Republic of Korea: Personal Information Protection Commission announced investigation into Shinhan Card over alleged unlawful sharing of merchant personal data

On 24 December 2025, the Personal Information Protection Commission (PIPC) announced an investigation into Shinhan Card following a public interest whistleblower report. The report alleged that Shinhan Card unlawfully shared merchant personal data, including merchant names, owner names, and mobile numbers from newly installed terminal information, with card recruiters between March 2022 and May 2025. The investigation aims to assess the cause, scope, and types of data leaked, and to determine Shinhan Card's compliance with the Personal Information Protection Act, with potential enforcement measures if violations are determined.