Personal information protection: issues easily overlooked in business-to-business contracts

It is well known that personal information protection is an important legal issue for companies that handle large volumes of customer personal information, such as online shopping malls, financial companies and hospitals. However, legal issues involving personal information also arise when an ordinary manufacturer manages the contact details of its business partners' staff, when a company outsources customer acquisition to an outside vendor, or when it runs its customer management system on an overseas cloud service. Even companies that do not specialize in handling personal information collect and use a wide range of it in the course of everyday business.

The legal risks of personal information protection are not limited to data breaches. The way personal information is collected, or provided to other companies, may itself violate the law. In fact, the matters sanctioned by the Personal Information Protection Commission include not only data leaks but a wide range of violations, such as unlawful collection and use of personal information, provision to third parties, overseas transfers and breaches of the duty to take security measures.

The Personal Information Protection Act is the basic law governing the processing of personal information. Collecting or using personal information, or providing it to a third party, requires a legal basis, and obligations regarding the purpose of processing, the retention period, security measures and destruction must also be observed. Depending on the type of business and the nature of the information, obligations under other laws may be added, such as the Act on the Consumer Protection in Electronic Commerce, the Credit Information Use and Protection Act and the Medical Service Act. In electronic commerce, for example, certain transaction records may have to be retained for a statutory period regardless of a request to delete personal information.

The consequences of a violation are not light either. The Personal Information Protection Act provides for corrective orders, penalty surcharges, administrative fines and criminal penalties depending on the violation, and liability for damages can also be at issue. In particular, penalty surcharges for certain violations are calculated based on revenue, and aggravated sanctions are possible for serious violations. Personal information protection is therefore not merely a matter of responding after an incident; it must be reviewed from the stage at which a company collects and uses information.

In advising companies, we have reviewed a wide range of personal information protection issues. One that frequently comes up is which company should collect and manage the personal information. Suppose, for example, that Company A engages Marketing Firm B to recruit new customers. The legal requirements to be reviewed and the allocation of liability differ depending on whether Company A collects the personal information directly and entrusts its processing to Firm B, or Firm B collects the personal information and then provides it to Company A.

In particular, it is important to distinguish outsourcing of personal information processing from provision to a third party. The legal relationship can differ between a case in which a marketing firm processes personal information on behalf of the commissioning company and under its instructions, and a case in which a marketing firm provides the commissioning company with personal information it collected for its own purposes and under its own authority. Labeling the arrangement as outsourcing of processing in the contract does not necessarily mean the actual legal relationship will be recognized as outsourcing, and obtaining consent to provision to a third party does not by itself satisfy every obligation regarding the processing of personal information.

At this point, it is not enough simply to review which structure is legally permissible. The parties must also consider which company may use the customer information in the future, who will maintain the customer relationship after the contract ends, and who bears what liability if a personal information issue arises. Depending on the actual business structure, the parties need to set the scope of use of personal information, the conditions for sub-outsourcing, security measures, notification and cooperation duties in the event of an incident, return and deletion after the contract ends, and liability for damages. In the end, the legal review of personal information protection becomes part of the process of deciding the business structure and the contract terms.

In addition, if an outside vendor misuses or leaks personal information, the commissioning company's legal liability is not automatically eliminated just because the contract makes the vendor bear all liability. On the other hand, damages and reimbursement between the parties can depend on the terms of the contract. It is therefore necessary to review legal obligations and the contractual allocation of liability separately.

As more Korean companies enter into service contracts with companies in the United States and other countries, or use overseas cloud and marketing services, the points to review on personal information protection are also becoming more complex. One issue requiring particular attention is the overseas transfer of personal information. When a Korean company sends customer information to an overseas headquarters or affiliate, entrusts the processing of personal information to an overseas vendor, or stores it on overseas servers, it must review the requirements for overseas transfers under the Personal Information Protection Act. Because overseas transfers can include not only provision to third parties but also outsourcing of processing or storage abroad, a company should not conclude that it has no obligations simply because it does not sell or provide personal information to overseas vendors.

U.S. privacy laws must be reviewed as well. Unlike Korea, the United States has no single comprehensive federal privacy law that applies uniformly to all companies; the area is governed by state laws and sector-specific federal laws. A leading example is the California Consumer Privacy Act (CCPA), which applies to businesses that meet certain thresholds and specifically sets out what must be included in contracts with businesses that process personal information. Accordingly, when a Korean company contracts with a U.S. company, it should identify the U.S. laws that apply to the transaction and distinguish the obligations it bears directly by law from those it takes on additionally through the contract.

When reviewing service contracts with U.S. companies, we sometimes see a separate data protection addendum that sets out not only who processes the personal information and the conditions for sub-outsourcing, but also specific performance standards such as encryption, access rights, the frequency of security audits, the deadline for notice of an incident, and the return and deletion of information.

In these contracts, it is necessary to review not only compliance with the relevant laws but also whether each obligation can actually be performed and what liability follows. For example, if the contract requires notice within 24 hours after an incident or security audits at set intervals, the company should confirm whether it can actually perform those obligations and what contractual liability it would bear for a breach. This is because accepting contractual standards stricter than the legal obligations can lead to liability for breach of contract even where no law has been violated.

Contracts with U.S. companies sometimes also include an obligation to comply with the European Union's General Data Protection Regulation (GDPR). What matters here is distinguishing whether the GDPR applies directly to the transaction or whether the company takes on additional compliance obligations by contract. In particular, when a company accepts a contractual obligation to comply with the GDPR, it should review what restrictions and liabilities this creates for its actual operations. It should confirm whether the obligations regarding the purposes and scope of use of personal information, sub-outsourcing, security measures, incident response and the handling of information after the contract ends fit its business model and operating systems, and, where necessary, adjust the scope of the obligations and the contractual liability.

Ultimately, personal information protection is not a problem solved merely by drafting a privacy policy or adding a confidentiality clause to a contract. A company needs to confirm who collects personal information and for what purposes it is used, how it is shared with outside vendors, and which laws apply if it is transferred abroad. It must then reflect these legal judgments in its actual business practices and in its contractual obligations and allocation of liability. The legal review for personal information protection should begin not after a problem arises, but at the stage of setting the business structure and entering into contracts.