South Korea’s Data Protection Laws and Regulations

Personal Information Protection Act (PIPA)

The Personal Information Protection Act (PIPA) regulates the collection, use, and disclosure of personal information in South Korea. Key aspects of PIPA include:

Fair Processing: Establishes principles for fair processing, transparency, and accountability.
Individual Rights: Empowers individuals with rights to access, correct, and erase their personal data.
Data Controller Obligations: Imposes obligations on data controllers to protect personal information from unauthorized disclosure.

Enforcement of PIPA

Failure to comply with PIPA can result in:

Fines
Imprisonment
Both fines and imprisonment

The Personal Information Protection Commission (PIPC) is the supervising authority responsible for issuing corrective orders and administering administrative fines.

Punitive Damages

Data controllers may be liable for up to five times the damages suffered in cases of intentional act or negligence leading to data breaches.

Electronic Marketing Regulations

South Korea requires explicit consent from individuals before transmitting advertisements via electronic transmission media. Key requirements include:

Explicit Consent: Requires explicit consent from individuals before transmitting advertisements.
Disclosures: Mandates disclosure of transmitter’s identity, contact information, and instructions on how to consent or withdraw consent.

Cookies, logs, IP information can be regulated as personal information if combined with other info enabling identification. Requirements include:

Consent: May require consent for collection, use, or disclosure of such data.
Regulation: Cookies, logs, IP information can be regulated as personal information.

Location Information Protection Act (LBS Act)

The Location Information Protection Act regulates the protection, use, and provision of location information. Key aspects include:

Prior Consent: Requires prior consent from individuals or owners before collecting, using, or providing location information.
Reporting: Mandates reporting to KCC for Location-based Service Providers and licensing for Location Information Providers.

Note

This summary is not exhaustive and may be subject to updates as laws and regulations evolve.