On December 12, 2024, the Personal Information Protection Commission (PIPC) published its decision, as issued on the same date, in which it imposed a fine of KRW 6.198 billion (approx. $4.33 million) on Hyundai Marine & Fire Insurance for violations of the Personal Information Protection Act (PIPA).

Background to the decision

The PIPC highlighted that it initiated an investigation into Hyundai Marine & Fire Insurance for the unnecessary or excessive use of customer personal information in August 2023. The PIPC noted that in providing services to sell automotive insurance, Hyundai Marine & Fire Insurance collected user data including resident registration numbers and mobile phone numbers, among others.

Findings of the PIPC

Following its investigation, the PIPC found that Hyundai Marine & Fire Insurance used pop-up windows inducing users to change their consent settings. Notably, the PIPC found that although consent was validly obtained in the pop-up window, the notice failed to mention the processing of personal information, such that users were unaware that their personal information was being processed for marketing purposes.

The PIPC noted that there were 13,645 spam reports stemming from Hyundai Marine & Fire Insurance's use of customer personal data for marketing purposes.

In addition, the PIPC also found that Hyundai Marine & Fire Insurance failed to consult the data protection officer (DPO) before implementing the pop-up windows. The PIPC further detailed that Hyundai Marine & Fire Insurance failed to destroy user data even one year after users had stopped using the insurance service or entered into insurance contracts.

Accordingly, the PIPC found Hyundai Marine & Fire Insurance to have violated Articles 21, 31, and 39-3 of the PIPA.

Outcomes

In light of the above violations, the PIPC imposed a fine of KRW 6.198 billion (approx. $4.33 million) on Hyundai Marine & Fire Insurance.

You can read the press release and the decision, both only available in Korean, here.