A supervisory authority has reprimanded several foreign technology companies for failing to meet their obligations regarding the management of data subject rights requests, notably by responding in a foreign language or not responding at all through their local representative.

Facts and context

The South Korean data protection authority, the Personal Information Protection Commission (PIPC), today issued improvement recommendations against Wrtn Technologies, Tesla Korea, Deepseek, OpenAI, and Nike for shortcomings related to the management of data subject rights requests and the role of their local representative.

This case originates from a follow-up audit conducted by the PIPC on companies whose privacy policies were deemed "inadequate" during an assessment carried out in 2025. The audit aimed to verify the effective implementation of corrective measures, particularly regarding the operation of rights exercise channels and the effectiveness of the local representative.

Grounds for the decision

• Obligation to facilitate the exercise of data subject rights: The authority found that three companies did not adequately handle requests made by Korean users. Indeed, Wrtn Technologies did not respond to a rights exercise request. Tesla Korea and Deepseek responded to local users respectively in English and Chinese. The authority considered that responding in a language the data subject does not understand constitutes an obstacle to the exercise of their rights, making communication ineffective and inaccessible.
• Obligation to ensure the effectiveness of the local representative: The investigation revealed that the local representatives of OpenAI and Nike did not effectively handle requests. Contacted by phone, their representatives merely redirected users to an email address, but emails sent to this address went unanswered. The authority considered that this mode of operation undermines the role of the representative, who must be a real and effective contact point for handling complaints and requests, not a mere administrative formality.

Authority's decision

Consequently, the authority recommended that Wrtn Technologies, Tesla Korea, and Deepseek improve their rights request handling system to ensure effective processing in the local language.

Furthermore, the authority recommended that OpenAI and Nike strengthen the management and supervision of their local representative to ensure effective handling of requests addressed to them.

Lessons learned

This decision reminds that:

• Responses to data subject rights requests must be provided in a language understood by the data subject; responding in a foreign language is considered an obstacle to the exercise of rights.
• The designation of a local (or Union) representative is not a mere formality; the company must ensure that the representative has the processes and means to effectively handle data subject requests and complaints.
• Supervisory authorities do not limit themselves to a formal analysis of privacy policies but also verify the operational effectiveness of data protection processes, notably how rights are concretely managed.