SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Jung-Chull Lee and Ari Yoon, Kim & Chang
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws The Personal Information Protection Act (PIPA) is the overarching privacy legislation in Korea. Other stat - utes governing particular types of personal informa - tion include the Credit Information Use and Protec - tion Act (the “Credit Information Act”) and the Act on the Protection and Use of Location Information (the “Location Information Act”). The Act on Promotion of Information and Communications Network Utilisation and Information Protection, etc (the “Network Act”) also deals with some privacy issues, such as sending advertising information, appointing a Chief Informa - tion Security Officer and issuing certification for infor - mation security management systems. While Korean constitutional law does not expressly guarantee rights related to personal information, the Constitutional Court’s position is that the right to self- determination of personal information derives from general personality rights, and the right to privacy and freedom and is thus protected under the Constitution. The National Assembly passed the proposed bill for the Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Reliability (the “AI Framework Act”), which was set to take effect on 22 January 2026. This statute is Korea’s first foundational law in the field of AI, aiming to ensure transparency and safety by imposing various obliga - tions on AI service providers. Regarding extraterritorial reach, both the Network Act and the AI Framework Act expressly provide for extraterritorial application, and they apply to acts con - ducted outside Korea if such acts affect the Korean market or users (see Article 5-1 of the Network Act and Article 4 of the AI Framework Act). By contrast, the PIPA does not contain an explicit pro - vision on extraterritorial application. Nevertheless, the Personal Information Protection Commission (PIPC) explains in its Guideline on the Application of the PIPA to Overseas Business Operators (published in April 2024) that the applicability of the PIPA should be assessed by reference to factors such as:
• whether goods or services are offered to Korean data subject; • whether the relevant activities have an impact on Korea or on Korean data subjects; and • whether the business has an establishment within Korean territory. 1.2 Rights and Obligations The PIPA establishes the following general principles governing the processing of personal data. • Purpose specification and data minimisation: the purpose of processing must be clearly specified and personal data may be collected lawfully only to the extent necessary to achieve that purpose. • Purpose limitation: personal data must be pro - cessed within the scope of the stated purpose of collection. Any use beyond that purpose is prohib - ited. • Data accuracy: data controllers must ensure that personal data is accurate, complete and kept up to date, and must maintain appropriate controls to that end. • Security safeguards: data controllers must imple - ment appropriate technical and administrative measures by taking into account the level of risk associated to ensure the secure processing and management of personal data. • Transparency and protection of data subject rights: data controllers must make their privacy policies publicly available and ensure the effective exercise of data subject rights, including the right of access. • Minimisation of privacy intrusion: processing activi - ties should be designed to minimise infringement of data subjects’ privacy. • Anonymisation or pseudonymisation: where anonymisation is feasible, anonymised data should preferably be used; if not, personal data should be pseudonymised. • Accountability and trust: data controllers should build trust with data subjects through compliance with and faithful implementation of their statutory obligations. The legal basis on which a data controller may rely varies depending on the type of personal data pro - cessing. For the collection and use of personal data, permissible legal bases include (among others):
434 CHAMBERS.COM
Powered by FlippingBook