Personal Information Protection Commission (PIPC) — OpenAI OpCo LLC

Decided by

Personal Information Protection Commission

Parties

Personal Information Protection Commission v. OpenAI OpCo LLC

Decision date

July 26, 2023

Remedy

OpenAI OpCo LLC was fined KRW 3.6 million for failing to comply with data breach notification requirements and issued administrative improvement recommendations to prevent recurrence and achieve full compliance with Korean privacy law.

Amount

₩3,600,000

Appeal

Appeal status not stated

Key holdings

1. OpenAI was fined for failing to meet statutory data breach notification obligations under Korean privacy law following a leak affecting ChatGPT Plus users.

   “OpenAI had failed to meet the notification requirement to report incidents of data breach which is also required under the PIPA, and this provided the ground for the fine imposed.” — Contents, section 1, paragraph 2

2. The PIPC issued administrative improvement recommendations directing OpenAI to implement safeguards, perform self-inspections, and ensure full compliance with the PIPA.

   “The PIPC also resolved to issue a set of “improvement recommendations,” a formal administrative disposition provided for in the Personal Information Protection Act (“PIPA”), to OpenAI” — Contents, paragraph 1

3. Korean privacy legislation applies to foreign services if their users are located in South Korea or if the data processed was collected from South Korea.

   “Today’s decision makes it clear that the Korean law will apply to new services if their users include users in Korea or the relevant data was collected from Korea.” — Contents, section 3, paragraph 3

In plain English

On July 26, 2023, South Korea's Personal Information Protection Commission held a plenary meeting and decided to sanction OpenAI OpCo LLC following an investigation initiated in March 2023. The investigation examined a data breach that occurred between March 20 and March 21, where an open-source cache bug exposed the personal information of 687 South Korean users of ChatGPT Plus. Exposed details included names, email addresses, billing addresses, credit card expiration dates, and the last 4 digits of credit card numbers. While the authority found no violation of security safeguard requirements, OpenAI failed to fulfill statutory obligations to notify affected parties about the data breach. Consequently, the authority imposed an administrative fine of 3.6 million KRW, equivalent to approximately 3,000 USD. The authority also identified several areas where OpenAI fell short of the Personal Information Protection Act, including the lack of a Korean privacy policy, improper user consent mechanisms, unclear data retention and processor roles, and setting a minimum age threshold of 13 despite Korean law requiring guardian consent for users under 14. In response, OpenAI agreed to achieve full compliance by September 15, 2023. The authority issued formal improvement recommendations requiring OpenAI to establish safeguards, complete self-inspections, and cooperate with future monitoring. The decision confirms that Korean privacy law applies to global service providers when service users are located in South Korea or data is collected within the country.