The Personal Information Protection Commission has imposed a total of approximately 10.5 billion won in penalties on TikTok and Apple for collecting users' personal information without legal grounds and transferring it overseas.

The commission also made decisions on correction orders and disclosure orders, clarifying its policy to strengthen the protection of domestic users' right to self-determination of personal information.

▲ TikTok Collects Third-Party Behavioral Data for Personalized Advertising

On the 23rd, the Personal Information Protection Commission explained that TikTok collected third-party behavioral information such as clicks, purchases, searches, and content viewing from users through pixel, SDK, and API tools distributed to other web and app operators.

Approximately 71,000 domestic companies used these tools, and TikTok was confirmed to have collected information from 9.45 million domestic active users.

TikTok linked this collected information to accounts, inferred user characteristics and interests, and used them for personalized advertising.

However, the commission determined that TikTok did not clearly disclose this during the registration process and bundled it with other necessary personal information for service use, treating it as mandatory consent and failing to provide genuine choice.

Personal Information Protection Commission Imposes Total 10.5 Billion Won in Penalties on Apple and TikTok(Photo : [Provided by Yonhapnews])

▲ Overseas Transfer Procedure Also Failed to Meet Statutory Standards

TikTok Lite failed to properly notify transfer items, recipients, purposes of use, and retention and use periods when transferring personal information to affiliated companies in the process of providing point cash withdrawal services.

The commission viewed this as a violation of Articles 15 and 28-8 of the Personal Information Protection Act and imposed a penalty of 10.306 billion won along with correction and disclosure orders.

This decision clarified that even transfers within affiliated companies must comply with overseas transfer regulations if they are processed overseas and domestic legal protection is not sufficiently guaranteed.

The commission viewed transfers to areas where protection levels weaken as overseas transfers, not merely physical movement.

▲ Apple Insufficient Consent in Process of Utilizing Siri Voice and Transcripts

Apple collected voice recordings and transcripts of Siri users until August 2019 and used them to improve voice recognition functions and search results without obtaining separate consent.

After that, while consent was obtained for voice recordings, it was confirmed that transcripts continued to be used without separate legal grounds.

Additionally, the commission investigated that Apple transferred users' personal information to affiliated companies such as Apple Inc. in the United States but did not sufficiently specify transfer items, purposes of use, and retention and use periods in its personal information processing policy.

The commission imposed a penalty of 252 million won on Apple affiliate ADI and issued correction measures to ASPL, including inspection of overseas transfer status.

The commission evaluated this action as significant in clarifying that overseas operators must faithfully fulfill their obligations to ensure transparency and guarantee the right to self-determination in the process of handling personal information of domestic users.