Key points. On 14 May 2025 the Personal Information Protection Commission ("PIPC") imposed a penalty surcharge of KRW 879,000,000 and administrative fines of KRW 17,600,000 on Whaleco Technology Limited, the operator of Temu (decision No. 2024-013-193). The surcharge rests on PIPA art. 28-8(1) (cross-border transfer); the fines rest on art. 26(2) (disclosure of an entrustee) and art. 31-2(1) (domestic representative). Whaleco raised five arguments. The Commission rejected four and accepted one: it did not impose a fine for failing to submit materials. In the same passage it treated the omission of China-based affiliates and subsidiaries from a submission as obstruction of the investigation, which raised the surcharge by 30% at the second adjustment. Related-party revenue was included in turnover, and the Korean share of turnover was then applied.
This note reads two parts of the decision closely.
They are the pages where the respondent’s arguments are answered and where the surcharge is calculated.
It covers one decision only, and it quotes the Korean text where the wording matters. English renderings of the Korean are ours.
What was decided
The Commission adopted the decision on 14 May 2025.
The respondent, Whaleco Technology Limited, had provided the Temu e-commerce service to Korean users since July 2023. The Commission began its investigation on 29 February 2024, citing concerns about personal data in fast-growing cross-border direct-purchase services.
The decision records the following findings.
| Provision | What the Commission found | Consequence in the decision |
|---|---|---|
| Art. 28-8(1) — cross-border transfer | Personal data was transferred for logistics, payment and other purposes to entities in Singapore, Japan, the United States, China and elsewhere without the statutory items being disclosed in the privacy policy or notified to users | Penalty surcharge KRW 879,000,000 |
| Art. 26(2) — disclosure of entrustee | A Korean company handling returns, refunds and exchanges was not named in the privacy policy | Administrative fine |
| Art. 26(4) — training and supervision of entrustee | The entrustee was neither trained nor supervised | Corrective order (b) |
| Art. 31-2(1) — domestic representative | No domestic representative until 18 March 2024 although the daily-average threshold of 1 million Korean data subjects was met for October–December 2023 | Administrative fine |
| Art. 38(4) — exercise of rights | Account deletion took seven or more steps, including an extra confirmation screen after the user had already entered a reason for leaving | Corrective order (c) |
| Art. 63(1) — materials | Materials on the countries of processing were submitted without the China-based affiliates and subsidiaries | No fine; treated as obstruction, +30% to the surcharge |
The two administrative fines are calculated in the decision as follows. The base amount for art. 26(2) was KRW 2 million, the first-violation amount. The base amount for art. 31-2(1) was KRW 20 million, which applies regardless of the number of violations. The Commission found no ground to increase either fine. It reduced both by 20% because Whaleco had stopped the violations before the prior-notice comment period ended. The total came to KRW 17.6 million.
The Commission also issued corrective orders (a) to (d) and improvement recommendations (a) to (d). Each set requires a report within 90 days of notification. One recommendation asks Whaleco to designate its Korean corporation as its domestic representative under the amended Act in force from 2 October 2025. That rule is explained in Appointing a domestic representative under Korea’s PIPA.
The five arguments and the Commission’s answers
| # | Whaleco’s argument | Commission’s answer |
|---|---|---|
| 1 | The transfer to a China-based affiliate was one-off, and the subsidiaries do not "process" personal data, so neither had to be disclosed | Rejected |
| 2 | The Korean business was too new for the entrustee training and supervision duty to have been breached | Rejected |
| 3 | The account-deletion process was already clear and simple, and had been simplified further | Rejected |
| 4 | Every request was answered by its deadline, so a fine for non-submission is inappropriate | Accepted for the fine, but the conduct was treated as obstruction for the surcharge |
| 5 | Related-party revenue has nothing to do with Korean users and should be excluded from relevant turnover | Rejected; the Korean share of turnover was then applied |
1. "The transfer was one-off, and the subsidiaries do not process personal data"
Whaleco admitted that it had not disclosed its cross-border entrustment and storage in the privacy policy. It said it had corrected this on 22 March 2024, after receiving the Commission’s request for materials.
Whaleco then drew a line around two group entities. It said the transfer to a China-based affiliate was one-off. It also said that certain subsidiaries did not "process" personal data at all. On that basis Whaleco argued that neither needed to appear in the privacy policy and that neither could be the subject of a corrective order.
The Commission rejected both points.
On the affiliate, the Commission looked at the purpose of the transfer. The facts section describes that purpose as resolving system failures and legal and compliance work, and gives an example: responding to requests from the Korea Customs Service about Korean consumers. The Commission held that this was an entrusted task that continues over a period of time. It therefore could not be the kind of one-off entrustment described in the Commission’s December 2020 guidance on the Act.
On the subsidiaries, the Commission looked at what they did. They used an application that Whaleco had provided to reach the server holding Korean users' personal data. They then printed shipping labels and attached them to the goods. The Commission held that an entity doing this cannot be regarded as a mere "conduit" (「단순 '도관' 사업자」).
The decision’s findings on the 22 March 2024 correction are also relevant here. The revised privacy policy of that date did not give contact details for the recipients, although every recipient was a legal entity. Those details were published on 17 June 2024. The China-based affiliates and subsidiaries were published only on 4 April 2025, after the Commission had raised the point. The facts section adds two further defects: some recipients were listed under a trade name rather than the registered corporate name, and some recipients located in China were listed with the country where their logistics system sat, such as Singapore, Japan or Korea.
2. "Our Korean business was too new"
Whaleco argued that it had only started its Korean service in July 2023. It said that, in light of the relevant rules and guidance, the short period meant there was no violation of the entrustee training and supervision duty.
The Commission rejected this. It reasoned that the training and supervision duty arises when processing is entrusted, not after some period of operation. It added that, depending on the nature of the entrusted work, training on precautions may be needed even before any personal data is actually handed over.
The Commission also noted, "for reference", that Whaleco had been entrusting processing worldwide before its Korean launch. It also described Whaleco, by reference to its Korean monthly active users as of June 2024, as one of the top e-commerce operators in Korea. The published text redacts the user figure.
3. "Our deletion process was already simple"
Whaleco argued that its account-deletion process was clearer and simpler than other operators', and that it had simplified the process further. On that basis it argued that a corrective order was not warranted.
The facts section records the process as it stood. Signing up required only an email address or mobile number, or a Google or Facebook login. Deleting the account took seven or more steps. After the user had entered a reason for deletion, a further screen asked the user to confirm the intention to leave. Whaleco removed that screen on 26 June 2024.
The Commission rejected the argument. It found that adding a confirmation screen after the user had already given a reason was a deliberate extra step to restrict deletion, and was unlawful. It also pointed to the need to publish the method and procedure for exercising rights so that data subjects can know them. Corrective order (c) was issued even though the screen had already been removed.
4. "We submitted everything on time"
This is the argument that the Commission accepted, and it needs to be read together with the calculation section of the decision.
The facts section sets out the sequence of requests and answers.
| Date | Event |
|---|---|
| 8 March 2024 | The Commission asks: where personal data is processed in countries other than the United States, "which country", "for what purpose", and "the role of each business" that processes it |
| 22 March 2024 | Whaleco submits what it published in its privacy policy that day, leaving out matters relating to its affiliates and subsidiaries located in China |
| Date not stated | The Commission asks for further material: the countries and businesses that can access the system, sample shipping-label images, and similar items, citing the absence of China from the list of transfer countries |
| 22 April 2024 | Whaleco identifies the affiliate used for system-failure resolution and Korea Customs Service requests |
| 23 May 2024 | Whaleco discloses that a subsidiary prints shipping-label images at the transit warehouse in China |
| 5 June 2024 | The Commission sends the prior notice of the proposed measures |
| 26 June 2024 | Whaleco submits its comments on the prior notice, and, after receiving the prior notice on non-submission, submits the shipping-label samples |
In the illegality section the Commission noted that the companies involved in processing were Whaleco’s own affiliates and subsidiaries, and that Whaleco ships goods from China. It said that revealing those entities only after a second, more specific request could amount to failing to submit materials.
Whaleco’s answer was that it had met every deadline. The Commission accepted that answer for one purpose. Whaleco had initially left out some affiliates, but it had supplied the additional material by the deadline for commenting on the prior notice. The Commission therefore considered it too much of a stretch to treat the conduct as failure to submit materials under art. 75(2)(25), and imposed no fine on that ground.
The next sentence of the decision changes the result. The Commission characterised the omission of the China-based affiliates and subsidiaries as follows:
「자료제출의 외형은 갖추었으나 실제는 갖추지 못한 것으로서, 명확한 증거를 제대로 제출하지 않은 조사 방해 행위」 — a submission that "had the outward form of a submission but lacked its substance", and conduct obstructing the investigation by not properly submitting clear evidence.
On that basis the Commission treated the omission as a ground for increasing the surcharge. The increase is the 30% at the second adjustment, described in the next section.
The structure is worth setting out plainly. The base amount of the fine under art. 75(2)(25) is set by Table 2 of the Enforcement Decree and can then be increased or reduced. The surcharge increase is a percentage of an amount calculated from turnover. Whaleco avoided the first and incurred the second, for the same conduct.
5. "Related-party revenue is unrelated to Korea"
Whaleco argued that revenue from related-party transactions was unrelated both to Korean users' information and to any service or sales activity directed at Korean users. It described that revenue as arising from intra-group transactions for efficient group operations.
The Commission examined the related-party contracts that Whaleco had submitted. In form, the contracts showed Whaleco receiving payment from an affiliate higher in the group for providing procurement agency services. In substance, the Commission found, the payments were funding that allowed the Temu service to operate in Europe without large losses, and the procurement agency service had no real content.
The decision gives the reasons for that finding.
- The Commission asked Whaleco for actual examples of the procurement agency work. Whaleco could not provide them. It answered that the group had provided financial support, in the form of related-party transactions, so that the Temu service could continue.
- According to the group structure chart, the related party wholly owned the subsidiary that prints shipping labels at the transit warehouse in China, the same subsidiary at issue under argument 1.
- The procurement agency service was provided only for the purpose of operating Temu. The Commission considered that Temu could not continue without it, so the two services could not be separated.
- Despite several requests for materials, Whaleco did not clearly prove that the related-party revenue was unrelated to the violation.
- The related-party revenue grew as Temu’s business grew. The Commission connected this to Temu’s low-price strategy and cited a commission rate of 0.5% as an example. On that reasoning the revenue was turnover affected directly or indirectly by the violation.
The Commission therefore calculated from total turnover including related-party revenue, citing art. 7(3) of the surcharge Notice.
It then made one adjustment in Whaleco’s favour. Whaleco had submitted its official financial statements and the detail of every transaction made through the Temu Korea site. Korean users' personal data was processed for Temu’s Korean service, meaning product sales and delivery. The Commission therefore applied the ratio of Korean turnover to total turnover, for 2023 and for 2024, to reach the turnover on which the surcharge was based. The published text redacts both percentages.
How the surcharge was built up
The surcharge was imposed for the art. 28-8(1) violation only, under art. 64-2(1)(7) of the Act, art. 60-2 of and Table 1-5 to the Enforcement Decree, and the Standards for Imposing Surcharges for Violations of the Personal Information Protection Act (PIPC Notice No. 2023-3, in force from 15 September 2023).
| Step | What the decision applies | Amount in the published text |
|---|---|---|
| Ceiling | 3% of the average annual turnover for the three business years before the year of the violation (art. 64-2(1); Decree art. 60-2) | Not stated |
| Relevant turnover | Total turnover including related-party revenue (Notice art. 7(3)), multiplied by the Korean share for 2023 and 2024 | Redacted |
| Seriousness grade | "Serious violation" (중대한 위반행위), after weighing intent or negligence, the method of the violation, the type of personal data, and the scale of and effect on data subjects (Notice art. 8(1) and Table) | — |
| Base amount | Relevant turnover × 1.5% (150/10,000), the base rate for a serious violation | Redacted |
| First adjustment | +25% of the base amount: violation period from July 2023 to April 2025, "more than one year and up to two years" (Notice art. 9) | Redacted |
| Second adjustment | +30% of the amount after the first adjustment: obstruction of the investigation (Notice art. 10) | Redacted |
| Final surcharge | — | KRW 879,000,000 |
The decision records no reduction at either adjustment step.
The two increases compound. The second increase is 30% of an amount that has already been increased by 25%.
The Notice describes the obstruction ground as refusing a request to produce goods or documents or an inspection under art. 63(1) or (2), or obstructing the investigation by destroying, concealing or manipulating evidence or giving false information. The decision places Whaleco’s conduct within that ground without saying which of the listed forms it took. The conduct the decision describes is an incomplete answer, not a refusal.
The administrative fine guidelines also list obstruction of the investigation among the grounds for increasing a fine. For the fines in this decision, however, the Commission found no ground for an increase.
A separate calculation tool explains the same steps in general terms: How Korean privacy fines are calculated.
Three points for a group legal team
1. The answer to "where is personal data processed" includes group companies. The Commission’s question on 8 March 2024 asked about every country outside the United States, the purpose, and the role of each business. Whaleco answered by reference to its published privacy policy. The Commission treated the gap between that answer and the actual group arrangements as obstruction. A group preparing a submission should therefore map every group entity that can reach Korean users' data, including entities that only access a system to support operations or compliance, and answer on that map rather than on the privacy policy.
2. Supplying the missing material by the prior-notice deadline did not remove the consequence. Whaleco completed its submission by 26 June 2024. That timing was enough for the Commission to decline the administrative fine. It was not enough to avoid the surcharge increase, because the Commission assessed the first, incomplete answer. In this decision, the point at which the answer became complete did not erase the incomplete answer that came first.
3. A related-party revenue argument needs evidence of substance, and the Korean-share adjustment depended on disclosure. The Commission did not accept the label on the intra-group contracts. It asked for examples of the service, read the group structure chart, and followed the revenue trend. Whaleco could not supply examples, and its own explanation described the payments as group financial support. On the other hand, the Korean-share ratio was applied because Whaleco had submitted its official financial statements and the full transaction detail for the Korean site. The decision does not say what the outcome would have been without that material. How far a similar argument would succeed depends on the group’s own contracts and records.
The same-day decision against Elementary Innovation
On the same day the Commission adopted a separate decision, No. 2025-011-035, against Elementary Innovation Pte. Ltd, which also concerned the Temu service.
That decision dealt with the onboarding of Korean sellers. Elementary Innovation collected and held sellers' resident registration numbers through identity-document images without a legal basis. The Commission found a breach of PIPA art. 24-2(1) and imposed a surcharge of KRW 490 million, together with a corrective order and an improvement recommendation.
The two decisions have different respondents, provisions and amounts. The KRW 490 million belongs to the Elementary Innovation decision and is not part of the surcharge imposed on Whaleco.
Related
- Appointing a domestic representative under Korea’s PIPA
- Entrustment and the processor under Korean law
- How Korean privacy fines are calculated
- PIPC enforcement decisions, in English
Frequently asked questions
In the Temu decision, was Whaleco fined for failing to submit materials to the PIPC?
No. Whaleco argued that it had submitted everything by the deadlines, and the Commission accepted that argument for the purposes of the administrative fine under PIPA art. 75(2)(25). The reason given was that Whaleco had supplied the missing material by the deadline for commenting on the prior notice. The Commission then treated the same conduct, namely answering a question about where personal data is processed while leaving out its affiliates and subsidiaries in China, as obstruction of the investigation, and increased the penalty surcharge by 30% at the second adjustment.
Did the PIPC accept that transfers to a group affiliate were one-off, or that subsidiaries printing shipping labels were not processing personal data?
No. The Commission found that the transfer to the China-based affiliate, made for resolving system failures and for legal and compliance purposes, was a continuing entrusted task, not a one-off one. It also found that the subsidiaries, which used an application supplied by Whaleco to access the server holding Korean users' data and print shipping labels, could not be treated as a mere conduit. The argument that these entities fell outside the privacy-policy disclosure duty was rejected.
Did related-party revenue count towards the relevant turnover in the Temu decision?
Yes. Whaleco argued that revenue from related-party transactions had nothing to do with Korean users. The Commission found that the procurement agency service described in the contracts had no real substance, that it existed only to keep the Temu service running, and that Whaleco had not shown the revenue to be unrelated despite repeated requests. It calculated from total turnover including related-party revenue. It then applied the ratio of Korean turnover to total turnover for 2023 and 2024, because Whaleco had submitted its official financial statements and the full transaction detail for the Korean site. The published text redacts the ratios.
This note describes a single published decision for readers outside Korea and is not legal advice. The outcome of any investigation turns on its own facts and requires individual review. Names of group entities, user numbers, turnover ratios and intermediate amounts are redacted in the published decision and are not supplied here. All English renderings of Korean statutes, rules and decision text are unofficial; the Korean text governs.
Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile — the page opens in Korean; use the ENG switch at the top right for the English version). Other English summaries are collected at English summaries.