Personal Information Protection Commission recommends improvements for five firms

The Personal Information Protection Commission said it has recommended improvement measures for five companies that failed to properly handle privacy inquiries from domestic users. The decision was made during the commission's 19th general meeting on Sept. 9, following a follow-up compliance check on businesses that received 'insufficient' ratings in the 2025 privacy policy evaluation.

Among the cited cases, Lutton Technologies did not reply to inquiries regarding the exercise of user rights, while Tesla Korea and DeepSeek responded to domestic users in English and Chinese respectively. The commission advised these three operators to upgrade their systems so that requests from Korean data subjects can be received and processed smoothly.

Issues with local representative operations were also identified at OpenAI and Nike. Although both companies directed phone callers to specific email addresses for privacy matters, they failed to send replies to those subsequent inquiries. The regulator urged the two firms to strengthen supervision to ensure grievances are handled properly through their domestic agents.

Inspectors further noted discrepancies between stated legal grounds and actual processing methods, complex navigation paths to privacy policies, and a failure to disclose previous versions of such policies. While some companies improved by reflecting specific data purposes and retention periods in their policies after receiving on-site support, the commission plans to notify each entity of the results individually and guide them toward voluntary improvements.

Ko Nak-jun, an official at the commission, said the agency will reinforce follow-up inspections and customized support to ensure evaluations lead to tangible improvements in privacy protection. "We will continue to monitor and improve matters that hinder the smooth exercise of data subjects' rights," he added.