South Korea is slapping the Chinese e-commerce site Temu with a fine of over one-point-three billion won, or about 930-thousand U.S. dollars, for sharing South Korean users’ sensitive personal data with third-party companies without their consent.

The Personal Information Protection Commission announced on Thursday that it will fine the online shopping platform for violating the Personal Information Protection Act.

Temu will also receive a separate penalty of 17-point-six million won, a corrective order and a recommendation for improvements.

Temu, which has seven-point-eight million users in this country, was found to have transferred 13 types of personal data, including device identifiers, user names, contacts and order information, in the process of fulfilling orders, making deliveries and facilitating customs clearance for items ordered through its site.
  
The commission said Temu entrusted data processing to 32 external companies across 10 countries, including South Korea, the United States, Australia, Indonesia and Singapore, but failed to disclose the practice and did not inform users until the commission launched its investigation.

It also said Temu did not supervise the overseas businesses it entrusted with processing personal information, such as by checking the status of processing or safety management training.

Amendments to the Personal Information Protection Act are set to take effect in October and will require overseas businesses to designate a corporation in South Korea to protect the personal information of their users here, such as by reporting any personal information leaks and notifying users. 
 
While Temu took some steps to remedy the situation amid the investigation, including steps to improve its membership withdrawal process, the commission said it will continue to thoroughly check whether the company faithfully protects users’ data and implements the corrective order.