South Korea's Personal Information Protection Commission on July 22 held its 14th plenary meeting and decided to impose total penalties of 10.56 billion won on two affiliates of TikTok and Apple for violating the Personal Information Protection Act and the former Act on Promotion of Information and Communications Network Utilization and Information Protection, also known as the Information and Communications Network Act. It also decided on corrective orders and public disclosure orders.

The businesses collected and used personal information and transferred it overseas without a legal basis.

According to the commission, TikTok distributes behavioural information collection tools, including TikTok Pixel, Events SDK and Events API, to other web and app operators while providing services such as advertising and content performance analysis. The tools collect activity records of users who visit third-party web and app pages where they are installed.

The commission said about 71,000 companies in South Korea use TikTok's behavioural information collection tools. It said TikTok collects third-party behavioural information from 9,450,000 domestic active users through the tools as of December last year.

TikTok collects users' third-party behavioural information and device identifiers together, links them to TikTok member accounts and analyses them. It then infers user characteristics and interests and uses them for targeted advertising. Even so, TikTok did not provide notice at sign-up in a way that users could clearly recognise it. It also obtained consent in a mandatory form together with other personal information needed to provide the service, effectively forcing data subjects who want to use TikTok to agree to the collection of third-party behavioural information for targeted ads and preventing them from exercising meaningful consent rights.

The commission also confirmed that TikTok transferred users' personal information to affiliates in the process of providing the TikTok Lite points cash withdrawal service, without disclosing or notifying legally required items such as the categories of personal information transferred, the purpose of use by the recipient, and the retention and use period.

The commission viewed this as the collection and use of third-party behavioural information without a legal basis and its transfer overseas, and imposed a penalty of 10.31 billion won along with corrective and public disclosure orders.

Apple was found to have collected voice recordings and transcripts when users used Siri, its voice assistant service, until August 2019. It used them for voice recognition functions and improving search results without obtaining separate consent from users.

Apple obtained separate consent from October 2019 to use voice recordings for service improvement, but it was confirmed to have continued using transcripts for service improvement without establishing a separate legal basis. It was also confirmed that Apple did not sufficiently state in its privacy policy the categories of personal information transferred, the purpose of use by the recipient, and the retention and use period, while transferring users' personal information overseas to affiliates such as Apple Inc in the United States.

During the investigation, Apple corrected the violations by giving data subjects a choice regarding the collection and use of transcripts, strengthening personal data protection measures such as filtering personal information in transcripts, and revising its privacy policy.

The commission imposed a penalty of 252,000,000 won on ADI, an Apple affiliate, for violating the former Information and Communications Network Act. It ordered another affiliate, ASPL, through a corrective action order that included checking the status of overseas transfers, to strengthen the level of personal data protection over violations including overseas transfers.

The commission said it will continue to inspect personal data processing practices by overseas businesses and respond strictly to violations without discrimination between domestic and overseas companies, to ensure South Koreans' personal information is protected safely and transparently even in complex cross-border environments.