SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Jung-Chull Lee and Ari Yoon, Kim & Chang
• the data subject’s consent; • where processing is expressly authorised by appli - cable law (ie, statutory authorisation); • where processing is necessary for the performance of a contract to which the data subject is a party (ie, contractual necessity); and • where processing is necessary to pursue the legitimate interests of the data controller, subject to applicable statutory limitations (ie, legitimate interests basis). The legal bases applicable to third-party provision of personal information, delegation of processing to a third party, and overseas transfers of personal data are subject to additional requirements and are addressed separately. Please refer to 5.1 Restrictions on International Data Transfers . Regarding data subjects’ rights, under the PIPA, data subjects have a broad set of rights, including: • the right to request access to their personal data; • the right of data portability; • the right to request rectification, deletion and sus - pension of processing; and • the right to withdraw consent. They also have the right to object to the automated decision-making and to request an explanation of how such processing is carried out. Under the Credit Information Act, credit data subjects have: • the right to request data portability; • the right to be notified of the credit information based on which a transaction refusal was based; • the right to request explanations of, and raise objections to, the results of automated assess - ments; • the right to withdraw consent to the transfer of personal credit information; and • the right to request cessation of contact. Credit data subjects may also request notification of credit inquiry records, free access to their credit infor - mation, and disclosure or access to information con -
cerning changes in creditors related to their personal credit information. Under the Location Information Act, personal location information subjects have: • the right to withdraw consent; • the right to request suspension of processing; and • the right to request access to, notification of, and correction of their personal location information. For compliance, the data controller must establish and rely on an appropriate legal basis correspond - ing to each type of personal data-processing activ - ity. In addition, the PIPA requires data controllers to implement technical, administrative and physical security measures necessary to ensure the security of personal data in accordance with the Standards for Measures to Ensure the Security of Personal Informa- tion , a notice published by the PIPC. Data controllers are also required to establish and publicly disclose a privacy policy that accurately describes their personal processing practices to ensure transparency. 1.3 Special Categories of Personal Data Under the PIPA, special categories of personal data are: • sensitive information; and • unique identification information. Sensitive information is personal information relating to an individual’s ideology or beliefs, membership in or withdrawal from a labour union or a political party, political opinions, health or sex life, genetic informa - tion, criminal history, biometric data used for iden - tification purposes, and race or ethnicity, where the processing of such information may seriously infringe upon one’s privacy. Unique identification information includes resident registration numbers, passport numbers, driver’s licence numbers, and foreigner registration numbers. Because both sensitive information and unique identi - fication information are subject to heightened protec - tion (ie, requiring separate legal bases and enhanced
435 CHAMBERS.COM
Powered by FlippingBook