Meta fined 20 billion won for illegally collecting sensitive information

Meta, which operates Facebook and Instagram, was fined around 20 billion won for using sensitive information, such as users' religion and sexual orientation, for customized advertisements without consent.

The Personal Information Protection Commission of Korea announced on Tuesday that it imposed a penalty surcharge of 21.613 billion won and a fine of 10.2 million won on Meta for violating obligations under the Personal Information Protection Act to restrict and take safety measures on the processing of sensitive information. Investigations revealed that Meta collected personal information, such as religious/political views and same-sex marriage status, of approximately 980,000 domestic users through their Facebook profiles. Such information was provided to advertisers, of which 4,000 advertisers used the information.

Meta created and operated advertising topics related to various types of sensitive information, such as religion, sexual orientation, and North Korean defectors, based on behavioral information, such as posts that were liked on Facebook and advertisement clicks. “They created a space in the Facebook profile for users to input religious and political views, etc. After creating about 90,000 similar ad categories (using user-entered information), they made targeted advertisements,” said Lee Eun-jeong, the first investigation division chief at the Personal Information Protection Commission.

The Personal Information Protection Act defines information on personal beliefs, political opinions, and sexual life as sensitive information that must be strictly protected and restricts the processing of such information. Such information can only be processed on legitimate grounds, such as obtaining consent from the data provider, which Meta violated.

Meta collected users' sensitive information and used it to provide customized services, but it did not make this clear in its data policy. It did not obtain user consent nor provide additional protection measures. It also declined users’ request to view personal information, claiming that it was not subject to the request for viewing as specified in the Personal Information Protection Act. The Commission imposed penalty surcharge and fines on Meta for violating legal regulations related to restrictions on processing sensitive information. A corrective order was issued to establish legal grounds and take measures to ensure safety while handling sensitive information and to respond to users' requests to view personal information.


이소정기자 sojee@donga.com