한국어
3.2.3

Protection of User Device Access

Based on official sourcesISMS-PCheckpoints 3Evidence 2Cases 4

Certification criterion

When access is needed to information stored in the mobile communication terminal device of a data subject (user) and to functions installed on the mobile communication terminal device, the data subject (user) must be notified so that they can clearly recognize this, and the consent of the data subject (user) must be obtained.

Key checkpoints

  1. When permission to access information stored in the mobile communication terminal device of a data subject (user) and functions installed on the mobile communication terminal device is needed, is the data subject (user) notified so that they can clearly recognize this, and is the consent of the data subject (user) obtained?
  2. Where an access permission on the mobile communication terminal device is not strictly necessary to provide the relevant service, is the provision of the service not refused even if the data subject (user) does not consent?
  3. On the mobile communication terminal device, are methods provided for the data subject (user) to consent to and withdraw consent for the relevant access permission?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.2.3 Protection of User Device Access], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When permission to access information stored in the mobile communication terminal device of a data subject (user) and functions installed on the mobile communication terminal device is needed, the data subject (user) must be notified of the relevant matters so that they can clearly recognize them, and the consent of the data subject (user) must be obtained.

※ Scope of mobile communication terminal devices

  • Applies to smartphones and tablet PCs capable of mobile communication

  • 2G mobile communication terminal devices are excluded from the scope, as they are in effect not environments in which apps can operate

  • Devices that do not use the mobile communication network and merely perform functions such as Bluetooth, Wi-Fi, or tethering are excluded from the scope of application

  • For smartwatches, considering that it is difficult to immediately implement notification/consent functions for access permissions due to constraints such as screen size, it is recommended to set only essential access permissions for now (however, from the point at which devices with notification/consent functions implemented are manufactured, the same rules as for smartphones and tablet PCs apply)

  • An app must minimize its permissions to access information stored in the smartphone and installed functions to within the scope necessary for the service

  • Before obtaining consent for access permissions, the access permissions strictly necessary to provide the relevant service (hereinafter "essential access permissions") and the access permissions that are not strictly necessary (hereinafter "optional access permissions") must be distinguished, the items requiring access permission and the reasons therefor must be disclosed to the data subject (user) in an easy-to-understand manner, and consent for the essential/optional access permissions must be obtained separately from the data subject (user)

    • (For essential access permissions) The following must be notified: (1) the items of information and functions requiring access permission, and (2) the reason access to that information and those functions is needed
    • (For optional access permissions) In addition to (1) and (2) above, (3) the fact that the data subject may decline to consent to allowing the access permission must be notified

Where an access permission on the mobile communication terminal device is not strictly necessary to provide the relevant service, the provision of the service must not be refused even if the data subject (user) does not consent.

On the mobile communication terminal device, methods for the data subject (user) to consent to and withdraw consent for the relevant access permission must be provided.

  • (Operating systems that allow individual consent selection, Android 6.0 or higher and iPhone) Even if the data subject (user) has already consented to access permissions, they can reset the access permissions for each app by using the per-app/per-access-permission consent withdrawal function provided by that operating system
  • (Operating systems that do not allow individual consent selection) Because a per-access-permission denial function is not implemented, only essential access permissions are set in principle; therefore, if a data subject (user) wishes to withdraw consent for such essential access permissions, they can simply delete the already installed app. However, even on such an operating system, if the app itself has implemented a function that sets optional access permissions and allows the user to choose whether to consent to them, the user can reset access permissions by using the consent withdrawal function provided by that app

※ For details, refer to the "Guide on Personal Information Protection for Smartphone App Access Permissions"

Related laws

  • Network Act Article 22-2 (Consent to Access Permissions)

Evidence (examples)

  • App access permission consent screen
  • Status of app access permission settings

Nonconformity examples

  • A case where a smartphone app excessively sets permissions to access personal information areas within the smartphone, such as the address book, photos, and text messages, even though they are unnecessary for the service
  • A case where an information and communications service provider's smartphone app accesses information stored in the smartphone and installed functions without providing notification of and obtaining consent for the access permissions
  • A case where, when obtaining consent for a smartphone app's access permissions, permissions that are optional are presented as essential permissions and consent is obtained
  • A case where an optional access permission is set together when distributing a smartphone app that supports Android versions lower than 6.0, on which individual consent to access permissions is not possible, such that the optional access permission cannot be declined

Source

Source: The certification criterion is based on [Annex 7-2] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2024.7.24); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2024.7.24); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7-2
Applies toISMS-P
Key checkpoints3
Evidence2
Cases4
Related lawsYes
Annex 7 / 3.2.3Annex 7