Republic of Korea: Issued PIPC ruling in investigation into Aliexpress imposing a KRW 1.978 billion fine for non-compliance with Personal Information Protection Act

On 24 July 2024, the Personal Information Protection Commission of South Korea (PIPC) concluded its investigation into Alibaba Singapore E-Commerce Private Limited, operating as AliExpress, for violating the Personal Information Protection Act. The PIPC imposed a fine of KRW 1’977’800’000 and a penalty of KRW 7’800’000, alongside orders for corrective measures and recommendations for improvement. The investigation was opened following concerns over the privacy risks associated with the surge in overseas direct purchasing services and found that AliExpress had provided Korean users' personal information to approximately 180’000 overseas sellers without adequate consent or disclosure, in violation of national data protection laws. AliExpress failed to inform users about the destination country of their personal data and the identity and contact details of the recipients, and it did not incorporate necessary data protection measures in its seller terms. Additionally, the platform made it difficult for users to exercise their rights, such as account deletion.