Before its major amendment in 2020, the data protection and privacy matters of ICT service providers were regulated by the Act on the Promotion of Information and Communications Network Utilization and Information Protection (“Network Act”). The data protection and privacy clauses in the Network Act, however, were later integrated into the Personal Information Protection Act (‘PIPA’) in 2020 which is the current data protection and privacy act in South Korea.
Although the PIPA doesn’t have an explicit clause, it is a general view of a Korean regulatory agency that the PIPA is applicable to any foreign business entity operating outside of Korea, so long as their businesses target Korean customers.
For example, in 2017, the Korean regulatory agency banned CallApp, a free mobile caller identification app developed and distributed by an Israel-based tech startup. The agency, the Personal Information Protection Commission of Korea, fined the service provider for illegally collecting and processing the Personally identifiable information (PII) of the users.
Also, in 2020, the agency fined Facebook $6 million USD and brought a criminal accusation for violating the PIPA by the following:
- Providing PII to 3rd parties without the data subject’s consent
- Failing to provide periodic notice to the users regarding the usage of PII
- Storing users’ passwords without encryption
The violation of the PIPA could result in imprisonment up to 5 years imprisonment or a criminal fine of up to KRW 50 million (around USD 45,000).
That being said, it is critical for any foreign ICT service providers to comply with the obligations under the Korean data protection and privacy regulations, if their services have a substantial number of Korean users.
If you have any questions about the Korean data protection and privacy law, and want to speak directly with our Korean qualified English speaking lawyer, please click the contact button below.
© 2023 All rights reserved.
Because of the generality of this update, the information provided herein, which may or may not reflect the most current legal development, may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.