South Korea slaps Meta with $15M fine for unauthorized data collection

Meta Platforms Inc., the parent company of Facebook and Instagram, has been fined more than $15 million by South Korea’s data protection authority for allegedly collecting sensitive personal data, including religious beliefs and sexual orientation, from nearly a million South Korean users without their explicit consent. This information was then shared with advertisers, a clear breach of the country's stringent data protection laws, according to an announcement made Tuesday by the Personal Information Protection Commission (PIPC).
The PIPC reported that Meta collected sensitive details about 980,000 users through Facebook, violating regulations that prohibit the collection of information regarding political views, religious beliefs, and aspects of personal relationships without explicit consent from individuals.
The commission stated that among the sensitive data gathered were users' religious affiliations and indications of same-sex relationships, which were then shared with around 4,000 advertisers. Meta reportedly used behavioural data, such as Facebook pages liked and ads clicked, to deliver targeted ads focused on topics like LGBTQ+ issues, transgender rights, and North Korean defectors.
In addition to the fine of 21.6 billion won ($15.6 million), South Korea’s watchdog instructed Meta to establish legal provisions for processing sensitive user data, enhance data security measures, and comply with user requests regarding access to personal information.
The PIPC emphasized that the decision reinforces the expectation for international tech companies to adhere to South Korea's stringent data protection laws when processing sensitive user data.