INSIGHTS

Newsletters
Enforcement of Amendments to the Unfair Competition Prevention Act and Patent Act Strengthening Protection for Rights Holders The amendments to the Unfair Competition Prevention and Trade Secrets Protection Act (the “Unfair Competition Prevention Act”) and the Patent Act will soon come into force on August 21, 2024. The main points of the amendments to the Unfair Competition Prevention Act and the Patent Act are as follows: (1) Increased criminal penalties: Criminal fines for unfair competition violations and trade secret misappropriation by corporations have been increased to up to three times the statutory maximum that can be imposed on an individual, and the statute of limitations for corporations has been extended from the current five years to ten years. (2) Enhanced punitive damages: Punitive damages of up to five times the actual damages may be awarded for willful acts of infringement, including infringement of patents, breach of exclusive license rights, theft of ideas and misappropriation of trade secrets. (3) Introduction of stronger administrative measures: A system for the issuance of corrective orders by the Commissioner of the Korean Intellectual Property Office (“KIPO”) has been established for acts of unfair competition, and a fine of up to KRW 20 million may be imposed for failure to comply with a corrective order. (4) Increased availability of evidence in civil proceedings: It is now possible for parties to inspect and request copies of materials related to administrative investigations, and the Commissioner of KIPO cannot refuse a court’s request to provide records without a legitimate reason. These amendments are interpreted as part of the government’s overall efforts to deter technology leakage and acts of unfair competition, which have been causing significant damage to the industry recently. To this end, the government launched a government-wide joint technology leakage response team on November 8, 2023, and approved the KIPO Technology Police as a standing organization on February 27, 2024. Further, the government amended the Judicial Police Service Act on January 16, 2024 to expand the scope of KIPO investigations, which were previously limited to the illegal acquisition, use and disclosure of trade secrets, to include a full range of trade secret misappropriation offenses, including preparatory acts, conspiratorial acts and unlawful possession. In addition, on March 25, 2024, the Supreme Court Sentencing Commission enhanced sentencing guidelines for trade secret misappropriation and technology infringement offenses (e.g., imprisonment of up to 12 years, as opposed to the current nine years, for overseas leakage), and strengthened probation guidelines (applicable to cases prosecuted on or after July 1, 2024). As civil and criminal penalties for intellectual property offenses increase, it will be all the more important for companies to establish and implement rigorous compliance systems throughout their operations. In addition, companies or individuals who are victims of intellectual property offenses or have concerns that their rights may have been infringed, should consider taking a more aggressive stance in enforcing their rights, as effective legal action is now more readily available. [Korean Version]
2024.08.16

Newsletters VIEW MORE
Newsletters
Information Security-Related Certification Requirement for Companies Doing On-Line Business in Korea This letter provides an overview of Information Security Management System (“ISMS”) certification under the Act on Promotion of Information and Communication Network Utilization and Information Protection, Etc. (“Network Act”), identifies the entities required to obtain this certification, and outlines key timelines. 1. What is an ISMS certification? An ISMS certification certifies that a company’s IT management system has achieved the required levels of stability, security, and reliability as mandated by the Network Act. This certification is issued by the Korea Internet & Security Agency (“KISA”) ? the certifying body ? after a thorough review of the company’s technical, administrative, and physical security measures. 2. Who must obtain an ISMS certification? An ISMS certification is mandatory for internet service providers, internet data center operators, certain hospitals and schools, and, more broadly, both domestic and overseas companies providing online services in Korea that meet either of the following conditions: Any company whose sales using information and communication services (e.g., E-commerce business) during the previous fiscal year was at least KRW 10 billion (approx. USD 7.62 million); or Any company whose average daily number of users of their online services in the preceding fiscal year was at least 1 million. As to the first criterion, e-commerce sales would include B2B sales, not only sales to end customers. 3. Deadline and Duration: The deadline for ISMS certification is August 31 of the year following the date when the obligation was triggered. For example, if a company with a fiscal year running from November to October met the revenue threshold during the November 2023 ? October 2024 fiscal year, it must obtain ISMS certification by August 31, 2025. For multinational companies, the certification process typically takes a minimum of nine to ten months from the start of preparation to certification approval. This is due to the need for close internal coordination among local, regional, and headquarters personnel, as well as the necessity of language translations throughout the process. Moreover, for multinational companies, preparing and applying for ISMS certification is often challenging and time-consuming, as it may require making changes to their IT systems to meet local demands tailored to Korean law requirements. 4. Penalty and Risks: Failure to obtain ISMS certification by the deadline can result in a corrective order and/or an administrative fine of up to KRW 30 million (approx. USD 23,000), even for a first-time violator. Furthermore, this fine is not a one-time penalty. It will be imposed annually at the same amount until the certification is obtained. More importantly, in the event of any personal information breach or leakage, non-compliance could lead to heightened scrutiny during investigations. Additionally, in the event of litigation concerning damages, there is a higher likelihood that negligence could be more easily established. 5. What is an ISMS-P certification? An ISMS-P certification is a voluntary certification that combines both ISMS and Personal Information Management System certifications into a single review process. By obtaining this certification, a company can show that it complies with the information security and personal data protection standards required by the Network Act and the Personal Information Protection Act. However, please note that since ISMS-P certification is voluntary, companies can define the scope of their certification based on their needs. This means that the review and certification will be limited to this specified scope. According to the statistics announced by the KISA, 25% of applicants for ISMS certification voluntarily have applied for ISMS-P certification as well. This trend reflects the growing interest in ISMS-P and the rising success rate of companies obtaining this certification. 6. Anticipated benefits: Obtaining ISMS or ISMS-P certifications can significantly benefit companies by enhancing the reliability of their information security and personal data protection measures, as well as mitigating potential legal, regulatory, and compliance risks. Particularly with ISMS-P certification, companies can benefit from a reduction in administrative penalties by up to 40% in the event of a personal information breach or leakage, as it serves as reliable evidence of compliance with relevant laws and regulations. Given the recent trend of increasing administrative penalties imposed by the Personal Information Protection Commission (“PIPC”), obtaining ISMS-P can help minimize companies’ financial and business risks. For example, this May, the PIPC imposed an administrative penalty of approximately KRW 15.14 billion (around USD 11.6 million) on an internet service provider. Furthermore, applying for this certification provides companies the opportunity to thoroughly examine the entire lifecycle of personal information they collect and process, and ensures compliance with evolving privacy laws and regulations in South Korea. [Korean Version]
2024.08.22

Newsletters VIEW MORE
Newsletters
The PIPC Releases its “Guideline on Processing Publicly Available Data for AI Development and Services” On July 17, 2024, the Personal Information Protection Commission (“PIPC”) released its Guideline on Processing Publicly Available Data for AI Development and Services (the “Guideline”) (Link). In sum, the Guideline defines “publicly available data” as personal information that is legally accessible to anyone and sets forth standards for applying the “legitimate interest” basis for collecting and using publicly available data to develop AI or provide AI services. The Guideline also elaborates on standard safeguards that AI companies can implement when training AI or providing AI services, how to protect data subjects’ rights, and the internal management system of AI companies. 1. Requirements and Standard for Applying “Legitimate Interest” The Guideline explains that the “legitimate interest” provision in Article 15, Paragraph (1), Item 6 of the Personal Information Protection Act (“PIPA”) can be a practical legal basis for the collection and use of publicly available data for AI training and services. In particular, the Guideline provides the PIPC’s interpretation of the requirements for applying legitimate interest, together with some examples. According to the Guideline, the following conditions should be met to utilize “legitimate interest” basis: Requirement 1: Legitimacy of the Purpose ? Various types of interests can qualify as “legitimate interest,” including the AI company’s commercial interest or the resulting societal interest. ? AI developers are recommended to define their purposes in as much detail as possible. ? The level of detail may depend on whether the AI could be considered “narrow AI” or “general AI.” Type Level of Detail in Defining Purposes Narrow AI Recommend defining the intended purpose and use in as much detail as possible (e.g., summarizing documents, translations, image generation). General AI May describe the legitimate interest within a reasonably foreseeable scope, using the AI’s types, functionalities and capabilities. Requirement 2: Necessity of Processing ? Necessity of processing will be determined on a case by case basis, considering factors such as the detailed purpose, use and context of the AI. ? The processing must be substantially related to the legitimate interest and within a reasonable scope. ? The AI company should establish, in advance, standards for training data, which are appropriate for the AI’s purpose, and use and exclude from training data if the data are not substantially related to the development of the AI. Requirement 3: Balance of Interests ? The data controller’s legitimate interest must clearly outweigh data subjects’ rights. ? The balancing test may consider the data controller’s implementation of safeguards to protect personal information and measures to ensure the data subjects’ rights (further discussed below). 2. Implementing Safeguards and Ensuring Data Subjects’ Rights The Guideline provides that AI companies can implement safeguards that are appropriate for their specific business and should effectively support the data subjects’ exercise of their rights in consideration of the currently available technology and limitations of AI. The Guideline presents the following examples of safeguards and means to protect the data subjects’ rights and expressly states that AI companies do not need to implement all safeguards that are discussed in the Guideline. Technical Safeguards Types of Measures Details and Examples Verification and Management of Sources of Training Data Comply with website terms of use and robots.txt, and confirm major data sources when using data collected by third parties (e.g., Common Crawl). Exclude from training data whose URLs are identified by the PIPC and the Korea Internet & Security Agency. Prevention of Data Breach Delete or de-identify personal identifiers (e.g., unique identification information, sensitive information, bank account information, credit card numbers). Use de-duplicated datasets or use tools for de-duplication. Use enhanced personal information protection technology (e.g., differential privacy). Secure Storage and Management of Personal Information Implement safeguards, such as access restrictions to prevent leakage of training data or to prevent combination of such data with user database. Additional Safeguards Through Fine-Tuning Use fine-tuning, such as supervised fine-tuning or reinforcement learning from human feedback. Filtering of Prompts and Outputs Refuse to answer or provide predetermined answers for prompts that try to induce individual profiling or privacy infringement. Use technology to detect and delete personal information that may be generated in outputs. Deleting Specific Data After Training Implement technology, such as machine unlearning (depending on technological progress). Managerial Safeguards Types of Measures Details and Examples Establishing Standards for Processing Training Data and Disclosing in the Privacy Policy Disclose the standards for collection and use of training data (including major collection sources, method of collection, and safeguards) in the privacy policy, technical documents, and FAQs. Privacy Impact Assessment Consider conducting privacy impact assessment under the PIPA (for AI services that can substantially impact data subjects’ rights and obligations or may include sensitive information in training data). AI Privacy Red Teaming Establish and operate red teams (including external experts) to test potential privacy infringement cases. Safeguards Appropriate for the Method of AI Development and Distribution (e.g., Open Source, API) For open source models: (i) Establish and distribute license policies that specify the terms and conditions of use. (ii) Promptly take responsive measures and redistribute models when vulnerabilities are discovered. For API-integrated services: (i) Impose contractual obligations on developers using the API to protect personal information and provide detailed instructions for use and technical documents. Ensuring Data Subjects’ Rights Types of Measures Details and Examples Enhanced Transparency on AI Training Data Disclose the collection of publicly available data (including major sources and processing purposes) in the privacy policy, technical documents, and FAQs. Support for Exercising Data Subjects’ Rights Make efforts to respond to data subjects’ privacy requests (e.g., access, correction, deletion) in consideration of reasonable time, costs, and technology involved in responding to such requests. 3. Internal Management Systems for AI Companies The PIPC recommends that AI companies establish an AI privacy department led by the Chief Privacy Officer. In particular, the Guideline explains that this AI privacy department’s primary responsibilities may include confirming and evaluating the legal bases for personal information processing, documenting such legal bases, conducting regular monitoring of risk factors, and providing support for exercising data subjects’ rights. 4. Implications The PIPC expressly stated that the Guideline provides legal interpretations that can serve as a reference, but that the Guideline is not legally binding and that noncompliance with the measures in the Guideline would not directly lead to PIPA violations. On the other hand, the PIPC clarified that AI companies bear the burden of proving that their privacy practices comply with the PIPA. Therefore, the Guideline will still serve as an important reference for companies in understanding the PIPC’s positions and interpretations, and companies should closely monitor subsequent PIPC activities, as well as how the Guideline will be applied in practice. [Korean Version]
2024.07.23

Newsletters VIEW MORE
Newsletters
Financial Authorities Announce Proposed Sanction Guidelines for Violation of Internal Control Management and Initiate a Responsibilities Map Pilot Program Under the amended Act on Corporate Governance of Financial Companies, effective as of July 3, 2024, the representative director (or an equivalent officer) and officers of a financial company (collectively, the “Officer(s)”) should be included in the financial company’s responsibilities map to be submitted to the Financial Authorities (defined below) within the statutory deadline for each type of financial company and bear managerial responsibility for the company’s internal control and risk management obligations (“Internal Control Obligations”) upon preparation and submission of the responsibilities map. Violation of the Internal Control Obligations may subject the implicated Officer(s) and the company to personal sanctions, although sanctions may be reduced or exempted in consideration of the background, degree and results of the violation as well as whether the Officer(s) exercised reasonable care. On July 12, 2024, the Financial Services Commission (the “FSC”) and the Financial Supervisory Service (the “FSS”) (collectively, the “Financial Authorities”) (i) announced a plan to conduct a pilot program to facilitate the smooth operation of new regimes including the responsibilities map, and (ii) prepared and announced the “(proposed) operation guidelines on sanctions for violation of the obligation to manage internal control” to enhance the predictability and transparency of sanctions issued for breaches of the Internal Control Obligations. Please refer to our memo (attached below) discussing the key contents. [Korean Version]
2024.07.22

Newsletters VIEW MORE
Newsletters
National Assembly Approves the Proposed Amendment to the Enforcement Decree of the FSCMA on Mandatory Prior Disclosure of Insider Transactions As noted in our previous newsletter released earlier this year (Link), the National Assembly promulgated an amendment to the Financial Investment Services and Capital Markets Act (the “Amended FSCMA”) last year to introduce advance disclosure requirements for insider transactions involving listed companies. The Amended FSCMA was set to take effect on July 24, 2024, key provisions of which are as follows: If an “insider” of a listed company intends to buy or sell shares (including equity securities, convertible bonds, bonds with warrants, and related depository receipts) issued by the listed company (“Specified Securities”), in an amount that meets the threshold specified by the Enforcement Decree, he/she must disclose the purpose, price, volume, and period of the transfer prior to the scheduled trading date (i.e., a period of at least 30 days, but not longer than 90 days prior to the trading date, as prescribed by the Enforcement Decree). For purposes of the Amended FSCMA, an “insider” of a listed company refers to an executive (including a director, auditor, and de facto executive (e.g., a person who orders business execution)) or a major shareholder (i.e., a person holding at least 10% of the shares of such listed company or having the power to exert de facto influence, excluding a set of persons exempted under the Enforcement Decree of the Amended FSCMA). Matters such as the specific transaction volume subject to prior disclosure obligations, persons exempt from disclosure obligations, disclosure deadlines, and reasons for making changes to disclosures are delegated to the Enforcement Decree. Failure to disclose transaction plans, provision of false disclosures, failure to implement transaction plans, and any other violations of disclosure obligations may result in an administrative fine of 0.02% of the market capitalization of the listed company, not to exceed KRW 2 billion (Article 429 (5) of the Amended FSCMA). In connection with the Amended FSCMA, the Financial Services Commission underwent the usual procedures for legislative notice and pre-announcement (Link) with respect to (i) the amended Enforcement Decree of the FSCMA (the “Amended FSCMA Enforcement Decree”) stipulating matters delegated by the FSCMA, (ii) the amended Regulations on Disgorgement of Short-Swing Profits and Unfair Trading Investigation and Report, Etc. (the “Amended Short-Swing Profits Regulations”), and (iii) the amended Capital Markets Investigation Operations Manual (the “Amended Investigation Manual”). All of these amendments were finally approved by the government at a cabinet meeting held on July 9, 2024 (Link). The key provisions of these amendments are as follows: 1. Insiders Excluded From the Scope of Parties Subject to Prior Disclosure Obligations (Article 173-3 (1) of the Amended FSCMA, and Article 200-3 (1) of the Amended FSCMA Enforcement Decree) Under the Amended FSCMA Enforcement Decree, the scope of parties subject to prior disclosure obligations excludes financial investors that are expected to have a relatively higher level of internal control standards and be less likely to misuse material non-public information (e.g., collective investment vehicles (including special purpose companies) such as pension funds and private equity funds, banks, insurance companies, specialized credit finance companies, financial investment businesses, and venture capital firms, and the Korea SMEs and Startups Agency). In addition, foreign investors with a status equivalent to domestic financial investors are also excluded from the scope of parties subject to prior disclosure obligations, in order to ensure equal treatment of domestic and foreign investors. 2. Transaction Volume and Types Exempt From Prior Disclosure Obligations for Transaction Plans (Article 173-3 (1) of the Amended FSCMA, Article 200-3 (2) of the Amended FSCMA Enforcement Decree, and Article 9-3 of the Amended Short-Swing Profits Regulations) Exempt from the reporting obligation are (i) any transaction where the trading volume of Specified Securities that are the subject of such transaction constitutes less than 1% of the total number of issued and outstanding shares of the relevant listed company, and (ii) any transaction where the value of Specified Securities that are the subject of such transaction is less than KRW 5 billion, in each case aggregated over the past six months (prior to the commencement date of the relevant transaction) and during the trading period. Also exempt from the prior disclosure requirement are transactions executed due to unavoidable reasons, such as where there is no risk of misuse of material non-public information as specified below[1] and where transactions are conducted due to external factors.[2] 3. Prior Disclosure Procedure and Method for Insider Transactions (Article 173-3 (1) through (3) of the Amended FSCMA, Article 200-3 (3), (4) and (6) of the Amended FSCMA Enforcement Decree, and Article 9-4 of the Amended Short-Swing Profits Regulations) The parties subject to prior disclosure obligations are required to specify in their transaction plan reports the (anticipated) trading amount, price, volume, and period of Specified Securities to be traded. The transaction that is the subject of a transaction plan report must be completed within 30 days from the scheduled commencement date thereof. The reporting of any new transaction plan is prohibited from the date the existing transaction plan is reported until the date the implementation of the relevant transaction plan is completed. The amount in the transaction that is the subject of a transaction plan report may deviate from the amount set out in such transaction plan by up to 30%, providing flexibility to the parties subject to prior disclosure obligations to respond to changing market conditions. Reporting of a transaction plan must be made 30 days prior to the commencement of the relevant transaction. Accordingly, the reporting obligation is applicable to transactions for which payment will be made on or after August 23, 2024 (and which are executed by floor trading on August 21, 2024), which is 30 days after the enforcement date of the Amended FSCMA (July 24, 2024). 4. Unavoidable Circumstances in Which Transaction Plans May Be Withdrawn (Article 173-3 (4) of the Amended FSCMA, Article 200-3 (7) of the Amended FSCMA Enforcement Decree, and Articles 9-6 and 9-7 of the Amended Short-Swing Profits Regulations) A transaction plan may be withdrawn in unavoidable circumstances such as (i) the death or bankruptcy of the filing party, (ii) a significant amount of loss anticipated due to increased market volatility,[3] (iii) the impossibility of executing a sales or purchase transaction due to reasons attributable to the counterparty, or (iv) rapidly changing market conditions (e.g., the delisting of the relevant company, a suspension of trading, etc.) after submitting the transaction plan. 5. Method of Calculating Administrative Fines for Violations of Prior Disclosure Obligations for Insider Transactions (Article 429 (5) and (6) of the Amended FSCMA, Article 379 (6) and (7) of the Amended FSCMA Enforcement Decree, and Attached Table 2-3 of the Amended Investigation Manual) Failure to disclose transaction plans, provision of false disclosures, failure to implement transaction plans, and any other violations of disclosure obligations may lead to an administrative fine of 0.02% of the market capitalization of the listed company, not to exceed KRW 2 billion. Accordingly, the Amended FSCMA Enforcement Decree has set out detailed provisions whereby administrative fines can be imposed differently depending on the market capitalization, trading amount, severity of violation, etc. The purpose of enforcing these prior disclosure requirements is to enhance the transparency and predictability of large-scale insider transactions in order to prevent unfair trading practices and safeguard general investors. For insiders, including major shareholders, the requirement to disclose substantial share sales in advance will mitigate unnecessary potential misunderstandings, which may occur due to the use of non-public information in disposals of shares. For major shareholders, however, there may be a number of relevant factors to take into account when reviewing transaction structures for large-scale share trading. This is because major shareholders are required to disclose information about their large-scale transactions in advance, thereby inevitably exposing themselves to the risk of stock price fluctuations from the date of disclosure until the date of transaction. It is also worth noting that under the Amended FSCMA Enforcement Decree, transactions of institutional investors (e.g., private equity funds), mergers and acquisitions, and transactions for corporate restructuring (e.g., acquisitions or disposals of shares due to split-ups or mergers) are exempt from the prior disclosure requirements. [1] Where the sale or purchase of shares is inevitable due to a statutory requirement, or is intended for stabilization or market creation (exceptions to disgorgement of short-swing profits (under Article 198, Subparagraphs 1 through 12 of the Amended FSCMA Enforcement Decree) are applied mutatis mutandis). [2] Succession/inheritance; share dividends; mergers and acquisitions involving the transfer or acquisition of shares; acquisitions or disposals of shares due to split-up or merger; or covering (or reverse trading) due to a decrease in the collateral value of shares. [3] Where the relevant stock price exceeds 30% of the closing price of the day preceding the reporting date of the transaction plan. [Korean Version]
2024.07.22

Newsletters VIEW MORE

김·장 홍보

151 Professionals Selected as “National Leaders”

In the 2024 edition of WWL: Korea, 151 professionals across 22 fields were selected as “National Leaders” in their respective fields. This year, our firm obtained the most listings out of all Korean law firms once again, demonstrating the expertise and extensive capabilities of our professionals.
VIEW MORE
Named “South Korea National Law Firm of the Year”

Kim & Chang was recognized as the “South Korea National Law Firm of the Year” at the Chambers Asia-Pacific & Greater China Region Awards 2024. Since 2010, our firm has been honored with this title nine times, earning widespread recognition as one of Korea’s leading law firms.
VIEW MORE
Named “South Korea Firm of the Year”

Kim & Chang was named as the “South Korea Firm of the Year” at the Benchmark Litigation Asia-Pacific Awards 2024. In addition, our firm won the “Tax Firm of the Year” award in the Practice Area Firm Awards.
VIEW MORE

웹접근성

김∙장 법률사무소는 장애인 및 비장애인 누구나 편리하게 웹서비스를 이용하실 수 있도록 웹접근성 준수 및 개선을 위하여 노력하고 있습니다.

김∙장 법률사무소는 앞으로도 모든 사용자들이 편리하게 서비스를 이용할 수 있도록 최선을 다하겠습니다.
불편사항은 lawkim@kimchang.com으로 연락주시면 친절하게 안내해드리겠습니다

레이어 닫기

The material on the Kim & Chang website is for general informational purposes only and should not be regarded as legal advice. The transmission or receipt of any information from this site is not intended to create nor constitute an attorney-client relationship. Kim & Chang does not assume and disclaims any liability to any person for any loss or damage caused by said person's use of or reliance upon the materials on this website, regardless of whether said loss or damage was directly or indirectly caused by inaccurate statements therein. On-line viewers should consult with competent and professional legal counsel before acting upon any information provided by this website. All of the contents on this site are copyrighted by Kim & Chang. Any reproduction, distribution or retransmission of any materials posted on the Kim & Chang website without prior written permission from Kim & Chang is strictly prohibited. Although we provide several links to other websites, please be advised that we have no control over the content of those sites.

Recently, there has been an increase in cases where the names of the firm, its attorneys, and other personnel have been used in connection with scams and other fraudulent activity. These include proposals regarding legal services, contracts, or investments; requests for payments or personal data; or employment offers or requests for payments in exchange for employment opportunities. Kim & Chang bears no responsibility or liability for any such unauthorized activity/communications, or issues arising therefrom.

We communicate with clients only through the authorized email and phone contact information found on our firm’s official website (www.kimchang.com). We do not utilize other communication channels for official business, including through non-Kim & Chang email addresses or phone numbers, text messages, or social networking services. Moreover, under no circumstances do we make individual requests for personal data or payment (apart from requests made pursuant to a duly executed engagement contract).

If you are the recipient of suspicious communications related to Kim & Chang or any individuals affiliated with the firm, please contact us at 02-3703-1114 or lawkim@kimchang.com

레이어 닫기