Home > Business > Industry

Temu fined nearly $1 million in Korea for transferring users’ data to China, elsewhere

Published: 15 May. 2025, 16:59 Updated: 15 May. 2025, 18:09

The logo of Chinese e-commerce platform Temu is seen on a mobile phone displayed in front of its website. [REUTERS/YONHAP]

Chinese e-commerce platform Temu has been fined 1.37 billion won ($982,420) for transferring local users’ data to entities in countries including China, Singapore and Japan without proper disclosure.

The Personal Information Protection Commission (PIPC) decided to impose the fine for violating Korea’s Personal Information Protection Act and issue a corrective order requiring improvements to the company’s personal information protection system, according to the commission on Thursday.

The regulator launched an investigation in April last year into Temu and AliExpress, both Chinese online retailers, over potential violations of Korea’s data protection law. AliExpress was fined 1.98 billion won last July for violations related to overseas data transfers. The penalty against Temu was delayed because the company failed to submit timely sales data, which is used to calculate fines.

Temu entrusted or stored personal data with multiple entities in Korea, China, Singapore and Japan for delivery purposes, according to the PIPC. However, the company did not disclose this in its privacy policy or notify users. The company also failed to oversee or educate its contractors on safeguarding the data, as the law requires.

Under current law, companies transferring or storing personal data overseas must disclose this in their privacy policy or notify users via email or other means.

Temu also failed to designate a local representative in Korea, despite an average of 2.9 million Korean users accessing its services daily as of late 2023. In addition, the company made it difficult for users to exercise their rights by requiring a seven-step process to delete accounts.

The logo of Temu, an e-commerce platform owned by PDD Holdings, is seen on a mobile phone displayed in front of its website, in this illustration picture taken April 26, 2023. [REUTERS/YONHAP]

However, the commission said Temu voluntarily amended its privacy policy during the investigation, disclosing the cross-border transfers, naming contractors, appointing a local representative and streamlining its account deletion process.

The PIPC also discovered that in February, Temu collected ID cards and facial video recordings from Korean sellers for its pilot “local-to-local” service, through which products are sold and delivered within Korea, without a legal basis to process resident registration numbers. The company reportedly deleted the data during the investigation.

The commission fined Temu 1.37 billion won for the illegal overseas transfer and handling of resident registration numbers, and imposed an additional administrative fine of 17.6 million won for violations related to contractor management and the failure to appoint a domestic representative.

The commission also ordered Temu to improve its transparency around the flow and delegation of personal data, strengthen oversight of contractors and better protect users' rights.

“The commission will closely monitor whether the company properly implements these corrective orders,” the PIPC said. “As more Chinese companies expand into Korea, we will continue to step up outreach about Korea’s data protection laws through platforms like the Korea-China Internet cooperation center and local business forums in China.”

Translated from the JoongAng Ilbo using generative AI and edited by Korea JoongAng Daily staff.
BY LEE SOO-KI [[email protected]]