South Korea fines Meta $15 million for illegally collecting information about Facebook users

SEOUL, South Korea (AP) — South Korea’s privacy watchdog was fined Tuesday social media company Meta 21.6 billion won ($15 million) for illegally collecting sensitive personal information from Facebook users, including data about their political views and sexual orientation, and sharing it with thousands of advertisers.

It was the latest in a series of punishments against Meta by South Korean authorities in recent years as they increase scrutiny over how the company, which also owns Instagram and WhatsApp, handles private information.

After a four-year investigation, South Korea’s Commission for the Protection of Personal Information concluded that between July 2018 and March 2022, Meta unlawfully collected sensitive information about approximately 980,000 Facebook users, including their religion, political views and whether they had a had a homosexual relationship.

The company said it shared the data with about 4,000 advertisers.

South Korea’s privacy law provides strict protection for information related to personal beliefs, political views and sexual conduct, and prohibits companies from processing or using such data without the specific consent of the individual concerned.

The commission said Meta collected sensitive information by analyzing the pages Facebook users liked or the ads they clicked.

The company categorized ads to identify users interested in topics such as specific religions, gay and transgender issues and issues related to North Korean refugees, said Lee Eun Jung, director of the committee that led the investigation into Meta.

“While Meta collected and used this sensitive information for individualized services, they only vaguely mentioned this use in their data policies and did not receive specific permission,” Lee said.

Lee also said Meta is endangering the privacy of Facebook users by not implementing basic security measures such as deleting or blocking inactive pages. As a result, hackers were able to use inactive pages to spoof identities and request password resets for other Facebook users’ accounts. Meta approved these requests without proper verification, resulting in data breaches affecting at least 10 South Korean Facebook users, Lee said.

In September, European regulators have hit Meta with more than $100 million in fines for a 2019 security flaw that temporarily exposed user passwords in unencrypted form.

Meta’s South Korean office said it would “carefully review” the committee’s decision, but did not immediately comment further.

The commission imposed fines in 2022 Google and Meta together 100 billion won ($72 million) for tracking consumers’ online behavior without their consent and using their data for targeted advertising, the highest penalties ever imposed in South Korea for privacy violations.

The commission said at the time that the two companies had not clearly informed users or obtained their consent to collect data about them because they used other websites or services outside their own platforms. It ordered the companies to provide an “easy and clear” consent process to give people more control over whether to share information about what they do online.

The commission also fined Meta 6.7 billion won ($4.8 million) in 2020 for providing personal information about itsx users to third parties without consent.