AliExpress fined 1.9 billion won for leaking personal information of Korean customers

The Personal Information Protection Commission fined the Chinese e-commerce platform $1.37 million for providing its sellers with the personal information of Korean users without their consent.

A commercial campaign of AliExpress [YONHAP]

Korea's personal information watchdog has fined Chinese e-commerce platform AliExpress 1.9 billion won ($1.37 million) for leaking the personal information of Korean customers to about 180,000 overseas sellers without consent.

The fine, approved by the Personal Information Protection Commission on Thursday, marks the first financial penalty levied against a major Chinese e-commerce company by a Korean regulator.

AliExress was found to have provided the personal data to its listed sellers. Over 180,000 overseas sellers, mostly Chinese, received the personal information in the process, the commission said.

The platform did not provide the required notification to users about the countries, names and contact numbers of those receiving their personal information, nor did it include necessary data protection measures in its sales terms, the commission said.

Additionally, its online pages were organized in a way that made it difficult for users to cancel their memberships, while the page for removing their accounts was written in English, making it less accessible.

The Personal Information Protection Act requires consent from users for overseas transfers of their personal information and mandates that information about consumer complaint settlement procedures be included in the terms and conditions.

Under Thursday's decision, the commission fined Alibaba.com, the parent firm of AliExpress, nearly 1.98 billion won, and ordered it to implement protection measures for overseas information transfers and to streamline the membership cancellation procedure.

The decision came as a result of the commission's investigation of personal data protection compliance by Chinese e-commerce giants, including Temu, amid rising complaints.

The commission decided to address another data protection case involving Temu during its next plenary session.

BY PARK EUN-JEE, YONHAP [park.eunjee@joongang.co.kr]