SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Jung-Chull Lee and Ari Yoon, Kim & Chang
• the method and procedure for withdrawing consent if the data subject does not wish their personal information to be transferred. In principle, the business transferor must provide the above information in writing (eg, written document, email, fax, phone, text message or any other equiva - lent method). However, if the business transferor is unable to provide such information in writing without negligence, the business transferor must publish this information on a website for at least 30 days. If there is a justifiable reason for not being able to publish the above information on a website, the business trans- feror must: • publish the above information in an easily visible location within the business transferor’s place of business for at least 30 days; or • publish it in a daily newspaper that is mainly dis - tributed in the city, province or region where the business transferor’s place of business is located. The business transferee has the same notification obligation as the business transferor. However, if the notification has been provided by the business trans - feror, the business transferee is not required to pro - vide one. Meanwhile, a business transferee that has received personal information as part of a business transfer or merger may use the personal information or provide it to a third party only for the original purpose for which it received the information.
• where personal information is stored overseas and/ or personal information processing is delegated to an overseas entity because it is necessary for the execution and performance of an agreement with the data subject, and certain information regarding the overseas transfer (storage/delegation) is dis - closed to the data subject, through either the data controller’s privacy policy or other written means such as email; • where the recipient party located overseas has obtained certification from the PIPC, and has taken measures to ensure that personal information and rights of data subjects are protected and to imple - ment the matters subject to certification in the destination country; or • where the PIPC has recognised the adequacy of the level of the privacy protection provided in the destination country. In the case of international data transfers, the data controller must consult with the recipient and reflect the following in the relevant agreement: • measures to ensure safety for protecting personal information under the PIPA; • measures to handle grievances and resolve dis - putes with respect to personal information breach - es; and • other measures necessary to protect the personal information of data subjects. Third-Party Transfers Separate from such regulation regarding overseas transfers, transferring personal information to a third party outside Korea for the purpose of either provid - ing personal information to a third party or delegating the processing of personal information also consti - tutes third-party provision or delegation of processing of personal information under the PIPA, respectively – these are subject to the relevant provisions of the PIPA in addition to the above-mentioned regulation on overseas transfer. Third-party provision occurs where a data controller provides personal information to a third-party recipient for the purpose and benefit of the third-party recipient. Delegation occurs where a third-party entity processes personal information that it receives from the data controller for the purpose and benefit of the data controller.
5. International Considerations 5.1 Restrictions on International Data Transfers
Under the PIPA, a data controller may transfer per - sonal information overseas (ie, provide, delegate the processing of, or store personal information with an overseas entity) only on one or more of the following grounds: • where the data controller obtains separate consent from the data subject; • where there is specific authorisation by treaty or other international agreement;
444 CHAMBERS.COM
Powered by FlippingBook