|
|
|
|
|
|
|
Newsletter | April 2015, Issue 1
|
|
|
|
|
|
|
|
|
|
|
TECHNOLOGY, MEDIA & TELECOMMUNICATIONS
|
|
|
|
|
Newly Issued Online Personal Information Processing Guidelines
|
|
|
|
By announcing the Online Personal Information Processing Guidelines (the “Guidelines”) on November 12, 2014, the Korea Communications Commission (“KCC”) has further clarified the standards for (1) collecting minimum personal information, (2) destroying personal information, and (3) obtaining consent, as required under the Act on the Promotion of Information and Communications Network Use and Information Protection (the “Network Act”). The Guidelines contain the following key points:
|
|
|
|
Standards for Collecting Minimum Personal Information
|
|
|
|
Under the Network Act, an online service provider is only permitted to collect personal information of its users to the extent needed to provide its online services – i.e., minimum scope of personal information. The Guidelines strictly limit “necessary minimum personal information” to “personal information which is necessary in carrying out the essential functions of the relevant online service” (referred to as “required information”; this includes information such as the user’s login ID, password, name, etc.). For other types of information which are not necessary in carrying out the essential functions of the relevant online services, the Guidelines provide that such information can be collected only at the option of the user (referred to as “optional information”; examples include the user’s telephone number collected for marketing purpose).
|
|
|
|
In addition, the Network Act does not expressly provide a time period or time limitation when the online service provider should collect personal information with the consent of the user. The Guidelines, on the other hand, clarify that an online service provider should receive the user’s consent at the time when the user actually uses the relevant online service, and for the services actually required at that time. For example, the Guidelines stipulate that at the subscription stage, companies should limit the scope of consent to the ID, password, etc., and request consent for further information (e.g., address) when such information is necessary (e.g., purchase of product).
|
|
|
|
Standard for drafting an easily comprehensible consent form
|
|
|
|
The Network Act provides that online service providers must disclose certain items about their collection and use of personal information so that the user can provide informed consent. In this regard, the Guidelines clarify how such disclosures should be made by the online service provider, as follows.
|
|
|
|
|
(1)
|
Online service providers must mark key details in the consent form with symbols, colors, or particular fonts so that the user can easily identify and understand these key details. If technical terms are used in drafting the consent form, online service providers should create a separate section explaining the technical terms.
|
|
|
(2)
|
“Required information” and “optional information” should be organized separately so that the user can clearly distinguish between these two items. Online service providers should make optional information distinguishable, so that a user can easily determine that providing such information is only optional. Further, online service providers should separately organize optional information in accordance with the purpose and usage of such information, so that the user can give separate consent for each type of optional information.
|
|
|
(3)
|
A “one-click” method of having all consent boxes checked at once for each individual consent item is permitted (however, the user should be informed of the fact that optional information are also included).
|
|
|
(4)
|
User consent should not be obtained through pre-checked boxes.
|
|
|
|
|
The Guidelines apply to all industries that collect and use personal information online. However, because the Guidelines are not legally binding, further monitoring will be needed to see how the KCC will practically implement and enforce the Guidelines in the future.
|
|
|
|
|
Back to Main Page
|
|
|
|
|
|
If you have any questions regarding this article, please contact below:
|
|
|
|
|
|
|
|
For more information, please visit our website:
|
|
|
|
|
|
|
|