The Commission found that, when users logged into other company's services using their Facebook accounts, the personal information of their Facebook friends was also shared to such service providers without consent. The personal information that was shared with other companies included users' names, addresses, dates of birth, work experience, hometowns and relationship statuses.
The PIPC also says the exact amount of the shared information is unclear as Facebook did not provide relevant documentation. The commission plans to refer Facebook Ireland, which was in charge of Facebook operations in South Korea from May 2012 to June 2018, to the prosecution for a criminal investigation.
Facebook Ireland's director in charge of user privacy could face up to five years in prison or a maximum of KRW 50 million in fines if convicted of violating South Korea's relevant personal information law. The PIPC also claims Facebook was uncooperative in its investigation as it submitted incomplete or false documents. Separately, the PIPC also fined Facebook KRW 66 million for the false documentation.
"We cooperated with the investigation in its entirety", Facebook said. "We have yet to closely review PIPC's measure", the company added.
