The Personal Information Protection Commission has released a revised ‘Guideline for Preparing Personal Information Processing Policies’. According to the Personal Information Protection Act, personal information processors must draft and disclose personal information processing policies appropriately and transparently. This revised guideline is designed to help personal information processors establish effective processing policies in anticipation of the policy evaluation set to begin in 2025.
Firstly, in relation to the ‘Personal Information Consent System’, revamped last September, the guideline clarifies, with numerous examples, which personal information items can be processed without consent and which require consent. For example, matters concerning the execution and performance of contracts, such as membership services, can be processed without consent. However, sensitive information, unique identification information, and the provision of personal information to third parties can only be processed with consent, even when related to contract execution and performance.
The revision has also eased the specificity required when detailing the personal information items processed and their retention and usage periods. Previously, all items had to be specifically listed, but going forward, exceptions for categorical reporting are allowed if there are special circumstances that make specific listing difficult.
Additionally, it requires personal information processors to provide contact information for the department directly handling complaints related to personal data. The disclosure method has been diversified to ensure that information subjects can easily access it, considering mobile application environments, among others. There is also a detailed guide on the procedures for exercising the rights of information subjects, including how to request data transfer. The collection, use, provision, and refusal of behavioral data have been clarified.
The Personal Information Protection Commission plans to hold a briefing session on the revised guidelines on the 28th at the Korea Science and Technology Center in Gangnam, Seoul. The revised guidelines are available on the commission’s website and the personal information portal.
The commission representatives stated, “This revision aims to practically ensure the rights of information subjects while reducing the burden on personal information processors.” They added that the structure of the items drafted was reorganized reflecting the improvement suggestions made by the Personal Information Processing Policy Evaluation Committee in 2024, clearly distinguishing between legally mandatory items and policy-recommended items.