Privacy & Information Security Law Blog

On September 1, 2021, the South Korean Personal Information Protection Commission (“PIPC”) issued fines against Netflix and Facebook for violations of the Korean Personal Information Protection Act (“PIPA”).

The PIPC issued a fine to Facebook of approximately $5.6 million USD relating to six alleged violations of PIPA, including (1) collecting facial recognition data without users’ consent; (2) collecting Social Security numbers in violation of the law; (3) failing to notify users when it changed the entity responsible for managing the personal data; (4) failing to disclose information about its transfer of personal data to third parties or overseas; and (5) not providing certain materials requested by the PIPC.  Sources indicate the PIPC also is requiring Facebook to destroy the facial recognition information and identity numbers and to disclose to users information about any transfer of personal data to third parties.

Netflix received a fine of $190,000 USD related to claims that Netflix (1) unlawfully collected personal data from prospective users without consent before the individuals completed the subscription process; (2) and transferred the personal data outside South Korea without providing appropriate notice to data subjects.