Meta Fined $15.6 Million in South Korea for Collecting Data Without Consent

Personal Information Protection Commission (PIPC) in South Korea has fined Meta $15.6 million for collecting and using sensitive data without obtaining consent from users. 

Meta has faced similar penalties in other countries, most recently from Ireland, as the Irish Data Protection Commission (DPC) fined Meta €91 million for storing hundreds of millions of users’ passwords in plain text. 

One of the largest fines issued to Meta, from the Irish Data Protection Authority (IE DPA), amounted to €1.2 billion, for breaking GDPR regulations.

The situation is different in South Korea, as authorities say that Meta collected information from people without their explicit consent. 

“The PIPC found that Meta has been collecting and using sensitive data without obtaining consent from users and launched investigations against the company,” reads PIPC’s press release. “Over the course of investigations, the PIPC got civil complaints saying the company rejected a request to access personal information without legitimate reasons and a report of its data breaches caused by hackers. The data protection supervisory authority also launched investigations into these cases as well.”

According to South Korean authorities, Meta also denied users access to personal data. 

Moreover, Meta didn’t do enough to protect users against data breaches. 

“Meta should have taken safeguards to delete or block the websites not in service but failed to remove pages for account recovery for them,” the authorities added. “Hackers took advantage of this loophole to request resetting passwords of others’ account by submitting fake IDs on the page for account recovery, leading Meta to approve the requests without sufficient authentication procedures to check whether ID was counterfeited.” 

Even with this fine issued, the PIPC promises to keep an eye on the company and check to see if the necessary changes are made so that all of these problems are resolved.