Please see below our update on this year’s review and enforcement of app access rights by the Korea Communications Commission (“KCC”).

Under Article 22-2(1) of the Act on Promotion of Information and Communications Network Utilization and Information Protection (“Network Act”), telecommunication service providers who request rights to access stored data or installed functions on their users’ mobile devices (“Access Rights”) must obtain the users’ consent after providing information specified in the Network Act in clear, understandable language. Article 22-2(2) of the Network Act further prohibits telecommunication service providers from refusing to provide services to users who did not consent to granting Access Rights that are not strictly necessary for providing those services.

KCC, the competent authority responsible for the Network Act, conducts annual reviews of telecommunication service providers with mobile applications on their compliance with the Network Act. The KCC then issues official notices to telecommunication service providers found to be in non-compliance, advising them to take remedial actions. KCC has conducted reviews during this calendar year, advising noncompliant providers of the needed corrections and requesting reports on the results of the remedial actions.

In view of the above, we advise companies to be prepared for KCC’s review by confirming their mobile applications’ compliance with the following requirements:
 

• The application must distinguish between mandatory and optional Access Rights, and explain the differences between the two;

• For optional Access Rights, the application must explain that users have the option of refusing consent;

• The application must obtain users’ consent for mandatory Access Rights;

• The application must allow users to continue using the application, even if the users refuse to grant consent for optional Access Rights; and

• The Access Rights actually exercised by the application must be consistent with the Access Rights as explained to the user.
   

KCC may issue corrective orders to those providers who fail to submit reports on the results of their remedial actions after receiving KCC’s official notices and advice. Subsequent failure to comply with the corrective order may result in fines of up to KRW 30 million, or in cases of violations of Article 22-2(2) of the Network Act, fines of up to KRW 30 million. If a provider is found to have violated other provisions of the Network Act, the provider may receive corresponding corrective orders as well.

[Korean Version]