South Korea's Personal Information Protection Commission imposed a fine of 210 million won on cryptocurrency exchange Bithumb on the 24th for unauthorized cross-border transfer of personal information. The commission confirmed Bithumb transferred user data to overseas exchanges without proper consent during orderbook sharing and digital asset transfer operations. The regulatory action follows an investigation initiated after concerns were raised during last year's parliamentary audit regarding the legality of Bithumb's orderbook sharing practices with foreign exchanges.
Bithumb Transferred User Data to Unauthorized Exchange During Orderbook Sharing
The commission's 12th plenary meeting voted to impose a 120 million won fine on Bithumb for violations related to orderbook sharing and a 90 million won fine for violations during digital asset transfers. The investigation revealed Bithumb shared orderbooks with overseas exchanges in the USDT market from September to November last year. Bithumb obtained consent to transfer personal information to Stellar exchange, but the commission confirmed the actual transfer went to BingX, including member information and order information.
Bithumb also transferred users' digital assets to 13 overseas exchanges and provided personal information — including names, wallet addresses, and dates of birth of senders and recipients — to these exchanges for anti-money laundering purposes. The commission determined Bithumb failed to meet some of the legal requirements for cross-border transfer of personal information stipulated in the protection law, including obtaining separate consent from data subjects.
Commission Issues Corrective Order and Blockchain Service Guidelines
The commission issued a corrective order requiring Bithumb to obtain separate consent from data subjects when transferring personal information overseas and to clearly communicate this in its personal information handling policy. The commission acknowledged the necessity of providing personal information for anti-money laundering purposes when transferring digital assets to other exchanges, but determined that cross-border transfer of personal information must strictly comply with the requirements and procedures set forth in the protection law.
The commission established the 'Blockchain Service Personal Information Protection Guidelines' based on blockchain technology characteristics analyzed during the investigation. The guidelines address transparency-related on-chain information disclosure and tracking prevention measures, decentralization-related information sharing management among participants, and immutability-related personal information destruction methods. The commission stated it plans to continue developing necessary standards to ensure personal information protection and safe utilization can coexist in new technology environments while strictly responding to violations of the protection law.
FAQ
What did South Korea's Personal Information Protection Commission do to Bithumb on the 24th?
The commission imposed a total fine of 210 million won on Bithumb for unauthorized cross-border transfer of personal information and issued a corrective order requiring the exchange to obtain proper consent when transferring user data overseas.
Why did Bithumb receive a fine for orderbook sharing with overseas exchanges?
Bithumb obtained consent to transfer personal information to Stellar exchange but actually transferred member information and order information to BingX during orderbook sharing operations from September to November last year, violating cross-border data transfer requirements under South Korea's personal information protection law.
