Collection/Use of Personal Information

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.1.1 Collection/Use of Personal Information], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When personal information is collected, the lawful requirements under the relevant laws, such as the data subject's consent, compliance with statutory obligations, and the conclusion/performance of a contract, must be clearly identified, and personal information must be collected lawfully in accordance therewith.

• Clearly identify the lawful requirements for collecting personal information for each personal information collection channel, and record/manage the relevant basis so that it can be proven

  • For example, where personal information is collected without the data subject's consent because there is a special provision in a statute or in order to comply with a statutory obligation, document the relevant basis such as the provision of the applicable Act or subordinate statute

• A personal information controller may collect personal information in any of the following cases, and may use it within the scope of the collection purpose

  Cases in which personal information may be collected (Personal Information Protection Act, Article 15(1))

  1. Where the consent of the data subject is obtained
  2. Where there is a special provision in a statute or where it is unavoidable in order to comply with a statutory obligation
  3. Where it is unavoidable for a public institution to perform its duties under its jurisdiction as prescribed by statutes, etc.
  4. Where it is necessary to perform a contract concluded with the data subject or to take measures requested by the data subject in the course of concluding a contract
  5. Where it is deemed manifestly necessary for the urgent benefit of the life, body, or property of the data subject or a third party
  6. Where it is necessary to achieve the legitimate interests of the personal information controller and such interests manifestly override the rights of the data subject. In this case, it is limited to cases substantially related to the legitimate interests of the personal information controller and not exceeding a reasonable scope.
  7. Where it is urgently necessary for public safety and security, including public health

When obtaining the data subject's consent to the collection of personal information, the data subject's consent must be obtained by an appropriate method that reflects the characteristics of the personal information collection medium, and the information must be collected at the point in time when it is needed.

• Consent to the collection of personal information must be obtained from the data subject by an appropriate method, taking into account the following matters according to the characteristics of the collection medium

  Methods of obtaining consent to the processing of personal information (Enforcement Decree of the Personal Information Protection Act, Article 17(2))

  1. A method of directly issuing to the data subject a document stating the consent content, or delivering it by mail, fax, or the like, and receiving a consent form signed or sealed by the data subject
  2. A method of informing the data subject of the consent content by telephone and confirming the expression of intent to consent
  3. A method of informing the data subject of the consent content by telephone, having the data subject confirm the matters of consent via an internet address, etc., and then confirming the expression of intent to consent to those matters again by telephone
  4. A method of posting the consent content on an internet website, etc., and having the data subject indicate whether they consent
  5. A method of sending an email stating the consent content and receiving from the data subject an email stating the expression of intent to consent
  6. In addition, a method equivalent to the methods under subparagraphs 1 through 5 of informing the consent content and confirming the expression of intent to consent

• Personal information must not be collected comprehensively in advance at the membership registration stage; it must be collected at the point in time when the information is needed

  • Consent to collection/use must be obtained only for the personal information necessary to commence the service, and for services provided thereafter, consent must be obtained at the point of providing the relevant service
  • Personal information needed only for the use of a specific service within a website at website membership registration is collected at the point of using the relevant service
  • However, in the case of a repetitive service, where consent is obtained by classifying it as an optional consent item at the point of the first use of the service, collection/use is possible

When obtaining the data subject's consent to the collection of personal information, the statutory notification matters must be clearly notified and consent obtained, and the important content prescribed by law must be clearly indicated so that the data subject can easily recognize it.

• When obtaining the data subject's consent to the collection/use of personal information, the four statutory notification matters must be notified specifically and clearly and consent obtained

  Notification matters when obtaining consent to the collection/use of personal information (Personal Information Protection Act, Article 15(2))

  1. The purpose of the collection/use of personal information
  2. The items of personal information to be collected
  3. The retention and use period of the personal information
  4. The fact that the data subject has the right to refuse consent, and, if there is any disadvantage due to the refusal of consent, the content of such disadvantage

• For the data subject's consent to be lawful, the lawful requirements must all be met, such as the determination of whether to consent according to the data subject's free will and the specificity and clarity of the consent content

  Conditions to be met when obtaining the data subject's consent (Enforcement Decree of the Personal Information Protection Act, Article 17(1))

  1. The data subject shall be able to determine whether to consent according to their free will
  2. The content for which consent is sought shall be specific and clear
  3. Wording that can be easily read and understood shall be used
  4. A method by which the data subject can clearly indicate whether they consent shall be provided to the data subject

  ※ However, this provision takes effect on September 15, 2024

• Pursuant to Article 22 (Methods of Obtaining Consent), paragraph 2 of the Personal Information Protection Act, when consent to the processing of personal information is obtained in writing (including electronic documents under Article 2, subparagraph 1 of the Framework Act on Electronic Documents and Transactions), the important content must be clearly indicated so as to be easy to recognize as follows

  Important content that must be clearly indicated (Enforcement Decree of the Personal Information Protection Act, Article 17(3))

  • Among the purposes of the collection/use of personal information, the fact that the data subject may be contacted using the relevant personal information for the promotion or sales solicitation of goods or services
  • Among the personal information items to be processed, sensitive information, passport numbers, driver's license numbers, and alien registration numbers
  • The retention and use period of the personal information (in the case of provision, the retention and use period of the recipient)
  • The recipient of the personal information and the recipient's purpose of using the personal information

  Method of indicating important content (Notice on the Method of Personal Information Processing, Article 4)

  • Ensure that the content is clearly indicated through the size, color, or thickness of the font, underlining, or the like
  • Where there are many consent matters and it is difficult to clearly distinguish the important content, indicate the important content separately from the other content so that it can be easily identified

  ※ Indicate so that the data subject can easily recognize it, taking into account the characteristics of the medium requiring written consent, such as paper printouts and computer display screens, and the data subject's usage environment

※ For details, refer to the "Guide to Consent to Personal Information Processing (Personal Information Protection Commission)"

When obtaining consent for the collection/use/provision, etc. of the personal information of a child under the age of 14, the necessary matters must be notified to the legal representative and consent obtained.

• Where there is no need to process the personal information of a child under the age of 14, take measures not to collect the personal information of a child under the age of 14 through an appropriate age verification procedure

• Where there is a need to process the personal information of a child under the age of 14, take measures to be able to obtain the legal representative's consent by preparing a separate collection consent form and a legal representative verification procedure

  Methods of verifying whether the legal representative has consented (Enforcement Decree of the Personal Information Protection Act, Article 17-2(1))

  1. A method of having the legal representative indicate whether they consent on an internet site where the consent content is posted, and notifying the legal representative by mobile phone text message that the personal information controller has confirmed the indication of consent
  2. A method of having the legal representative indicate whether they consent on an internet site where the consent content is posted, and being provided with the card information of the legal representative's credit card/debit card, etc.
  3. A method of having the legal representative indicate whether they consent on an internet site where the consent content is posted, and verifying identity through the legal representative's mobile phone identity authentication, etc.
  4. A method of directly issuing to the legal representative a document stating the consent content, or delivering it by mail or fax, and having the legal representative sign and seal the consent content and then submit it
  5. A method of sending an email stating the consent content and receiving from the legal representative an email stating the expression of intent to consent
  6. A method of informing the legal representative of the consent content by telephone and obtaining consent, or guiding a method by which the consent content can be confirmed such as an internet address, and obtaining consent again through a telephone call
  7. In addition, a method equivalent to the methods under subparagraphs 1 through 6 of informing the legal representative of the consent content and confirming the expression of intent to consent

Only the minimum information necessary to obtain the legal representative's consent (information on name/contact details) must be collected, and procedures and methods to verify whether the legal representative meets the eligibility requirements must be prepared.

• The minimum information necessary to obtain the legal representative's consent (information on the legal representative's name/contact details) may be collected directly from the child without the legal representative's consent
  • However, when collecting the legal representative's name/contact details, the child must be informed of the collector's identity and contact details and the reason for collecting the legal representative's name and contact details (Standard Personal Information Protection Guideline, Article 13(1))
  • The legal representative's personal information collected from the child must be used only for the purpose of obtaining consent
• To obtain the legal representative's consent, it must be verified whether the information provided by the child is that of a genuine legal representative and whether the legal representative is authentic
  • Verifying whether the legal representative is a minor
  • Verifying the age difference with the child, etc.
  • ※ (Reference) Legal representative of a minor
    • Primarily, a person with parental authority, such as the child's parents, is the legal representative (Civil Act, Article 911)
    • Where a minor has no parents or the parents cannot exercise parental authority, a guardian secondarily becomes the legal representative, and the guardian follows the order of designated guardian (Civil Act, Article 931) and appointed guardian (Civil Act, Article 932)
• Where the legal representative refuses consent, or the legal representative's intent to consent is not confirmed, the information must be destroyed within 5 days from the date of collection (Standard Personal Information Protection Guideline, Article 13(2))

When notifying a child under the age of 14 of matters related to personal information processing, etc., they must be expressed in an easy-to-understand format and in clear and easy-to-understand language.

• Convey information transparently in a child-friendly manner, such as language, pictures, and videos that are easy for the child to understand

• Take into account the capabilities and usage behavior of children by age group

  ※ For details, refer to the "Guideline on the Protection of Children/Adolescents' Personal Information (Personal Information Protection Commission)"

Records of consent obtained from data subjects and legal representatives must be kept and retained so that the lawful basis for consent to the collection/use of personal information can be proven.

• Matters to be recorded: date and time of consent, items consented to, the consenting party (in the case of consent by a legal representative, the legal representative's information), the method of consent, etc.
• Retention period: until the relevant personal information is destroyed due to membership withdrawal, etc.

For personal information that may be processed without the data subject's consent, its items and the legal basis for processing must be disclosed in the privacy policy separately from personal information processed with the data subject's consent, or notified to the data subject by a method such as in writing.

• Cases in which the collection/use of personal information is possible without the data subject's consent: cases falling under subparagraphs 2 through 7 of Article 15(1) of the Personal Information Protection Act
• Matters to be notified to the data subject: the items of personal information that may be processed without consent and the legal basis for processing
• Method of notifying the data subject: disclose in the privacy policy separately from personal information processed with consent, or notify the data subject by a method such as in writing (in writing, by email, fax, telephone, text message, or an equivalent method)

When personal information is additionally used without the data subject's consent, a decision-making standard for the matters to be considered, such as the relevance to the original collection purpose, foreseeability, whether interests are infringed, and measures to ensure safety, must be established/implemented, and where additional use occurs continuously, this must be disclosed in the privacy policy and compliance with the standard reviewed.

Matters to be considered upon additional use of personal information (Enforcement Decree of the Personal Information Protection Act, Article 14-2(1))

1. Whether there is relevance to the original collection purpose
2. Whether there is foreseeability of the additional use or provision of personal information in light of the circumstances in which the personal information was collected or the processing practices
3. Whether the interests of the data subject are unfairly infringed
4. Whether measures necessary to ensure safety, such as pseudonymization or encryption, have been taken