Real-time footage captured by robot vacuums inside homes is encrypted and sent directly to the user’s smartphone, without being stored on the service provider’s server. The original voice commands are either processed within the vacuum or converted to text on the server before being immediately deleted.
However, some products failed to fully comply with privacy laws regarding personal information collection, use, international transfers, and access control.
On Monday, the Personal Information Protection Commission announced that after reviewing five major brands of robot vacuums sold in South Korea, no significant risks of personal data breaches were found in the collection, transmission, and storage of video, audio, photos, and mapping data.
The inspection covered the latest models from Roborock, Samsung Electronics, LG Electronics, Ecovacs, and Xiaomi, as of March last year.
Robot vacuums use cameras, microphones, and sensors to detect obstacles and allow users to view their homes remotely or issue voice cleaning commands. This process involves handling internal video and audio, as well as mapping data that reveals the home’s layout.
The commission’s examination of actual data processing revealed that real-time footage viewed by users on their apps is encrypted and transmitted from the robot vacuum to the user’s app, without being stored on the service provider’s server.
Voice commands like “Clean the room” are not stored on the server. Depending on the product, some vacuums process voice commands internally, while others send them to the server for text conversion before immediately deleting the original audio. Users can also delete the converted text.
Photos of obstacles taken during cleaning are temporarily stored on the vacuum or server before deletion, depending on the product. Mapping data showing the home’s layout is stored on the vacuum and not on the user’s smartphone, though some products do store this information on the server.
From International Transfer Notices to Access Control, Some Shortcomings in Personal Data Management Were Identified
The review uncovered instances where certain companies failed to fully meet their obligations under privacy laws during data processing.
Some firms didn’t clearly distinguish between personal information that can be processed without consent for contract fulfillment and data requiring user consent. Cases were found where companies collected and used personal information for service improvement without explicit user permission.
Some companies using overseas data centers failed to properly disclose international data transfers in their privacy policies or provided vague information about data retention periods, using terms like “until the purpose is achieved.”
Certain foreign companies neglected to designate a domestic representative as required by privacy laws, or appointed a non-South Korean entity as their representative.
The review also highlighted security management deficiencies. Some companies showed weaknesses in procedures for managing access rights for personnel handling personal data and in maintaining access logs. The investigation revealed that some firms need to improve encryption processes for access control and data transmission in their robot vacuums.
The Personal Information Protection Commission stated that it has requested improvements from the companies during the review process. Most have either completed the necessary measures or are currently implementing them. Issues related to access control and encryption for the latest models have been addressed, while improvements for other models are ongoing. For unresolved issues, the commission plans to recommend corrective actions and verify compliance.
In the latter half of this year, the commission intends to conduct additional reviews focusing on new features in the latest robot vacuums sold in South Korea to assess potential personal information breach risks.
To address the growing amount of personal data processed by smart home appliances due to artificial intelligence (AI) and Internet of Things (IoT) advancements, the commission will establish a Technology Analysis Center by year-end. This center will empirically analyze personal information breach risks associated with new technologies and services, while expanding pre-emptive checks on products and services closely tied to daily life.