExpress) for violation of the Personal Information Protection Act (PIPA).

Background to the decision

In particular, the PIPC highlighted that AliExpress operates an 'open market' model that provides a platform and collects a certain percentage of product sales amount as a brokerage fee. Users' personal information is transferred to overseas sellers in the process of a transaction.

Findings of the PIPC

Following its investigation, the PIPC found that AliExpress transferred the personal information of approximately 180,000 South Korean data subjects to overseas Chinese sellers.

Notably, the PIPC outlined that AliExpress, in transferring data subjects' personal information, did not notify consumers of the country to which personal information is transferred. In addition, the PIPC determined that the account deletion is difficult and the display of information in English, made the exercise of user rights under the PIPA difficult.

Accordingly, the PIPC determined AliExpress to have violated Article 28(8) of the PIPA relating to the transfer of personal information overseas, Article 31(2), and 38 of the PIPA for the difficulty in exercising data subject rights.

Outcomes

In conclusion, the PIPC imposed a fine of KRW 1.97 billion (approx. $1.43 million) and a penalty surcharge of KRW 7.8 million (approx. $5,640) for the abovementioned violations. The PIPC also imposed corrective measures on AliExpres, including:

• disclosing the transfer of personal information processing as transparently and clearly as possible, and updating disclosures when processing operations change;
• making practical operational efforts to protect personal information; and
• minimizing personal information collected in accordance with the principle of data minimization under the PIPA.

You can read the press release and download the decision, both only available in Korean, here.