China's First E-commerce Sanction... Alibaba Fined 2 Billion for Personal Data Law Violation

Personal Information Commission Holds Full Meeting on 24th and Resolves
Provides User Information to 180,000 Sales Locations in China
Fails to Implement Legal Measures for Overseas Transfer

China's e-commerce platform AliExpress (hereinafter Ali) is facing a fine of 1.978 billion KRW for violating domestic personal information protection measures. This is the first sanction against a Chinese e-commerce company, which has continuously raised concerns about personal information leaks while expanding its market share in Korea.

The Personal Information Protection Commission held a plenary meeting on the 24th and decided to impose a fine of 1.978 billion KRW, a penalty of 7.8 million KRW, corrective orders, and improvement recommendations on Ali for violating the Personal Information Protection Act.

It was found that Ali failed to implement necessary measures to protect personal information during the process of transferring Korean users' personal data overseas.

Ali, ranked second in the number of domestic e-commerce users, is an open market platform that allows sellers to sell products to users. When users purchase products, sellers deliver the products by receiving personal information such as addresses from users, and it has been confirmed that Chinese sellers who received Korean users' personal information number as many as 180,000.

Personal information provided overseas in this way is difficult to apply legal protection measures, so consent from the data subjects must be obtained, and safety measures to protect personal information, grievance handling for personal information infringement, and necessary measures for dispute resolution must be taken. However, Ali did not notify users of legally required information such as the country to which personal information is transferred, the corporate name and contact information of the recipient of the personal information. It also did not reflect necessary personal information protection measures in seller terms and conditions. Additionally, the membership withdrawal menu was designed to be difficult to find, and the account deletion page was displayed in English.

The Personal Information Protection Commission issued a corrective order requiring Ali to reflect measures to prevent misuse due to personal information transfer and simplify the membership withdrawal procedure to facilitate users' exercise of rights. It also recommended improvements such as minimizing the collection of personal information, disclosing the flow of personal information processing to users, and preparing specific plans for complaint resolution and damage relief related to personal information processing.

Ali reportedly took voluntary corrective actions during the investigation process, including obtaining user consent for overseas transfer in accordance with legal requirements.

Nam Seok, Director of the Investigation and Coordination Bureau of the Personal Information Protection Commission, stated, "This investigation and sanction clarify that even overseas e-commerce operators are subject to our laws when providing services to domestic users, and that personal information protection and management at the level of domestic operators are required."

The Personal Information Protection Commission also decided to further verify facts and supplement materials before deliberating and deciding on another Chinese e-commerce platform, Temu.

This content was produced with the assistance of AI translation services.