[Asia Economy Reporter Kang Nahum] In the future, when a personal information handler obtains consent for processing personal information, important details such as promotional purposes or the processing of sensitive information must be displayed in a font size of at least 9 points (pt), which is at least 20% larger than other content. Additionally, when drafting a privacy policy, a Personal Information Processing Labeling system composed of symbols will be introduced to help data subjects easily identify key points.
The Personal Information Protection Commission disclosed the "Easy-to-Understand Personal Information Processing Consent Guide" and the "Privacy Policy Drafting Guidelines" on the 3rd, which are based on these principles.
The guide includes the requirements that personal information handlers must follow when obtaining consent from data subjects. It prohibits obtaining broad, preemptive consent by predicting the necessity of personal information processing and mandates processing only the minimum necessary personal information at the required time.
It also requires clearly identifying the personal information handler and making it easy for data subjects to recognize important information such as the fact that they may be contacted for promotional or sales purposes of goods or services, the processing of sensitive and unique identification information, and the retention and usage periods.
To this end, important content must be displayed in a font size of at least 9 points and at least 20% larger than other content, and clearly indicated using color, bolding, underlining, or other means.
The guide also instructs that consent content should be explained in simple language rather than technical terms, and that the data subject’s intention should be confirmed through active actions or statements.
Furthermore, it includes provisions that no disadvantages, such as refusal to provide goods or services, should be imposed for refusing consent to process personal information beyond the minimum necessary scope.
In addition, the Personal Information Protection Commission has prepared privacy policy drafting guidelines to help data subjects easily understand how their personal information is processed.
Although current law requires personal information handlers to draft and disclose privacy policies detailing personal information processing, there have been criticisms that these policies are often formalistic and complex, limiting the protection of rights.
The drafting guidelines require that privacy policies include important matters such as the cross-border transfer of personal information, consent for children under 14 years old, and processing of personal information in emergency situations.
They also provide examples of incorrect cases such as ambiguous drafting and cautionary notes, and require overseas businesses to draft privacy policies in Korean as well.
Moreover, a Personal Information Processing Labeling system will be introduced. This system uses symbols to help data subjects easily identify key points of the privacy policy, which will be summarized and disclosed at the beginning of the policy.
However, the Personal Information Protection Commission explained that the drafting guidelines are advisory and not mandatory.
The Commission plans to strengthen related education and publicity in cooperation with relevant organizations and continuously improve the system. Yoon Jong-in, Chairperson of the Personal Information Protection Commission, said, "We hope that the newly released guide and drafting guidelines will serve as an opportunity for data subjects to fully understand and protect their personal information processing."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
