It is well known that personal data protection is a key legal issue for companies that handle large volumes of customer data, such as online retailers, financial institutions and hospitals. Yet personal data issues also arise when an ordinary manufacturer keeps contact details for its business partners' staff, when a company outsources customer acquisition to an outside agency, or when it runs its customer management system on an overseas cloud service. Even companies that do not specialize in handling personal data collect and use a wide range of it in the ordinary course of business.
The legal risks of personal data protection are not limited to data breaches. The way personal data is collected, or provided to other companies, may itself violate the law. In practice, the sanctions imposed by Korea's Personal Information Protection Commission cover not only data leaks but a wide range of violations, including unlawful collection and use of personal data, unlawful provision to third parties, unlawful cross-border transfers and failure to take required security measures.
The Personal Information Protection Act is Korea's basic law governing the processing of personal data. Collecting, using or providing personal data to a third party requires a legal basis, and companies must also comply with obligations on processing purposes, retention periods, security measures and destruction. Depending on the type of business and the nature of the information, obligations under other laws may apply as well, such as the Act on the Consumer Protection in Electronic Commerce, the Credit Information Use and Protection Act and the Medical Service Act. In e-commerce, for example, certain transaction records may have to be kept for a statutory period regardless of a request to delete personal data.
The consequences of a violation are serious. The Personal Information Protection Act provides for corrective orders, administrative fines, penalties and criminal sanctions depending on the violation, and civil liability for damages may also be at issue. Fines for certain violations are calculated on the basis of revenue, and aggravated sanctions are available for serious violations. Personal data protection is therefore not just a matter of responding after an incident; it must be reviewed from the stage at which a company collects and uses information.
In advising companies, we have reviewed a wide range of personal data protection issues. One of the most common is which company should collect and manage the personal data. Suppose Company A engages Marketing Agency B to recruit new customers. The legal requirements and allocation of responsibility differ depending on whether Company A collects the personal data itself and entrusts B with processing it, or whether B collects the personal data and then provides it to Company A.
It is especially important to distinguish outsourced processing of personal data from provision to a third party. The legal relationship may differ between a case in which the marketing agency processes personal data on the client's behalf and under its instructions, and a case in which the agency provides the client with personal data it collected for its own purposes and under its own authority. Describing an arrangement as outsourced processing in the contract does not guarantee that it will be treated as such, and obtaining consent to third-party provision does not by itself satisfy every obligation relating to the processing of personal data.
It is not enough simply to ask which structure is legally permissible. Companies also need to consider which company will be able to use the customer data going forward, who will maintain the customer relationship after the contract ends, and who bears what responsibility if a personal data problem arises. Depending on the actual operating structure, the contract should set out the permitted scope of use, conditions for subcontracting, security measures, notification and cooperation duties in the event of an incident, and return, deletion and liability for damages after termination. In the end, the legal review of personal data protection becomes part of deciding the business structure and the terms of the contract.
Moreover, if an outside vendor misuses or leaks personal data, a contract clause making the vendor bear all responsibility does not automatically relieve the client of its own legal liability. Damages and indemnification between the parties, on the other hand, may depend on the terms of the contract. Statutory obligations and the contractual allocation of liability therefore need to be reviewed separately.
As more Korean companies sign service agreements with U.S. and other foreign companies, or use overseas cloud and marketing services, the issues to review in personal data protection are becoming more complex. One issue that requires particular care is the cross-border transfer of personal data. When a Korean company sends customer data to an overseas headquarters or affiliate, entrusts its processing to a foreign vendor or stores it on overseas servers, it must review the cross-border transfer requirements under the Personal Information Protection Act. Cross-border transfers can include not only provision to third parties but also outsourced processing and storage abroad, so a company should not conclude that no obligations apply simply because it does not sell or provide personal data to foreign companies.
U.S. privacy law must also be reviewed. Unlike Korea, the United States has no single comprehensive federal privacy law that applies uniformly to all businesses; privacy is governed by state laws and sector-specific federal laws. A leading example is the California Consumer Privacy Act (CCPA), which applies to businesses that meet certain thresholds and specifies in detail what must be included in contracts with service providers that process personal information. When a Korean company contracts with a U.S. company, it should therefore identify which U.S. laws apply to the transaction and distinguish obligations it bears directly under the law from additional obligations it takes on under the contract.
In reviewing service agreements with U.S. companies, we often see a separate data protection addendum that specifies not only who processes the personal data and the conditions for subcontracting, but also detailed operational standards such as encryption, access rights, the frequency of security audits, notification deadlines in the event of an incident, and the return and deletion of data.
In such contracts, it is necessary to review not only compliance with the applicable laws but also whether each obligation can actually be performed and what liability attaches to it. If the contract requires notification within 24 hours of an incident or security audits at set intervals, for instance, the company must confirm that it can actually meet those obligations and what contractual liability it faces if it does not. Accepting contractual standards stricter than the law requires can give rise to liability for breach of contract even where no law has been violated.
Contracts with U.S. companies sometimes also include an obligation to comply with the European Union's General Data Protection Regulation (GDPR). The key point here is to distinguish whether the GDPR applies directly to the transaction or whether the company is taking on additional compliance obligations by contract. Where a company accepts a contractual obligation to comply with the GDPR, it should review what restrictions and liabilities this creates for its actual operations. It should confirm that obligations on the purpose and scope of use, subcontracting, security measures, incident response and post-termination handling of data fit its business model and operations, and where necessary, adjust the scope of those obligations and the related contractual liability.
Ultimately, personal data protection is not solved simply by drafting a privacy policy or adding a confidentiality clause to a contract. Companies need to know who collects personal data and for what purpose, how it is shared with outside vendors, and which laws apply when it is transferred abroad. They must then reflect these legal judgments in their actual business practices and in the contractual allocation of obligations and liability. Legal review for personal data protection should begin when the business structure is being set and the contract is being signed, not after a problem has occurred.
Related practice: Corporate & Business Advisory