News and developments
Second Major Amendment to the Personal Information Protection Act Passed by National Assembly (I)
The legislative purpose of the Amended PIPA is to facilitate the use of personal information while strengthening the protection of data subjects’ rights and ensuring compatibility and interoperability with the global regulatory regime in the advent of the digital economy. Accordingly, the Amended PIPA contains some significant changes in terms of substance.
In a series of 3 newsletters, we will take a closer look at some of the key provisions of the Amended PIPA as set out below.
In this first newsletter, we review some of the key provisions of the Amended PIPA relating to the processing of personal information in general. Companies are advised to pay close attention to these provisions as they differ in certain respects to the previously proposed amendments thereto that were proposed by the Korean government back in January 2021 (the Government Proposal).
If you have any questions regarding this article, please contact below: Kwang Bae PARK ([email protected]) Jong soo (Jay) YOON ([email protected]) Hwan Kyoung KO ([email protected]) Sunghee CHE ([email protected]) Kyung Min SON ([email protected]) For more information, please visit our website: www.leeko.com
[1] Initially, the Government Proposal only stated a maximum administrative penalty amount of 3% of total sales revenue, which was subsequently changed, after the public commentary period, to permit the exclusion of any sales revenue unrelated to the activity in violation of the PIPA.
l Newsletter No. 1: Provisions relating to the processing of personal information in general - Unification of data protection rules for offline and online businesses - Revamping of provisions relating to administrative penalties and criminal penalties - Easing of requirements for the processing of personal information - Revamping of provisions relating to the mediation of disputes involving personal information l Newsletter No. 2: Provisions relating to the processing of special categories of personal information - Revamping of provisions relating to visual information processing devices - Introduction of rights relating to automated decision-making - New rules for cross-border transfers of personal information l Newsletter No. 3: Provisions relating to the right to data portability |
-
Unification of data protection rules for offline and online businesses
-
Revamping of provisions relating to administrative penalties and criminal penalties (Articles 64-2 and 71 ~ 73)
- Consolidation of administrative penalty provisions
- Changing the upper limit of administrative penalties
- Revamping of criminal penalty provisions
-
Easing of consent requirements for the processing of personal information
- The current PIPA provides that personal information may be collected and used without the data subject’s consent in cases where such collection/use is “unavoidably necessary” for entering into and performing a contract with such data subject. However, the phrase “unavoidably necessary” will be deleted from the relevant provision (Art. 15(1)(iv)) in the Amended PIPA, thereby reducing the excessive reliance on the data subject’s consent as a legal base for the collection/use of personal information.
- In addition, the current PIPA provides that personal information may be used/provided beyond consented purposes if there exists a clear and urgent need to protect the life, physical body or economic interest of the data subject or a third party, and consent for such use/provision cannot be obtained because the data subject or his/her legal representative is unable to express his/her intent or his/her address is unknown. However, the phrase “and consent for such use/provision cannot be obtained because the data subject or his/her legal representative is unable to express his/her intent or his/her address is unknown” will be deleted from the relevant provision (Art. 18(2)(iii)) in the Amended PIPA, thereby easing requirements for the use/provision of personal information without consent in cases where there is an urgent need to protect the lives of individuals.
- Lastly, the Amended PIPA will contain newly created provisions (Art. 15(1)(vii) and Art. 18(2)(x)) that will permit the collection/use of personal information without consent and the collection/provision of personal information beyond consented purposes if urgently necessary to ensure public safety and well-being, including public health (e.g., prevention of the spread of COVID-19 and other infectious diseases).
-
Revamping of provisions relating to the mediation of disputes involving personal information
- The scope of data controllers obligated to participate in mediation by the PIDMC (Art. 43(3)) has been expanded from public institutions (under the current PIPA) to data controllers in general.
- Committee members of the PIDMC and public officials belonging to related organizations will be granted new authority to conduct relevant fact-finding by visiting locations related to the dispute to conduct investigations and view relevant materials (Art. 45(2),(3)).
- Other amendments
- If a data controller determines that there is a risk of privacy infringement due to the inclusion of sensitive information in the information that will be disclosed in the course of providing goods/services, such data controller will be required to provide data subjects with prior notice of (i) the possibility that their sensitive information may be disclosed and (ii) the methods on how to choose not to disclose their sensitive information (Art. 23(3)).
- New obligation imposed on data controllers to destroy pseudonymized information in their possession (Art. 28-7).
- An evaluation system for privacy policies will be introduced which will allow them to be assessed for compliance with applicable requirements, including whether privacy policies have been prepared/disclosed in a manner easily understandable/viewable by data subjects, and provide for the recommendation of improvements (Art. 30-2).
- The PIPC will be granted discretion to specially reduce or waive any administrative fines it has imposed after considering extenuating circumstances such as the severity/motivation/results of the activity in violation of the PIPA and the scale of the data controller’s business operations (proviso to Art.75(5)).
If you have any questions regarding this article, please contact below: Kwang Bae PARK ([email protected]) Jong soo (Jay) YOON ([email protected]) Hwan Kyoung KO ([email protected]) Sunghee CHE ([email protected]) Kyung Min SON ([email protected]) For more information, please visit our website: www.leeko.com
[1] Initially, the Government Proposal only stated a maximum administrative penalty amount of 3% of total sales revenue, which was subsequently changed, after the public commentary period, to permit the exclusion of any sales revenue unrelated to the activity in violation of the PIPA.