In order to protect smartphone application users, the Korea Communications Commission (the “KCC”) annually monitors whether users’ consent to access authority for applications has been properly obtained under the Act on Promotion of Information and Communications Network Utilization and Information Protection (the “Network Act”).
In accordance with Article 22-2, Paragraph 1 of the Network Act, where a provider of information and communications services needs authority to access (“access authority”) information stored and functions installed on users’ mobile devices, the provider shall inform users of certain matters so users may clearly recognize them, and shall obtain consent from the users. Additionally, Article 22-2, Paragraph 2 of the Network Act provides that no provider of information and communications services shall refuse to provide the relevant services to users on the ground that users withhold consent to access authority that is not clearly necessary to provide the relevant services.
The KCC, the competent enforcement authority of the Network Act, annually (i) monitors whether information and communications service providers that provide application services (“app service providers”) comply with this requirement through relevant agencies, and (ii) delivers notices to app service providers who are found to have violated the requirement. As part of its annual monitoring, the KCC is informing app service providers of the results of such monitoring and requesting that those who have received notices submit the results of their improvement measures by June 28.
In light of the foregoing, it would be advisable for app service providers to respond to the KCC’s monitoring by assessing (i) whether they are providing users with an explanation on access authority, including the classification of essential access authority and optional access authority, (ii) whether they are providing users with an explanation of their option to refuse to grant consent in the case of the optional access authority, (iii) whether they actually obtain users’ consent with respect to access authority, (iv) whether users can still use the relevant application even if they refuse to consent to optional access authority, and (v) whether the notified access authority corresponds to the actual grant of access authority.
A failure to submit the results of improvement measures despite the KCC’s notice and request for improvement may result in the imposition of corrective orders or an administrative fine of up to KRW 10 million. Furthermore, a violation of Article 22-2, Paragraph 2 of the Network Act may result in the imposition of an administrative fine of up to KRW 30 million, and other violations of the Network Act may be subject to corrective orders.
