TikTok has been fined 10.3 billion won (RM 29 million) by South Korea’s Personal Information Protection Commission (PIPC) for collecting user activity data through a tool distributed to third-party websites and apps. The same data was used to serve personalized ads without proper notification to 9.45 million TikTok users in South Korea.
The fine is owed to Singapore-based TikTok Pte. Ltd because it operates TikTok’s services in South Korea. TikTok distributes free user activity data collection tools, such as the TikTok Pixel and Events SDK, to help advertisers measure the effectiveness of their ad campaigns.
Activity data refers to records that can reveal a user’s interests or preferences based on activities on a website or app, such as purchases, adding items to shopping carts, searches, content views and downloads. About 71,000 companies in Korea use TikTok’s activity data collection tools.
In addition to TikTok, two Apple subsidiaries – Apple Distribution International and Apple Services – were also found to have failed to follow proper procedures when processing personal information. They collected transcripts generated from Siri users’ voice recordings and used them to improve the voice assistant’s speech recognition without obtaining separate user consent.
Apple was also reported to have failed to adequately disclose in its privacy policy the types of personal information transferred to its affiliates in the United States. Apple worked with the PIPC and introduced a separate consent process for the use of voice recordings and strengthened protections by filtering out personal information contained in the recordings during the investigation process.
The company also revised its privacy policy and corrected the violations. The PIPC imposed an administrative fine of 252 million won (~RM 704,000) and ordered Apple to improve its management of overseas data transfers.
