"Robot Vacuum Data Management Generally Safe... Corrective Actions Recommended for Deficiencies"
Personal Information Protection Commission Inspects Five Robot Vacuum Brands
No Risk of Data Breaches Found in Video, Audio, or Photo Collection
Deficiencies Noted in Data Collection Notices, Cross-border Transfers, and Appointment of Local Representatives
Additional Inspections and Technology Analysis Center Planned for Second Half of Year
The Personal Information Protection Commission announced on September 14 that it had inspected the personal information processing practices of major robot vacuum cleaners sold in Korea, and found deficiencies in areas such as the provision of information regarding data collection and use, notification of cross-border data transfers, and the appointment of domestic representatives. The commission said it will issue recommendations for corrective action.
The inspection covered the latest models from five brands: Roborock, Samsung Electronics, LG Electronics, Ecovacs, and Xiaomi. The commission focused on the processes by which video, audio, photos, and mapping data are collected, transmitted, stored, and used via the robot vacuum, related smartphone applications, and servers.
The investigation found no significant risk of information breaches in the collection or transmission of core data processed by the robot vacuums. Although there were detail differences by brand, real-time video was encrypted and sent directly to the user's app without being stored on the company server. Voice command recordings were either deleted immediately or processed internally within the device without being stored on the server. Obstacle photos were temporarily stored on the server but were deleted after 24 hours or by the next cleaning session. Mapping information, by default, was stored only on the device itself.
However, there were some omissions and procedural shortcomings concerning mandatory requirements under the Personal Information Protection Act. Some companies did not distinguish between personal data processed without user consent for contract fulfillment and data requiring user consent, but bundled them together in the notices provided. In addition, when collecting data for service improvement purposes, some companies did not allow users to choose in advance whether to consent, thereby restricting users' right to choose. Other issues included failure to separately notify users about cross-border transfers of personal data to overseas data centers, vague guidance on retention periods for personal data, inadequate appointment of domestic representatives for overseas businesses, and insufficient control and monitoring of personal data processor access rights and access logs.
Hot Picks Today
Despite "Insufficient Balance" Notices, They Board Anyway... Reports of Foreign Fare Evasion Mounting
- "If It Helps My Child's Studies, It's Worth Every Penny"... U.S. Parents Open Their Wallets for $10,000 Tests
- [Exclusive] "We Came for a KRW 140,000 Trip": Following Chinese Tourists in Korea Uncovers a 'Suspicious' Tour
- "I'm paying to stay, and you want me to do the laundry and dishes too?" ... Airbnb bans excessive cleaning demands
- "Baek Jongwon Had Been Quiet, Then Hit It Big"... Waits in the 100s in U.S. Despite KRW 46,000 Pork Belly
The commission plans to recommend corrective action for issues that have not yet been remedied and will verify the outcome of these measures. In the second half of this year, it will conduct additional inspections focusing on new features of the latest robot vacuum models. The commission also plans to launch a "Technology Analysis Center" by the end of the year to analyze emerging threats to privacy posed by new technologies and services. An official from the commission stated, "We will expand proactive, prevention-focused inspections and improvements of personal information processing in products and services closely tied to daily life."
© The Asia Business Daily. All rights reserved. Unauthorized AI training and use prohibited.
