Republic of Korea: Issued ruling in PIPC investigation of 5 businesses regarding violations of the Privacy Act

On 14 June 2023, the Personal Information Protection Commission (PIPC) fined Dreamers Ltd., Gosia Academy, Musinsa Co., Bilbax.com Inc., and Linical Korea Ltd. for violations of the Personal Information Protection Act. The collective fines and penalties amount to KRW 462.35 million. An error in system operations caused false logins for Dreamus Company Ltd.'s users. For a limited time, users accessed accounts differing from their own and therefore had illegal access to other users' personal information. The company also failed to inform users of the breach for more than 24 hours. These violations incurred a fine of KRW 378.95 million. Gosia Academy incurred a fine of KRW 47.2 million for failing to introduce any authentication methods for administrators, causing any member's information to become publicly available. It also failed to inform its customers. While Musinsa Co. Ltd. updated its system, it allowed for delivery addresses of members to be displayed to other non-members when changing the address. It also failed to inform its members. As a result, a fine of KRW of 10.8 million was imposed. Bilbax.com Inc. failed to impose administrator access restrictions on one of its real estate platforms Nuri Jip. Hackers accessed the personal information of many users, who were also not notified. Finally, Linical Korea Ltd. shared its user's information with a third party for storage purposes without entering into a contract or informing its customers.