Exclusive
Controversy Over 'Privacy Infringement' at KakaoMap, Suspected Violation of Enforcement Decree of the Information and Communications Network Act

[비즈한국] Kakao035720, which previously received a recommendation from the Personal Information Protection Commission (PIPC) to improve its personal data processing practices after exposing the private information of KakaoMap users, is now suspected of violating smartphone app access permission regulations once again. It has been revealed that when using KakaoMap on an iPhone, users must set photo access permissions to "Full Access" to upload photos. In response, the Korea Communications Commission (KCC) stated that it would review whether this practice violates the Enforcement Decree of the Information and Communications Network Act.

KCC Specifies ‘Minimization of Smartphone App Access Permissions’

In 2017, as cases of smartphone app providers leaking user personal information or gaining unauthorized access to information within smartphones increased, authorities enacted the Information and Communications Network Act. While releasing related guidelines, the KCC specified that businesses must "minimize" smartphone app access permissions. According to the Smartphone App Access Permission Personal Information Protection Guidelines, app service providers must minimize permissions to access information within the smartphone. In particular, it stipulated that they must distinguish between essential access permissions, which are strictly necessary for providing the service, and optional access permissions, which are not.

However, through reporting by Bizhankook, it was revealed that KakaoMap has been operating in a way that forces iOS (iPhone) users to set access permissions to "Full Access." iOS users must grant full access to their photo library to upload images for services such as KakaoMap reviews.

While iOS settings allow for setting photo library access to "Limited Access," doing so makes image uploads impossible. When "Full Access" is granted, the iOS system displays a notification stating, “Photos may contain metadata such as location, depth information, captions, and audio.” In contrast, Android users are able to upload images even when set to limited access.

KCC: “Review of Enforcement Decree Violation Planned”

Other map and social media apps, including Naver035420 Map, Instagram, and X (formerly Twitter), allow iOS users to upload photos even when photo library settings are restricted to "Limited Access."

Services like TMAP and Google Maps have adopted new technologies to remove the "Full Access" option entirely. They have implemented a method that only accesses the specific photos selected by the user when uploading an image. Smartphone users do not need to configure separate settings. In this case, a notification appears stating, “Your photo library may appear in this app, but this app can only access the photos and videos you select.”

App businesses explained that they are using only the minimum necessary access permissions in accordance with the Enforcement Decree of the Information and Communications Network Act. A TMAP Mobility official explained, “The KCC’s Smartphone App Access Permission Personal Information Protection Guidelines recommend preventing privacy infringement caused by excessive app access permissions. TMAP Mobility is taking personal information protection measures accordingly.” A Naver official also stated, “We are obtaining user consent and using only the access permissions strictly necessary to provide app services in accordance with relevant laws and regulations.”

On the other hand, because KakaoMap requires users to set permissions to "Full Access" to upload photos, the KCC has begun reviewing whether this constitutes a violation of the Enforcement Decree of the Information and Communications Network Act. An official from the KCC’s Broadcasting and Communications User Policy Bureau stated, “We have been continuously monitoring whether businesses are violating the Smartphone App Access Permission Personal Information Protection Guidelines, and this is the first time we have learned of the KakaoMap case. We will review whether it violates the enforcement decree. We have received an oral explanation from Kakao and have requested a written response.”

While acknowledging that it does not provide a limited access option to iPhone users, Kakao explained that this does not constitute a violation of the law. A Kakao official explained, “While access permissions can be set selectively on Android, there are aspects of the iOS operating system that make it difficult for users to have a smooth experience when using selective access. We are guiding users to set permissions according to each mobile operating system and are complying with relevant laws and guidelines. However, we plan to improve this for user convenience in the future.”

In 2022, Kakao received a recommendation from the Personal Information Protection Commission (PIPC) to improve its personal data processing. This was because KakaoMap users who created folders for lists of places of interest had the default setting for items set to "public." At the time, Kakao issued a statement saying, “We apologize for the inconvenience and concern caused. We will switch all existing public folders to private.”