PIPC Unveils Results Of 2024 Personal Information Policy Evaluation

The Personal Information Protection Commission (PIPC) announced the results of its '2024 Personal Information Processing Policy Evaluation' on March 17, 2025. The evaluation assessed how 49 companies manage personal information across various sectors, including big tech and online shopping, all of which are closely related to consumers' daily lives.

According to the assessment, 72% of the companies evaluated were found to manage personal information differently from their stated processing policies. This statistic reveals significant gaps between what companies claim about their handling of data and the reality many consumers experience.

More than half of the companies lacked clear communication about how long they retain personal information, often describing the retention period as simply 'necessary period'. Such ambiguity raises concerns for consumers who deserve clarity on how their data is managed and when it will be deleted.

Accessibility issues were another major finding revealed by the evaluation. On average, users needed to scroll 12 times to access the personal information processing policy on websites, with some online shopping sites requiring more than 50 scrolls. This raises significant concerns over how user-friendly these companies are when it involves transparency about personal information usage.

The evaluation assessed not only domestic companies but also 12 foreign businesses. The results indicated these international entities fared poorly compared to their South Korean counterparts. Problems included misaligned expressions of personal information sharing methods when compared to local laws and policies, alongside awkward translations which hampered readability.

Yang Cheong-sam, head of the Personal Information Policy Bureau, emphasized the report's significance, stating, "The introduction of the evaluation system is meaningful because it allows companies to recognize the importance of processing policies and create opportunities for improvement." He pointed out the need for corporations to develop effective internal processes to keep their privacy policies updated as services evolve.

The PIPC plans to notify the companies of their evaluation results and aims to encourage voluntary improvements. This collaborative approach seeks to boost the standard of personal data protection and corporate accountability. Yang added, "The evaluation results will help companies improve voluntarily," indicating the PIPC's commitment to fostering enhanced practices industry-wide.

The 2024 evaluation was the first under the recently implemented Personal Information Processing Policy Evaluation System, which is intended to heighten data protection measures and strengthen oversight responsibilities among companies. With personal data handling under increasing scrutiny, especially amid rapid technological advancements and growing public concern for privacy, initiatives like this evaluation are more relevant than ever.

Looking forward, the PIPC will roll out the '2025 Personal Information Processing Policy Evaluation Plan' by mid-May 2025, focusing on sectors such as AI and smart home technology. This upcoming initiative aims to address key areas of consumer interest and expand upon the findings from the 2024 evaluation to include more comprehensive oversight of data protection nationwide.

Overall, the results of the '2024 Personal Information Processing Policy Evaluation' highlight the need for improved practices by many companies operating within South Korea. The detailed scrutiny of how personal data is treated reflects society's growing demand for accountability and transparency, which are fundamental to consumer rights and trust.