SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Jung-Chull Lee and Ari Yoon, Kim & Chang
By contrast, for non-personal information, there are no general laws or regulations that grant similar rights or obligations. For example, although public institu - tions are generally required to disclose most of their data for free use (with some exceptions), this require - ment does not extend to private companies. Also, the government may recommend that cloud service providers establish co-operation frameworks to pro - mote interoperability, though such recommendations are not legally binding. Therefore, companies should distinguish personal information from non-personal information and tailor compliance efforts accordingly. 3.4 Regulators and Enforcement As explained in 1.7 Regulators , the key regulatory authorities include the PIPC, KMCC, KISA, FSC and MSIT. If multiple laws apply to a given matter, these regulators may exercise regulatory authority concur - rently. For instance, as noted in 1.6 Data Breach Requirement , recent cases have involved simultane - ous investigations by the PIPC, KISA and MSIT’s joint private-public task force into cyber-incident and data breaches. The PIPA does not require data controllers to obtain users’ consent for the installation of cookies, nor does it restrict the use of cookies. However, if the informa - tion collected through cookies qualifies as personal information – defined by the PIPA as information that can be easily combined with other information to identify an individual – it falls under the PIPA’s regula - tions, and legal basis such as explicit opt-in consent is required. The PIPA also obligates data controllers to state “matters concerning the installation, opera - tion and refusal of a device that automatically collects personal information, such as an internet access data file” in their privacy policies – ie, data controllers are obligated to state such matters when installing and operating a device that automatically collects person - al information such as a cookie or similar technology on their own web or app. 4. Sectoral Topics 4.1 Use of Cookies Please refer to 4.2 Personalised Advertising and Other Online Marketing Practices for enforcement
trends related to behavioural information collected through cookies. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised Advertising In the absence of specific statutory regulations regarding the processing of behavioural data for per - sonalised advertising, the general legal principles of the PIPA apply if such information is considered per - sonal information. That is, if online identifiers used for targeted advertising, along with the behavioural information collected, can be combined to person - ally identify individuals, this information is classified as personal information. Consequently, to collect and use this behavioural data for personalised advertising, the legal requirements for processing personal infor - mation – such as securing legitimate legal grounds for processing – must be met. Conversely, if the behavioural data does not enable the identification of specific users, it is not considered personal information under the PIPA. In this scenario, PIPA regulations do not apply, though the PIPC rec - ommends implementing safety measures. Online Marketing Practices In order to send marketing communications via an electronic medium such as email or SMS, data con - trollers must obtain from the data subject: • consent to processing their personal information for marketing purposes pursuant to the PIPA; and • consent to receiving marketing communications in accordance with the Network Act. Data controllers are required to comply with certain formality requirements to clearly show that the infor - mation is an advertisement, and separate consent from the data subject is required for night-time trans - mission. Children’s Data As explained in 1.3 Special Categories of Personal Data , the PIPA generally requires data controllers to obtain consent from a legal guardian when obtain - ing consent for processing personal information of children under 14. Moreover, when providing notices
442 CHAMBERS.COM
Powered by FlippingBook