South Korea’s data privacy watchdog has made use of the Personal Information Protection Act (PIPA) to fine AliExpress two billion won (about $1.4 million) for privacy violations involving transferring customer information to third party sellers in China and other foreign nations, and it has indicated that an ongoing investigation into Temu may yield similar results.
AliExpress has grown to become the country’s second largest online retailer by monthly active user count, followed very closely by third-place Temu. The rapid growth of these companies in the region and a preponderance of customer complaints have sparked the Personal Information Protection Commission (PIPC) investigations, which now may be developing into a general crackdown on China-based e-commerce firms.
Alibaba Group ordered to remedy privacy violations
The PIPC fine to Alibaba Group was accompanied by an order to rectify the privacy violations, along with a set of recommendations to avoid future regulatory action. About 180,000 AliExpress customers are thought to have been impacted, with personal information connected to their accounts provided to sellers on the platform without their full knowledge and consent under the terms of the law. The retailer also failed to provide required dispute resolution protocols for cases of alleged infringement.
This is the first case of PIPA, which was substantially revised in 2023, being used in an enforcement action involving overseas personal data transfers. The decision clarifies that foreign companies operating in South Korea are equally subject to PIPA requirements regarding personal data management and potential privacy violations.
PIPC investigations into both AliExpress and Temu began in late 2023, as both businesses were in the midst of a major spike in user adoption in the country. Both platforms essentially work on the eBay model, providing an online marketplace for buyers to connect with vast amounts of third-party sellers rather than producing anything directly. Consumer complaints also spiked as the platforms grew, though most involved product quality, late shipping or failure to deliver as promised.
In addition to the fine, AliExpress will be required to demonstrate that it has contracts in place with vendors that specifically address potential PIPA privacy violations and to improve its data minimization practices. The order also recommended, but does not yet require, that the company update its own internal privacy protection measures to ensure compliance with the law. It has also been asked to improve its account deletion process and to provide consumer rights information in languages other than English outside of China.
South Korea getting tougher on China’s e-commerce platforms
The PIPC action follows a March emergency meeting by government ministers and announcement that Chinese e-commerce platforms could expect to face increased scrutiny going forward and a proposed update to the Electronic Commerce Act that would require them to establish a local office within the country to continue operating there. Ostensibly this was to do with mounting consumer complaints and potential privacy violations, but the rapid growth of Chinese companies in the area has also crowded out a number of local Korean competitors.
The Chinese platforms have been able to undercut the competition by having less expensive suppliers and offering added perks like free returns. AliExpress has also convinced Korean sellers to jump ship from local platforms with targeted benefits such as an extended introductory period free of sales commissions.
These aggressive expansion moves have created regulatory issues that are separate from the privacy violations. In March, South Korea’s antitrust agency launched its own investigation into possible unfair business practices by AliExpress. Temu seems to be next in line for heavy scrutiny, with the PIPC announcing that it will be the focus of its next plenary meeting. AliExpress has about 8.4 million active monthly users in South Korea, followed closely by Temu with 8.2 million.
AliExpress is also facing potential fines in the EU, with a European Commission investigation launched in March that is seeking to determine if the platform has been doing enough to curb the sale of illegal goods such as fake medications and dietary supplements with bogus ingredients. Any fine could run up to 6% of the company’s annual global turnover, but the Commission has said that it is “not yet clear” if AliExpress is out of compliance. Temu is similarly being scrutinized by the European Union, which in May classed it as a “very large online platform” under the EU’s Digital Services Act. That obligates it to comply with the Act’s full requirements by September of this year. Some members of the US government have also recently called for investigations into Temu under suspicion of the use of forced labor in its supply chains.
