Personal Information Commission to Gradually Improve Mandatory Consent Practices
Protection Act Enforcement Decree to Take Effect from the 15th
Consent Decision to Be Free and Wording Simplified
Regulations requiring online businesses to clearly display consent for the collection and use of personal information in language that is easy for users to understand will be enforced. However, the practice of formal mandatory consent for personal information will be improved. Information essential for service use can be collected and used without user consent.
The Personal Information Protection Commission announced on the 12th that the enforcement decree of the Personal Information Protection Act containing these provisions will take effect from the 15th. Following the amendment of the law in September last year, personal information can be collected and used without the consent of the data subject (user) when necessary for fulfilling service contracts.
From the 15th, principles and methods to be followed when collecting and using personal information with consent will be enforced under the protection law.
The Personal Information Protection Commission stated, "It will be clearly indicated that personal information can be collected and used without consent in relation to service use contracts such as website registration." They added, "We will gradually improve the practice of mandatory consent by providing guidance on measures to ensure that the data subject’s choice is not restricted when consent is required in areas unrelated to the contract."
Since 1999, online businesses have been required to obtain mandatory consent when providing services, and users have been unable to use services without giving consent. This practice of mandatory consent has also long persisted in the public sector and offline sectors except in unavoidable cases.
As a result, companies faced the issue of having to obtain user consent even when necessary for service provision contracts. For example, an internet shopping mall must obtain essential information such as address, contact details, and payment information from customers to fulfill contracts including payment, delivery, and after-sales service.
When collecting and using personal information unrelated to contract fulfillment, easy-to-understand language must be used to fully inform the data subject of the consent content. Additionally, measures must be taken to allow users to freely decide whether to consent.
The enforcement decree includes provisions such as ▲the content for which consent is sought must be specific and clear ▲language used must be easy to read and understand ▲methods must be provided to the data subject to clearly indicate consent or refusal.
This would apply, for example, when a shopping mall business collects and uses personal information such as marital status or occupation for product development purposes. In hospitals, it could apply when collecting and using related personal information for clinical trials unrelated to medical treatment contracts.
Businesses must take measures to distinguish and disclose personal information collected with consent from that collected without consent so that users can understand how their personal information is being processed.
For sensitive information and unique identifiers such as passport numbers, driver’s license numbers, and criminal record data, users must be fully informed of the consent content and separately provide mandatory consent before processing. However, if stipulated by law, processing without consent is permitted.
The Personal Information Protection Commission plans to prepare a 'Comprehensive Guide to Personal Information Processing' by the end of the year to prevent confusion in the field and provide guidance on specific cases. The guide will comprehensively present compliance requirements at each stage of personal information processing with case-centered examples.
Yang Cheong-sam, Director of the Personal Information Policy Bureau at the Personal Information Protection Commission, said, "Considering that mandatory consent has been a system in place for over 20 years, we will continue to communicate with the industry and discover lawful personal information processing cases." He added, "We plan to promote and guide the revised system through briefings and other means to ensure it is smoothly established in the field."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
