SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Ari Yoon and Jisoo Yoo, Kim & Chang
ies, nor does it restrict the use of cookies. How - ever, if the information collected through cook - ies qualifies as personal information – defined by the PIPA as information that can be easily combined with other information to identify an individual – it falls under the PIPA’s regulations. For example, the PIPA obligates data control - lers to state “matters concerning the installation, operation, and refusal of a device that automati - cally collects personal information, such as an internet access data file” in their privacy policies – ie, data controllers are obligated to state such matters when installing and operating a device that automatically collects personal information such as a cookie or similar technology on their own web or app. Please refer to 4.2 Personalised Advertising and Other Online Marketing Practices for enforce - ment trends related to behavioural information collected through cookies. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised Advertising In the absence of specific statutory regulations regarding the processing of behavioural data for personalised advertising, the general legal principles of the PIPA apply if such information is considered personal information. That is, if online identifiers used for targeted advertising, along with the behavioural information collected, can be combined to personally identify individu - als, then this information is classified as personal information. Consequently, to collect and use this behavioural data for personalised advertis - ing, the legal requirements for processing per - sonal information, such as securing legitimate legal grounds for processing, must be met. Conversely, if the behavioural data does not enable the identification of specific users, it is
not considered personal information under PIPA. In this scenario, PIPA regulations do not apply, but the PIPC recommends implementing safety measures. Additionally, the PIPC is developing comprehensive guidelines for collecting behav - ioural data for customised advertising, which are expected to be released in early 2025. Online Marketing Practices In order to send marketing communications via electronic medium such as email or SMS, data controllers must obtain from the data subject (i) consent to processing their personal information for marketing purposes pursuant to the PIPA, and (ii) consent to receiving marketing commu - nications in accordance with the Network Act. Data controllers are required to comply with cer - tain formality requirements to clearly show that the information is an advertisement, and for night time transmission, separate consent from the data subject is required. 4.3 Employment Privacy Law There are no specific regulations or considera - tions exclusively for processing employees’ personal information; instead, the general pro - visions of the PIPA apply. Apart from general provisions of the PIPA, below are examples of instances where other related laws may become relevant. • Automated decision-making: During recruit - ment, if an applicant is disqualified based on AI analysis of their personal information, such as through AI interviews or application form assessments, it may involve automated decision-making as described in the regula - tions on AI. If this disqualification significantly impacts the applicant’s rights or obligations, they may have the right to refuse and request an explanation regarding the decision.
396 CHAMBERS.COM
Powered by FlippingBook