1.

Collection and Use of Personal Information (Article 15 of the PIPA)

The Guidelines provide specific standards for interpreting the legal bases for collection and use of personal information. In particular, the Guidelines explain the most commonly used legal bases for processing, such as “consent,” “contractual necessity” and “legitimate interest.”
 

2.

Restriction on Collection of Personal Information (Article 16 of the PIPA)

The Guidelines explain that when a data controller collects personal information of a data subject for any of the purposes set forth in Article 15, Paragraph (1) of the PIPA, the data controller should collect the minimum personal information to the extent necessary for such purpose. In this regard, the Guidelines provide that the data controller may collect and use information other than the minimum information required if the data subject freely gives his/her consent. However, in such case, the data subject should be specifically informed of the fact that he/she may refuse to give consent, and the data subject should not be denied of the goods or services based on his/her refusal to consent to the collection and use of personal information beyond the minimum scope.

However, since the PIPA distinguishes the types of personal information processing into collection, use, and third party provision, the principle of minimum collection applicable to “collection” of personal information is not applicable to other types of personal information processing.

The Guidelines note that the scope of the “minimum required personal information” should be determined based on (i) the details set forth in the privacy policy, consent forms, agreements, terms and conditions, and service-related guidelines; and (ii) the nature, purpose, and market/transaction environment of the relevant service, the status of technological development, and other relevant factors.
 

3.

Method of Obtaining Consent (Article 22 of the PIPA)

The Guidelines explain that the consent process should be reformed so that consent can be given based on the “free will” of the data subject, and consent should not be coerced by refusing to execute a contract based on the data subject’s refusal to give consent. The Guidelines add that whether the data subject’s consent based on free will is restricted should be determined on a case-by-case basis considering the circumstances, such as the nature of the service and the context in which consent is requested.

Notably, the Guidelines say that personal information necessary for the performance of a contract does not require mandatory consent, but instead, it is sufficient for the data controller to disclose such personal information in the privacy policy so that data subjects can easily understand what personal information is being collected to perform a contract. In the case of personal information unrelated to the relevant contract, the data controller should take measures to allow the data subject to freely decide whether to give consent to the processing of such information. If the data subject is restricted from freely deciding whether to give consent or the details of consent are not clearly notified to the data subject, this can be a violation of the requirements for lawful collection and use under Article 15 of the PIPA.
 

4.

Restriction on Sensitive Information Processing (Article 23 of the PIPA)

A data controller is obligated to inform the data subject of (i) the fact that his/her sensitive information may be disclosed; and (ii) how to choose non-disclosure of sensitive information.

However, the Guidelines provide that in the case of services, such as online public bulletin boards and social media services, which are clearly provided for the purpose of mutual communication, the data subject can reasonably be deemed to have expected that the personal information he/she voluntarily posts on such services will be disclosed to the public, and thus, the data controller can be deemed to have already informed the data subject of the above two notification items. In addition, the Guidelines state that if the data subject can choose between “public” and “private” setting on the information posted by the data subject, the default setting should be “private.”
 

5.

Restriction on Personal Information Processing in Delegation (Article 26 of the PIPA)

The Guidelines make clear that the scope of “delegatees” include not only the primary delegatees, but also sub-delegatees. Further, with regard to the obligation to manage and supervise delegatees, the Guidelines note that in relation to a professional delegatee delegated with personal information processing by multiple delegators, the delegator may perform its supervisory obligation by managing the notification given by the delegatee on a regular basis in the manner specified in the delegation documents. Such notification could include (i) the fact that the delegatee’s business is regularly inspected through ISMS-P, self-regulation through public-private partnerships (e.g., HR, Seller Tool sector), or the Chief Privacy Officer Council; or (ii) the results of self-inspection and improvement. To this end, a professional delegatee is required to specify in advance the inspection system, such as certification, and disclose the supervisory relationship with multiple delegators, in the relevant delegation agreements.
 

6.

Transfer of Personal Information in Business Transfers (Article 27 of the PIPA)

The Guidelines explain that in case of overseas transfer of personal information through a business transfer, Article 27 (Transfer of Personal Information in Business Transfer, etc.) and Article 28-8 (Overseas Transfer of Personal Information) of the PIPA will apply. Accordingly, the Guidelines clarify that in the event of an overseas transfer of personal information through a business transfer, the transferor is required to obtain a separate consent for overseas transfer under Article 28-8 (1) of the PIPA even though the transfer of personal information through a business transfer itself does not require a consent under Article 27.

However, if the personal information stays in Korea at the time of business transfer, and the acquirer later transfers the personal information overseas for delegation or storage for the purpose of performing a contract with the data subject, such transfer can be made without consent and only requires disclosure of the relevant matters in the privacy policy.