Reservation Information Leak of 1,818 Cases: Hanwha Hotels & Resorts Fined 200 Million KRW... Thingsflow and Hyundai Also Sanctioned

Hanwha Hotels & Resorts has been fined approximately 200 million KRW in penalties and fines for violating obligations related to safety measures for personal information protection. AI content company Thingsflow and Hyundai Motor Company are also being sanctioned for violations of the Personal Information Protection Act.

The Personal Information Protection Commission announced on the 29th that it held a plenary session and decided to impose a fine of 185.31 million KRW and a penalty of 3 million KRW on Hanwha Hotels & Resorts.

Hanwha Hotels & Resorts changed the reservation procedure for an event where online members could use coupons to book accommodations, but due to system development negligence and insufficient prior verification, information of persons other than the reserving customer was viewed up to 1,818 times. The Commission judged that by changing the login procedure without properly verifying the possibility of accessing others' personal information, there was a violation of the obligation to implement safety measures.

Thingsflow was fined 27.32 million KRW and penalized 3.6 million KRW.

Between Us, which merged with Thingsflow, operated the couple-targeted social networking service (SNS) Between, and collected personal information of 38,633 children under the age of 14 without the consent of their legal guardians.

Additionally, it was found that the personal information handler did not preserve or manage access records to the personal information processing system, and failed to respond within the 10-day period to requests for personal information access. The Commission decided to impose fines and penalties, issue corrective orders, and publicly disclose the results on the Commission’s website.

While investigating Between Us following reports of personal information infringement, the Commission proceeded with investigation and disposition on Thingsflow after the companies decided to merge.

Furthermore, Hyundai Motor Company was fined 3.29 million KRW, penalized 9 million KRW, and the results were also decided to be publicly disclosed.

Hyundai Motor Company was found to have refused to provide goods or services, specifically the new car test drive service, on the grounds that consent was not given for the collection and use of personal information for marketing and promotional purposes, which is prohibited. It was also investigated that the company delayed applying security patches to commercial software used in customer support applications, resulting in exposure of others' personal information and delayed reporting and notification.

This content was produced with the assistance of AI translation services.