The government has imposed a fine of 210 million won on cryptocurrency exchange Bithumb for transferring users' personal information overseas without their consent.
The Personal Information Protection Commission (PIPC) said Tuesday that it held a plenary meeting at the Government Complex Seoul last Monday and resolved to impose the fine on Bithumb, along with a corrective order requiring the exchange to meet legal requirements. The commission found that Bithumb had violated the cross-border transfer provisions of the Personal Information Protection Act.
The investigation began after suspicions were raised during last year's National Assembly audit that personal information had been illegally transferred overseas during Bithumb's "order book sharing" process.
The investigation found that Bithumb transferred personal information overseas from September to November last year while sharing its order book with an overseas exchange in the Tether (USDT) market. During this process, users were informed that their personal information would be transferred to a specific exchange (Stellar) and gave separate consent, but in reality, membership numbers and order information were sent to a system operated by a different exchange (bingx.com).
It was additionally revealed that when users withdrew cryptocurrency to overseas exchanges, Bithumb provided the names and wallet addresses of senders and recipients to 13 overseas exchanges for anti-money laundering (AML) purposes, without obtaining separate consent from the data subjects, failing to meet the cross-border transfer requirements under the protection law.
While the PIPC acknowledged the necessity of providing information for anti-money laundering purposes, it determined that, because cross-border transfers of personal information are closely tied to data subjects' right to self-determination, legal requirements and procedures must be strictly observed. Accordingly, it imposed a fine of 120 million won for violations in the order book sharing process and a fine of 90 million won for violations in the cryptocurrency withdrawal process.
In addition, the PIPC issued a corrective order requiring Bithumb to lawfully meet the requirements under the protection law when transferring personal information overseas, and to clearly disclose and explain the relevant details in its personal information processing policy.
Meanwhile, the PIPC also prepared "Personal Information Protection Guidelines for Blockchain Services," reflecting the characteristics of blockchain technology identified during the investigation. The guidelines include measures to prevent the disclosure and tracking of on-chain information (information recorded on the network) due to blockchain's transparency; measures to manage information sharing among participants due to its decentralized nature; and measures to destroy personal information given its immutability.
"We will continue to respond strictly to violations of the protection law, including cross-border transfers of personal information," a PIPC official said. "We plan to continuously establish related standards so that personal information protection and safe utilization can be harmonized in new technology environments."
