Google and Meta fined record $72.2M in Korea for violating privacy laws opt-in consent

What happened? 

On Sep 14, Korea’s Personal Information Protection Commission (PIPC) found Meta and Google in violation of privacy law regarding consent and collection of users’ behavioural data online, and fined them a record $72.2M. 

What was the issue? 

The PIPC concluded that Meta and Google were presuming consent by enabling data collection as the default option for new users, and made relevant privacy settings difficult to understand or change. 

What impact will this have? 

In Korea, this is a sign that the PIPC will strongly enforce privacy rights compliance regarding the collection of personal information for targetted advertising, and will likely cause other online platforms such as Kakao and Naver to improve the privacy settings of users. 

In Canada, existing laws and ‘guiding opinions’ released by the Office of the Privacy Commissioner (OPC) indicate that such practices by Meta and Google in Korea would also be considered as non-compliant with Canadian privacy law. Given recent trends, such as the OPC’s conclusion this June that targeted advertising may not be an appropriate purpose for a business to justify collecting data unless valid consent was obtained, it is likely that obtaining meaningful consent with easy ways to understand and change such privacy settings will become more crucial for online platforms. 

In more detail: 

On Sep 14, Korea’s Personal Information Protection Commission (PIPC) found that when creating personalized ads, Meta and Google were collecting users’ behavioral data (such as website visits, usage, purchases, and searches) without obtaining prior consent or properly informing users of the collection of the data. They were found to have presumed consent by enabling such data collection as the default settings, and further made the relevant privacy settings difficult to understand for new users. Such methods are prohibited in other regions such as the GDPR in the EU. Over 82% of Google users and 98% of Meta users in Korea were discovered to have enabled (by default) their data collection, which the PIPC viewed as a significant danger to the users’ right to privacy and control of their own data. Consequently, PIPC fined Google $50M and Meta $22.2M for violating Korean privacy protection laws(s39.3.1 of Korea’s Personal Information Protection Act), a record high fine. Google and Meta both expressed their opinion that they had followed all relevant privacy laws. 

What does this mean? 

In Korea, the PIPC seems intent on strengthening enforcement of privacy laws regarding personalized ads, with the PIPC stating that they intend to also investigate other big online platforms such as Naver and Kakao for compliance.

In Canada, PIPEDA currently does not specifically have laws regarding targeted advertising and the personal information collected by companies for that purpose. However, the OPC (Office of the Privacy Commissioner) has stated that it will generally consider information collected for the purpose of targeted advertising to be ‘personal information’, which falls under PIPEDA protection. Regarding opt-out consent, which was the main issue behind PIPC’s fining of Google and Meta in Korea, Canada permits them only when certain conditions are fulfilled, including that the purpose of collection (of personal data) is made clear and understandable to users, with the ability to opt-out needing to be easy to do and immediate in effect. Overall, “meaningful consent” is required for online behavioural advertising, and opt-out (implied) consent is only permitted when safety parameters are in place. For more details, see the OPC’s Policy position on online behavioural adverting, published in 2015 and revised in Aug 13 2021.  

OPC and its provincial counterparts also jointly investigated and concluded that targeted advertising may NOT be an appropriate purpose to justify the collection and use of sensitive location data in June 1 2022, and that valid consent must be obtained. 

Additionally, Bill C-27 that is still being developed, promises to improve privacy protection regarding current changes and trends in online collection and processing of personal information. 

Written by Simplawfy