Privacy News This Week

Created with Microsoft Bing Image Creator powered by DALL-E

Privacy News This Week 

International:

        Recently, France's CNIL fined Tiktok 5 million euros for cookie consent violations. The issue arose from Tiktok's cookie consent methods making it complex to refuse cookies, which encouraged many to choose 'accept all' cookies instead of refusing them purely to avoid the hassle. Combined with inadequate information on the purpose of the cookies, this process was ruled to infringe the freedom of Internet users and thereby violated France's privacy laws. This fine comes closely after EU Commission officials warned Tiktok to comply with all EU privacy laws, especially since Tiktok is under two investigations by Irish data protection regulators on transfers of EU citizens' data to China and violations on children's privacy. 

Korea:

        Shilla Hotel Resorts suffered two consecutive data breaches after the New Year. The first breach on Jan 3rd involved the leak of email addresses, while the second breach on the 13th was due to an internal employee mismanagement of data that resulted in almost a hundred thousand customers' personal information being leaked. Although Shilla alerted affected customers as soon as they were alerted of the error, and promised to reform their membership service to prevent a recurrence of such mistakes, these data breaches demonstrate how data breaches are more often than not the result of human error rather than outside interference (such as hacking). In such cases, even with properly trained employees, it can be difficult to completely prevent data breaches, with the only real solutions being stricter privacy-by-design systems that reduce the impact of human error as well as quick responses to minimize the damage when breaches do occur. 

        Korea's Personal Information Protection Commission (PIPC) finalized the 'Personal Information Protection Investigation Promotion Direction in 2023' on Jan 11th, which outlines the PIPC's direction of investigative work regarding personal information protection in the upcoming year. The PIPC aims to create a "digital ecosystem" that the public can trust in, which will be created through preemptive and preventive inspections to protect and promote privacy rights. These pre-emptive and preventative inspections will be a step beyond current standards which mainly focus on investigating leaks and infringements that have already happened. 

        Additionally, the PIPC plans to focus on the issue of 'dark patterns' (design of deception) that are used to induce irrational decisions by users, as well as improving the protection of children's' personal information. These deceptive designs and privacy issues have come to light recently, with examples such as the video game Fortnite's $520M penalty settlement for deceptive game designs that collected information and enabled harmful communication for minors without proper informed consent or parental oversight while inducing unintended purchases. Overall, it seems that the PIPC intends to investigate and survey a wide variety of fields that may impact personal information rights. The Promotion Direction plan includes plans to survey major online services that have high usage (such as online shopping malls, reservations, communications), 'non-face-to-face platform services' (including hospitals, video lectures, and financial institutions), 'Super Apps' that have high monthly users or subscribers, 'Smart Devices' that process personal information (such as phones, smart home appliances, smart TVs), and 'Large Trustees and Solution Providers'.