B. Main Topics 1) Problems of Customized Advertising from the Information and Communication Technology and Human Rights Perspectives A) Personal Information Protection Commission’s Decision to Impose Fine on Multi-National Corporations A global IT company changed its privacy policy in Korea on May 26 and included the collection of personal information, such as third-party behavioral information for customized advertising, in the “mandatory consent”686) section. The company stated that this was necessary to provide customized information, such as advertisements or news through algorithms, and announced that Facebook and Instagram could not be used from June if consent is not provided. Civil groups criticized the company’s actions through a press conference, saying that they amounted to unlawful consent.687) On Sep. 14, the Personal Information Protection Commission judged that company G and M violated Article 39-3(1) of the ‘Personal Information Protection Act,’688) and imposed a penalty of 69.2 bil. KRW on company G and 30.8 bil. KRW on company M, along with an order to correct the violation.689) The investigation and disposition are the first sanctions related to the collection and use of behavioral information690) of the online customized 686) When collecting user's personal information, the business operator divides it into mandatory consent items (personal information that is absolutely necessary to provide the service) and optional consent items (personal information requested from users due to additional functions of the service or business operator's needs), and consent must be obtained for each (Personal Information Protection Commission, “Guidelines for Consent to Processing Personal Information”, March 2022). 687) Yonhap News, “Why do I have to consent to everything?…Controversy over user information collection by Facebook and Instagram,” Jul. 24, 2022 688) 「Personal Information Protection Act」 Article 39-3 (Special Cases on Consent to the Collection and Use of Personal Information) ① Notwithstanding Article 15 (1), an information and communications service provider who intends to collect and use personal information of users shall notify users of the following matters and obtain consent therefor. The same shall apply when changes are made for the following matters: 1. The purpose of the collection and use of personal information; 2. Particulars of personal information to be collected; 3. The period for retaining and using personal information. 689) Company M announced on July 28, 2022, before the decision of the Personal Information Protection Commission, that it had decided to withdraw the mandatory consent process. However, regarding the Personal Information Protection Commission's decision to impose a penalty, the Company M said, "We cannot agree with this decision, and we plan to carefully review the matter while leaving all possibilities open, including the court's decision," suggesting that it will proceed with administrative litigation. 690) Online user activity information (Korea Communications Commission, Korea Internet & Security Agency, “Online 285