Consumer Foundation reveals the leak of personal information of South Korean e-commerce company Kupeng and calls for strengthening cross-border information security supervision

A personal information leakage incident broke out last year at South Korean e-commerce company Kupeng, which affected the personal data of more than 200,000 Taiwanese users. The Consumer Cultural and Educational Foundation called on the government to implement a substantive information security supervision mechanism as cross-border platforms become more and more popular, establish a personal information protection committee as soon as possible, and tighten personal information laws. It also reminded the public to pay attention to relevant terms when applying for an account.

Deng Weizhong, chairman of the Consumer Foundation, pointed out that Coolpeng claimed that Taiwanese users were not affected when the personal information leak occurred last year. However, after an investigation by the Ministry of Digital Information and Communications, it was discovered that the company's former Chinese employees had illegally accessed the data of nearly 200,000 Taiwanese users, exposing vulnerabilities in corporate information security and authority management. It also highlighted the challenges faced by the current information security supervision system as cross-border transmission and overseas storage of personal information of Taiwanese consumers, which deserves the joint attention of the government, enterprises and all sectors of society.

Please read on...

Xu Zeyu, executive director of the Consumer Foundation, said that as far as current regulations are concerned, according to the "Personal Data Protection Law", if non-public agencies transfer personal information overseas without the consent of the parties involved and exceed the necessary scope of the original collection purpose, it may involve violating Article 20 of the "Personal Data Protection Law" and may be fined not less than 50,000 yuan but not more than 500,000 yuan. However, the relevant fine amount is "slightly low" for large companies and may not have the power to deter it.

Xu Zeyu said that although many multinational companies inform in their privacy clauses that consumer data will be stored abroad. For example, Coolpeng informed that customer data is stored in South Korea, but most consumers may not check the relevant clauses.

Xu Zeyu said that although Article 21 of the "Personal Information Law" gives the competent authorities the power to restrict cross-border transmission of personal information by non-public agencies under certain circumstances, this is only limited to conditions involving major national interests, and cannot effectively restrict individual companies that have not implemented personal information protection.

Chen Yaping, secretary-general of the Consumer Foundation, emphasized that in addition to Kupeng, major information security incidents have occurred at PChome’s Pi Pay International (Pi Wallet) and cross-border purchasing platform Bibian. If Taiwan does not control the leakage of personal information, it can only passively wait for returns from overseas companies and cannot prevent blockage immediately. This reflects that with the rapid development of cross-border platforms, personal information security is facing increasingly severe challenges.

Chen Yaping said that the information security risks of this incident include three major loopholes in cross-region backup key settings, access rights of resigned employees, and information security leak reporting procedures, especially for personal information. Currently, there is no independent supervision agency. They are all managed by different business authorities, and there is no complete supervision system.

The Consumer Foundation calls for the establishment of a personal data protection committee to be completed as soon as possible and to establish an independent and dedicated personal data supervision mechanism to improve the effectiveness of personal data protection in my country; for domestic companies with existing entities, consumers' personal data should be required to be stored domestically and subject to effective supervision; consumers are also reminded that before applying for an account and filling in personal data, it is recommended to confirm the operator's privacy policy and user terms, pay attention to the scope of personal data provision, and make good use of the privacy settings and security notification functions provided by the platform.