“Korea Law Firm of the Year” for 12 Years in a Row
For the twelfth consecutive year, Kim & Chang won the “Korea Law Firm of the Year” award at the ALB Korea Law Awards 2024.
もっと見るINSIGHTS
-
ニュースレター もっと見るニュースレターProduct Liability in Korea in the Age of E-Commerce Platforms In an e-commerce era increasingly dominated by online platforms, global changes and discussions are taking place to update local product liability laws originally developed for traditional product supply chains and markets. One of the key issues being debated is an e-commerce platform operator’s liabilities in terms of consumer protection. That is, what are the e-commerce platform operator’s liabilities and obligations if a defective product is distributed through its platform, and the consumer is unable to recover damages from the overseas manufacturer? We summarize below Korea’s relevant laws impacting e-commerce platform operators, and the possible directions they may take in view of recent developments in other major jurisdictions like the EU and the US. 1. E-Commerce Platform Operator’s Liabilities under Korean Laws (1) The Product Liability Act (“PLA”) The PLA, enacted in 1999 and effective since July 1, 2002, is Korea’s primary legislation on providing relief to consumers for harm caused by defective products. The PLA achieves this objective by alleviating the consumer’s burden of proof in establishing a manufacturer’s liability for damage to life, body or property caused by a product defect (Article 3 (1) of the PLA). Further, if an injured party does not know the identity of the defective product’s manufacturer, a qualifying commercial supplier of the product can also be held liable (Article 3 (3) of the PLA). The PLA imposes such liability on manufacturers and their commercial distributors to strengthen consumer protection, taking into consideration their roles in the traditional product supply chain. However, since an e-commerce platform operator is neither a manufacturer nor a commercial supplier (wholesaler or retailer) in the traditional sense, whether an e-commerce platform operator may be held liable under the current PLA may depend on the similarities and differences between the roles of the e-commerce platform operator and traditional suppliers. Thus far, however, there have been no clear precedents in Korea holding an e-commerce platform operator liable under the PLA. Against this backdrop, there have been calls to hold e-commerce platform operators liable under the PLA, given that (i) consumers often conduct transactions online, trusting the reputation of the e-commerce platform and not the individual manufacturer/seller, (ii) defective products are nevertheless being sold on such platforms, and (iii) the platforms are often involved in multiple aspects of such transactions (e.g., contract execution, payment, and refund) beyond mere market formation. Proponents also argue that the PLA essentially imposes tort liability on manufacturers or importers without establishing true fault or negligence as a matter of consumer protection policy, and advocate for an expansion of such principles to cover e-commerce platform operators. However, the fact that e-commerce platform operators normally do not directly handle the products, in contrast to traditional suppliers, presents additional hurdles for such justification. (2) Court Precedents A pair of Korean Supreme Court decisions have held that e-commerce platform operators are liable for products or postings on their platforms as follows. In the first decision, the Supreme Court held that a platform operator is jointly liable for the tortious acts of an individual seller in a case involving the posting of copyrighted content, stating that “if it is technically and economically possible to manage and control postings which infringe upon copyrights, the service provider is obligated to take appropriate measures, such as deleting such postings and blocking future postings with similar contents in the same Internet space” (Supreme Court Decision 2009Da4343, March 11, 2010). In the second decision involving a platform operator who offered discounts on books, the Supreme Court held that the platform operator is liable for non-compliance with a fixed price book sales brokerage system, stating that “it is reasonable to interpret that online sales brokers are included in the scope of publication sellers who are obligated to comply with the fixed price book sales system” (Supreme Court Decision 2019Ma5464, September 10, 2019). While the above cases do not pertain to liability based on product defect, they represent cases where an e-commerce platform operator was found liable based on certain public interest or consumer protection laws and regulations in relation to its brokered products. (3) The Act on the Consumer Protection in Electronic Commerce, Etc. (“E-Commerce Act”) The E-Commerce Act sets forth other liabilities of e-commerce platform operators (or online sales brokers) that are unrelated to defective products. First, if an online sales broker fails to provide notice that it is not a party to the online transaction brokered on its platform, the online sales broker will be jointly and severally liable with the seller for any property damage to the consumer caused by the seller’s willful misconduct or negligence (Article 20-2 (1) of the E-Commerce Act). In order to avoid such liability, which is intended to protect consumers, the online sales broker must enter into an agreement with the seller (for the seller to assume responsibility for the sales transaction) and provide the above notice to the consumer (Article 20-2 (3) of the E-Commerce Act). In addition, an online sales broker performing a key role (order or payment processing, etc.) in the online transaction will be held liable for certain obligations (provision of information on refund, etc.) (Article 20-3 of the E-Commerce Act). This provision also takes into account the status and role of e-commerce platforms in the distribution process of the relevant products and services in relation to consumers. 2. Legislations, Precedents, and Trends in other Jurisdictions (1) European Union The EU Product Liability Directive (85/374/EEC), approved by the European Parliament on March 12, 2024 to be adopted by the Member States, stipulates that economic operators, including not only manufacturers, but also authorized representatives, importers, distributors, and fulfillment service providers, are liable for defective products, and further, that provisions on distributors shall apply mutatis mutandis to e-commerce platform operators. (2) United States In California, two separate bills, which would have imposed product liability on e-commerce platform operators, such as Amazon, failed to pass in 2020 and 2021. Nevertheless, US courts have held that e-commerce platform operators can be found liable for defective products based on consumer protection related factors (Oberdorf v. Amazon.com Inc., Third Circuit Court of Appeals, No. 18-1041; Bolger v. Amazon.com, LLC, 53 Cal.App.5th 431; Loomis v. Amazon.com LLC, 63 Cal.App.5th 466; Lee v. Kitchables Prds., 2021 US Dist. LEXIS 140045; Diew v. Amazon.com Serv., LLC, 2021 US Dist. LEXIS 112000). 3. Outlook on Product Liability for E-Commerce Platforms in Korea There are currently no pending legislations, court cases, or other firm developments concerning an e-commerce platform operator’s liability for a defective product. However, the unabated growth of several high-profile e-commerce platforms in Korea continues to spur heavy debate on their responsibilities and impact on consumer safety and protection. Accordingly, the above-discussed global trends strengthening consumer protection against defective products from e-commerce platforms are likely to influence ongoing discussions and potential legislation in Korea. [Korean Version]2024.10.29
-
ニュースレター もっと見るニュースレターUpdated Guidelines on Standards for Measures to Ensure Security of Personal Information Released by PIPC On October 31, 2024, the Personal Information Protection Commission (“PIPC”) released the updated Guidelines on Standards for Measures to Ensure Security of Personal Information (the “Guidelines”) (available in Korean, Link). The PIPC updated the Guidelines for the first time since December 2020, by consolidating its former guidelines on security measures. The updated Guidelines incorporate changes in technical and security practices, as well as amendments to relevant laws and regulations. They outline the minimum standards that service providers must adhere to in order to safeguard personal information, in compliance with the Personal Information Protection Act (“PIPA”) and the Standards for Measures to Ensure the Security of Personal Information, and include examples and a Q&A section. Below is a summary of key points in the updated Guidelines. Relevant Provision Key Details Definitions (Article 2) FTP servers, backup servers and systems/services built in cloud environments are added as examples of personal information processing systems. ? Internal business systems, like groupware that handle employee data, qualify as such systems if they process employees’ team, number, name and contact information. Sharing settings include allowing access to resources through remote access, such as remote desktop connections. Companies must implement standards to ensure the security of personal information when managing and operating a system for personnel management of employees. Establishment, Implementation, and Inspection of Internal Management Plan (Article 4) Internal management plan must encompass all aspects of technical, managerial and physical security measures as outlined in the Standards for Measures to Ensure the Security of Personal Information. It must also address the qualifications and appointment of the Chief Privacy Officer. Within the “matters related to risk analysis and management” required in an internal management plan, risk analysis involves “evaluating the degree of risk, such as the likelihood of data breaches, including loss, theft, leakage, forgery, alteration, or damage, and the resulting impact on the data subject, depending on the method of processing and type of personal information.” The methods and procedures for analyzing and managing personal information risk can be independently developed, taking into account the data controller’s unique characteristics and circumstances. Training on personal information protection should be tailored to the position and role of the Chief Privacy Officer and personal information handlers, considering their specific duties and work proficiency. In addition to technical training relevant to their tasks, the training must cover essential topics such as privacy laws and internal management plan. Management of Access Rights (Article 5) In cases where issuing individual accounts is not feasible, such as with root accounts, alternative administrative or technical controls must be implemented. These may include account management logs and access control systems to identify individuals who accessed the personal information processing system. Various authentication methods can be used for personal information handlers and data subjects, including SMS authentication, telephone authentication, and social login, alongside traditional methods, like password authentication, One-Time Password (“OTP”) authentication and biometric authentication. If a user fails to authenticate after a set number of attempts, measures such as temporarily locking the account or delaying further authentication attempts may be applied to restrict access to the personal information processing system. Additionally, CAPTCHA can be used as a supplemental tool to prevent automated bot access. Access Control (Article 6) The use of fixed IP addresses or MAC addresses on personal information handlers’ devices is not considered a secure method of authentication. Credential stuffing attacks and similar incidents are identified as a type of personal information leakage or exposure that occurs through websites and internet portals. Examples of measures to prevent the leakage or exposure of personal information include implementing CAPTCHA when there is an increase in login attempts, setting and monitoring thresholds for login failure rates, and using methods, such as SMS or email, to verify the legitimacy of users when they log in to a page with personal information. Vulnerability inspections must address issues like identification and authentication failures, as well as vulnerabilities, such as server-side request forgery. The “idle session timeout” for systems should generally be limited to between ten to 60 minutes. When personal information is processed for business purposes using a company’s business app on a personal smartphone or tablet, or when accessing the company’s email server, such devices fall under mobile devices requiring appropriate security measures. Encryption of Personal Information (Article 7) The Guidelines suggest adding a salt value to passwords during one-way encryption to defend against random attacks and rainbow table attacks. Security Measures for Printing and Copying (Article 12) The following precautions should be taken when printing or copying personal information: ? Prevent a “like” search for personal information, unless it is necessary for business. ? Ensure searches are conducted with specific criteria or require two or more search terms to avoid unnecessary or excessive searches for personal information. ? Restrict the display of information based on consistent standards as personal information handlers could compile complete sets of data if personal information is masked differently across various systems. Security solutions can be implanted to protect printed and copied personal information, especially when using external storage devices. Solutions may include document rights management (“DRM”), secure USB drives, data loss prevention (“DLP”) tools and media control systems. The Guidelines are intended to serve as a standard for interpreting and implementing security measures under the PIPA. Data controllers who handle personal data for business purposes are advised to refer to these Guidelines to ensure the secure management of personal information. [Korean Version]2024.11.01
-
ニュースレター もっと見るニュースレターKFTC Announces Draft Amendment to Unfair Trade Practice Review Guidelines The Korea Fair Trade Commission (“KFTC”) announced a proposed amendment (“Proposed Amendment”) to the Unfair Trade Practice Review Guidelines (“Guidelines”). The public opinion canvassing period, which began on October 24, 2024, will last for 21 days, ending on November 13, 2024. The Proposed Amendment reflects recent KFTC decisions and court rulings regarding certain types of unfair trade practices, such as unfair solicitation of customers, abuse of superior bargaining position, and interference with business activities. It also clarifies that activities aimed at complying with environmental, social, and governance (“ESG”) regulations would not be considered unfair trade practices in violation of the law. The key contents of the Proposed Amendment are outlined below. 1. Unfair Solicitation of Customers Adds a New Example of Illegal Conduct under “Other Improper Solicitation of Customers” ? The Proposed Amendment adds “filing a patent lawsuit against a competitor without a reasonable cause and using it in business activities to solicit customers of the competitor” as an example of illegal conduct, in light of recent KFTC decisions and court rulings. ? This newly added conduct is regarded as an unfair means of competition and can be regulated without proving anti-competitive effects in the relevant market. 2. Abuse of Superior Bargaining Position Lowers Criteria for Establishing Superior Bargaining Position ? The Proposed Amendment provides that while a continuous business relationship is a factor considered when determining a company’s superior bargaining position, a superior bargaining position may also be recognized in one-time transactions if the counterparty cannot freely disengage from the business relationship. This amendment is in light of a recent court ruling, which held that the essence of a superior bargaining position lies in one party’s dependence on the other party in transactions and that a continuous business relationship, in and of itself, cannot be considered an independent criterion. ? In furtherance of the court ruling, the Proposed Amendment clarifies that a superior bargaining position may be recognized even in one-time transactions if dependency of one party on the other party in transactions can be established. Specifies Criteria for Determining Illegality of Management Interference Related to Compliance with Global ESG Regulations ? The Proposed Amendment provides that when determining the illegality of a conduct alleged to be management interference, a conduct necessary for achieving the objectives of domestic and foreign export-related laws or complying with global supply chain ESG regulations may not constitute an illegal conduct and that the appropriateness of the means taken and the availability of alternative methods must be considered. ? Even under the current regulations, actions such as requesting materials to comply with ESG regulations are unlikely to constitute unfair management interference, but the intent of the Proposed Amendment is to explicitly state it in the Guidelines to resolve any legal ambiguities for companies. 3. Interference with Business Activities Amends Criteria for Determining Illegality of Improper Use of Technology ? The Proposed Amendment introduces a new clause specifying that in determining whether business activities are substantially hindered, which is a criterion for assessing the illegality of improper use of technology, the decrease in sales or number of business partners does not need to be considered in cases where there are no sales due to the business being in its initial stage or there is a high sales volatility due to the nature of the business. ? This amendment is designed to improve the effectiveness of regulations on improper use of technology by reflecting the characteristics of certain businesses that may not generate sales in their early stages or have a high sales volatility, such as startups. Incorporates Amendment to the Enforcement Decree of the Monopoly Regulation and Fair Trade Law (“FTL”) ? In line with the amendment to the Enforcement Decree of the FTL, the Proposed Amendment revises the wording used to assess the degree of difficulty in business activities, from “extremely” difficult to “considerably” difficult, under the criteria for determining illegality of a conduct alleged to be interference with business activities. [Korean Version]2024.10.29
-
ニュースレター もっと見るニュースレターKim & Chang Legal Newsletter (2024 Issue 3) This is a quaterly update of legal developments in Korea from Kim & Chang. This issue includes: Prior Disclosure of Insider Transactions Becomes Mandatory for Listed Companies Implementation of Amended MRFTA Enforcement Decree and Administrative Fine Notification to Promote Fair Trade Voluntary Compliance Programs Key Contents of Proposed Amendment to English Arbitration Act and Implications in International Arbitration Implementation of Amended Merger Control Administrative Guidelines New FSC Chairman’s Supervisory Plan for Real Estate PF New Developments on Dual-Class Shares Announcement of Plans to Develop Laws, Institutions and Infrastructure to Foster the Used Battery Industry Government’s System Improvement Plan in Response to WeMakePrice and TMON Incident Enforcement of Recent Amendments to Public Notice on Trade of Strategic Items ? 34th and 35th Amended Public Notices FSC and FSS Held Second Insurance Reform Conference Korean Supreme Court Clarifies Meaning of “New Chemical Entity” for PTE Eligibility 2024 UFLPA Strategy Update and Key Implications Recent Supreme Court Decision Determining Whether Employees Were Engaged in Managerial or Supervisory Work Amendments to Enforcement Decree of Industrial Cluster Act: Easing Regulations on Industrial Complexes, Including Asset Securitization (Real Estate Financing) Recent Changes to Korean Short Sale Rules 2024 Proposed Tax Law Amendments ? Notable Items Korea Communications Commission to Conduct Investigations Following Periodic Status Reviews of Location Information-Related Service Providers Developments in Revitalizing Aerospace Industry: Impacts of Establishing KASA and Proposed Amendment to Space Development Promotion Act To view the newsletter, please click on the link below. Kim & Chang Legal Newsletter (2024 Issue 3) .content_view .view_area a { color: #2c3e50; text-decoration: none; }2024.10.25
-
ニュースレター もっと見るニュースレターAI Issues and Implications in Q3, 2024 1. Content Regulation and Copyright Legislative Trends in Deep-Fake Regulations The National Assembly of Korea has passed an amendment to the Sexual Crimes Punishment Act targeting illegal AI-generated deep-fake videos. An amendment to the Network Act is also expected to pass soon. Additionally, there is ongoing discussion within the National Assembly on new legislation, including an AI Framework Act and an amendment to the Telecommunications Business Act. These proposed legislations would introduce requirements for watermarking AI-generated content and obligations to prevent the spread of illegally filmed content for businesses including AI service providers and platform operators. 2. Privacy Privacy in AI: Use of Publicly Available Data and Regulatory Trends Regarding Legal Uncertainties The Personal Information Protection Commission has recently released a guideline that defines the extent to which publicly available data (i.e., data voluntarily made available to the public by data subjects) can be used for AI development and service purposes. The guideline clarifies that “legitimate interest” may serve as a legal basis for processing such data, and outlines the requirements for applying legitimate interest. Separately, the Personal Information Protection Commission also announced plans to provide a “one-stop channel for business innovation support” aimed at addressing legal uncertainties that companies may encounter in the course of developing AI technology and related services, as well as to promote the use of the existing pre-adequacy review and regulatory sandbox systems. 3. Antitrust and Competiton Key Consumer Protection Issues in the Use of GenAI in Advertising and Marketing AI technology is widely used in various advertising and marketing activities. Businesses should pay particular attention to several key consumer protection issues such as false advertisements generated by AI, ads that do not disclose the use of AI, and “AI washing” involving false and exaggerated claims. 4. Labor, Employment and ESG Using AI to Enhance Safety and Health in the Workplace: Related Trends and Legal Issues The number of workplace accident cases resulting in heavy criminal punishment for the “Responsible Management Personnel” of Korean companies (as such term is defined in the Serious Accidents Punishment Act or the “SAPA”) has been growing following the implementation of the SAPA. The pace of adoption of AI solutions in Korea aimed at enhancing safety and health in the workplace (especially those with focus on serious accidents) has been brisk. In light of various Korean law issues that may be implicated, introduction of AI solutions in this connection should be carried out with caution. 5.
Governance and Risk Management Key Updates on AI-Related Bills Submitted to the 22nd National Assembly As of September 24, 2024, a total of 11 AI-related bills have been introduced in the 22nd National Assembly. On the same day, a public hearing was convened to discuss the legislation of the AI Framework Act, during which leaders of both the ruling and opposition parties agreed to expedite the legislative process. This collaboration suggests a prevailing consensus within the National Assembly on the necessity and urgency of passing the AI Framework Act. The AI Framework Act represents significant legislation that engages a wide range of stakeholders, complicating the ability to anticipate the precise timing of its enactment. However, given the potential for a swift legislative process, it is advisable to closely monitor the legislative developments at the National Assembly as well as the movements at the key ministries, and to review their impact on businesses and services in the near term. 6.
Foundation Models and Platforms Insights from Global AI Safety Initiatives to Shape Korea’s AI Safety Institute Prompted by the AI Safety Summit in November 2023, the US, UK, and Japan have each created an AI safety institute to help establish and disseminate trusted security best practices for AI. In line with this development, Korea also announced its plan to establish a national AI safety institute in May 2024. As countries worldwide increasingly collaborate on important discussions about AI safety, the goals and research trends of the existing overseas AI safety institutes will likely serve as valuable references for defining the roles and functions of the new Korean AI safety institute. [Korean Version] [Related Newsletter] AI Issues and Implications in Q2, 2024 [Related Newsletter] AI Issues and Implications in Q1, 2024
2024.10.11
김·장 홍보
-
-
Ranked in the World’s Top 100 for the 11th Consecutive Year
For the eleventh consecutive year, Kim & Chang was ranked among the world’s top 100 law firms in “The Global 200” rankings published by The American Lawyer and Law.com International.
もっと見る -
“Outstanding” in All Categories and 65 “Leading Lawyers”
Kim & Chang was named “Outstanding” in all 24 categories in the 2024 edition of asialaw, once again receiving the highest recognition across all surveyed categories. Moreover, 65 of our attorneys and patent attorneys were recognized as “Leading Lawyers.”
もっと見る