SOUTH KOREA Trends and Developments Contributed by: Hwan Kyoung Ko, Sunghee Chae, Kyung Min Son and Matt Younghoon Mok, Lee & Ko
evaluate whether an organisation has systematically established and operates measures and activities for information security and personal data protection. Under the previous regime, obtaining ISMS-P certifi - cation was generally voluntary for most data control - lers and was often pursued to enhance external cred - ibility regarding the robustness of their data protection practices. By contrast, the Amended PIPA now requires data controllers meeting prescribed thresholds to obtain ISMS-P certification as a statutory obligation. The applicable thresholds will be determined by Enforce - ment Decree, taking into account factors such as turn - over and the scale of personal data processing. The PIPC has also indicated that it may actively consider revocation of ISMS-P certification in cases involving serious violations relating to personal data protection. Restructuring of the personal data breach notification regime The Amended PIPA revises the notification regime applicable to personal data breaches by expand - ing the scope of personal data breaches subject to notification and broadening the content of required notifications. These changes affect both the timing and scope of notification obligations imposed on data controllers. Expansion of the scope of personal data breaches subject to notification (Article 23, paragraph 2 and Article 34, paragraph 1) Before the Amended PIPA, notification to data subjects was required where breached personal data had been “lost, stolen or leaked”. The Amended PIPA expands the scope of personal data breaches to include cases of “forgery, alteration or damage” to personal data. Introduction of notification obligation in cases of potential personal data breach (Article 34, paragraph 2) The Amended PIPA introduces a new obligation to notify data subjects even where an actual personal data breach has not yet been conclusively confirmed. Where a data controller becomes aware of a possibil - ity of a personal data breach – as determined under
Enforcement Decree with reference to the type of per - sonal data involved, the potential impact on data sub - jects and the level of risk – the data controller must, without delay, notify all affected data subjects of such possibility and provide information necessary to mini - mise harm. Expansion of notification content (Article 34, paragraph 1) In addition to the existing notification items required, the Amended PIPA further requires data controllers to inform data subjects of: • information concerning their legal rights and avail - able methods of exercising such rights, including claims for damages and statutory damages arising from the personal data breach; and • other matters to be prescribed by Enforcement Decree. Introduction of an aggravated administrative penalty regime of up to 10% of total turnover The Amended PIPA revises the administrative pen - alty framework by introducing an aggravated penalty of up to 10% of total turnover in specified cases of repeated or serious violations, while also establishing a statutory basis for mandatory mitigation in certain circumstances. Introduction of an aggravated administrative penalty of up to 10% of the total turnover (Article 64-2, paragraph 2) Under Article 64-2, paragraph 1 of the PIPA, where a violation subject to an administrative penalty occurred, the PIPC was authorised to impose an administrative penalty of up to 3% of the total turnover, excluding turnover unrelated to the violation. Where turnover was absent or difficult to calculate, the maximum administrative penalty was KRW2 billion (approxi - mately USD1.4 million). The Amended PIPA introduces Article 64-2, paragraph 2, pursuant to which an administrative penalty of up to 10% of the relevant total turnover, excluding turnover unrelated to the violation, may be imposed, or up to KRW5 billion (approximately USD3.5 million) where turnover is absent or difficult to calculate, in the fol - lowing circumstances:
449 CHAMBERS.COM
Powered by FlippingBook