SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Ari Yoon and Jisoo Yoo, Kim & Chang
2.2 Recent Case Law Major lawsuits related to privacy in 2023–2024 were as follows. • As explained in 1.4 Data Protection Fines in Practice , in 2022, the PIPC imposed an administrative penalty of around KRW100 billion in total to two online platforms on the ground that they did not obtain legitimate consent from users processing their personal information for personalised advertising purposes. The two online platforms have filed a lawsuit, which is pending, seeking revoca - tion of the disposition imposed by PIPC. As regulations on the collection of behavioural data and the use of personalised advertis - ing are being tightened in other jurisdictions such as the EU, this case is the first decision in Korea regarding the collection and use of behavioural data on personalised online advertising platforms, drawing keen attention to the outcome of the court’s decision. • In 2019, PIPC imposed an administrative penalty of about KRW1.8 billion on an online shopping mall for a data breach. In 2023, the Supreme Court rendered a decision in this regard. This decision sets forth for the first time the scope of the “relevant revenue”, which forms the basis for calculating the administrative penalty, and the factors to be considered in determining the amount of administrative penalty, in imposing an administrative penalty for a data breach. More specifically, in the context of a data breach, the Supreme Court ruled that the calcula - tion of the relevant revenue for imposing the administrative penalty should be based on the scope of services for which the affected personal information is retained and man - aged, taking into account that it is difficult to calculate the profits generated from the viola - tion at issue.
comply with the PIPA in the course of plan - ning new technologies or services such as AI, the service provider and the PIPC will work together to come up with a plan to apply the PIPA, which is appropriate for the processing environment, to resolve legal uncertainties. • For other requests for legal interpretation of AI technology, PIPC will provide legal inter - pretation on a case-by-case basis.
2. Privacy Litigation 2.1 General Overview
The amount of administrative penalties imposed for violations of the PIPA has increased signifi - cantly, and the number of administrative law - suits filed against PIPC has been increasing. The amount of administrative penalties imposed and the number of lawsuits filed by PIPC has been gradually increasing as follows. In 2020: KRW2.9 billion – five lawsuits; in 2021: KRW9.1 billion – four lawsuits; in 2022: KRW102.5 billion– one lawsuit; and in 2023: KRW23.3 billion – eight lawsuits. Moreover, as explained in 1.3 Enforce- ment Proceedings and Fines , the amendment to the PIPA has changed the threshold for admin - istrative penalties, which is expected to further increase the number of administrative lawsuits filed against the PIPC. Meanwhile, the courts, like the PIPC, acknowl - edge jurisdiction in cases where overseas service providers provide services to domes - tic users. The major lawsuits explained in 2.2 Recent Case Law also include a number of cases where foreign service providers that were subject to PIPC’s dispositions have objected and filed lawsuits against the PIPC.
392 CHAMBERS.COM
Powered by FlippingBook