Antitrust, privacy regulators in South Korea in subtle competition over digital-ad regulation

Gone are the days in when no one was held accountable for anything in the digital-advertising market.

The issue of digital advertising has recently been thrust into the spotlight by regulators in Europe, Asia and elsewhere, which are gearing up to regulate these unregulated markets that are expanding rapidly and beginning to enrich a handful of tech giants.

South Korea is no exception. The country's antitrust authority is undertaking a preliminary study before ramping up its enforcement operations in this area. Also throwing its hat into the ring is the country's privacy regulator, which is keenly monitoring data-gathering practices of ad platforms and other businesses to uncover privacy violations.

The increased focus on digital advertising by the two regulators is beginning to raise questions about which one will ultimately come out on top in exercising oversight responsibility for the sector. So far, the answer is unclear because their inquiries are still at an early stage. But what is known is that a subtle rivalry between the two is emerging, MLex has been told.

Antitrust regulator’s digital-ad agenda

The ambition of the Korea Fair Trade Commission, or KFTC, to take the lead in regulatory oversight of digital advertising first became known through dawn raids it conducted earlier this year on Facebook and Google, two of the digital-ad juggernauts with significant market power.

The purpose of the raids was largely kept under wraps until the regulator acknowledged for the first time at a press briefing in May that it had begun looking into ad-tech businesses. Since then, the KFTC has been very explicit about its intention to “counteract unfair trade practices emanating from ad platforms’ expanding dominance in these emerging markets.”

Having established a new unit dedicated to investigating the markets under its ICT taskforce, the antitrust watchdog is currently dissecting the nuts and bolts of how digital advertising is done, who shapes the fabric of the market, who has the upper hand and how they do business.

Terms and conditions of local and foreign ad-tech firms are being juxtaposed and compared, in-depth interviews are being conducted with executives and employees at advertisers, advertising agencies and publishers. In addition, examples of ad-tech regulation in other jurisdictions are being studied — all to uncover industry practices that undermine competition. Some of the practices may include unfair customer inducements, tying, self-preferencing or unreasonable restrictions on their competitors’ transactions, the KFTC has said.

While all of this involves standard issues for the KFTC, the regulator is also exploring matters that don't normally fall under its purview — data collection and the entailing privacy risks. It said it is scrutinizing how ad-tech firms collect, link and combine user data — the types of user-data tracking tools used, the methods for combining various sources and types of data and the amount of control users have over their personal information — for use in targeted advertisements, which are at the heart of digital advertising.

Privacy regulator takes a quieter approach

Meanwhile, the privacy regulator has largely been silent, all the while having a plan in the works to regulate the digital-ad markets.

Only when asked by MLex did it say that it is aware of the privacy risks associated with digital advertising and is “paying close attention” to potential breaches.

It appears the Personal Information Protection Commission, or PIPC, is doing a preliminary study of the markets from the perspective of privacy regulations, although not as extensively as the KFTC. Other than that, nothing else is known about the PIPC's efforts in this area.

Targeted advertising entails businesses quietly siphoning off and compiling large amounts of users’ behavioral data across the web or mobile apps through cookies or other tracking technologies to build up their profile and make inferences about the types of products and services they are likely to purchase. These activities undoubtedly fall under the scope of the Personal Information Protection Act, or PIPA, which is administered by the PIPC and governs how data should be collected, managed and distributed.

The regulator would be most concerned about whether behavioral data collected by ad platforms, such as users' browsing histories, what they click on, the content they create and share, and their location, run the risk of revealing their identities, especially when combined with other personal information such as email addresses or phone numbers, and whether this results in any violations of the country’s privacy regime.

Is a turf war brewing?

If the PIPC has the PIPA on its side, the KFTC, which is likely to approach the data issue from the standpoint of consumer protection, may soon have a legal basis available for regulatory intervention in matters relating to data.

In the sweeping revision to the E-Commerce Law by the KFTC, the regulator inserted a new clause that will require e-commerce businesses to ask users' permission when they want to offer targeted ads and notify users of ad content. The revision, which seeks to enhance the liability of online businesses, could serve as a legally binding instrument to prevent large platforms from misusing the personal information of consumers.

The E-Commerce Law revision is being re-drafted after the KFTC received feedback on a draft bill during the public consultation period.

With some overlap inevitable as both the KFTC and the PIPC attempt to regulate ad-tech businesses and their data-gathering practices using their respective legal tools, the question boils down to this: Which regulator will eventually take the lead in oversight of the digital-ad markets and curb the power of tech heavyweights such as Facebook and Google?

For now, it is too early to know the answer.

Experts highlight that it’s only the start of something big, with a market status check being conducted by both regulators for the first time ever — even though digital advertising has been around for more than 20 years.

One thing to note, however, is that the KFTC is much more powerful than the PIPC, which was established in August of last year. In contrast, the KFTC has been the primary enforcer of competition and consumer protection laws for the past 40 years. Therefore, the privacy regulator may lack the resources, manpower and experience to get a handle on the complicated digital-ad markets, although it has sufficient reasons to keep them in check.

There is currently no open conflict between the two regulators, but it is unclear how long this will last. Experts predict that their respective desires to seize the lion's share of regulatory jurisdiction, taking authority over data-equipped ad platforms, will only grow stronger, because online ad markets offer a plethora of opportunities for regulation and law enforcement.

This dynamic involving different regulators is playing out in other countries such as Japan, which is a few steps ahead of South Korea in digital-ad regulation. Four different agencies in Japan — the Japan Fair Trade Commission, the Personal Information Protection Commission, the Ministry of Economy Trade and Industry and the Ministry of Internal Affairs and Communications — all want to regulate a portion of the digital-ad sector.

— Additional reporting from Sachiko Sakamaki and Toko Sekiguchi.