Provision of Personal Information to Third Parties

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.3.1 Provision of Personal Information to Third Parties], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When personal information is provided to a third party, the lawful requirements under the relevant laws, such as data subject consent and compliance with statutory obligations, must be clearly identified, and personal information must be provided lawfully accordingly.

• Scope of third party

  • All persons except the data subject and the personal information controller that collects/holds personal information about the data subject (other departments and organizations within the same personal information controller do not constitute a third party)

  ※ Provision of personal information to a third party (examples)

  • Physically transferring a storage medium containing personal information or printouts/booklets containing personal information
  • Transmission of personal information over a network
  • Granting a third party access rights to personal information
  • Sharing of personal information between the personal information controller and a third party
  • Any other act that results in the transfer or joint use of personal information

• Clearly identify the lawful requirements for providing personal information by each provision route, and record/manage the relevant grounds so that they can be substantiated

  • For example, where personal information is provided without the consent of the data subject because there are special provisions in a statute or in order to comply with a statutory obligation, document the relevant grounds such as the provisions of the applicable statute or law

• A personal information controller may provide (including sharing) personal information to a third party in any of the following cases

  Cases in which provision of personal information to a third party is permitted (Personal Information Protection Act, Article 17(1))

  1. Where the consent of the data subject is obtained
  2. Where there are special provisions in a statute or where it is unavoidable in order to comply with a statutory obligation
  3. Where it is unavoidable for a public institution to perform its duties under its jurisdiction as prescribed by statutes, etc.
  4. Where it is clearly deemed necessary for the imminent life, body, or property interests of the data subject or a third party
  5. Where it is necessary to achieve the legitimate interests of the personal information controller and such interests clearly take precedence over the rights of the data subject. In this case, it is limited to cases that are substantially related to the legitimate interests of the personal information controller and do not exceed a reasonable scope.
  6. Where it is urgently necessary for public safety and welfare, such as public health

  ※ Personal information collected under items 2 through 6 above may be provided without the consent of the data subject within the scope of the purpose for which it was collected

Consent for the provision of personal information to a third party must be obtained separately from consent for collection/use, etc., and unless the provision to a third party is essential for performing the fundamental functions of the service, the provision of the service must not be refused on the grounds that the data subject does not consent to it.

Cases requiring separation of consent items (Personal Information Protection Act, Article 22(1))

1. Where consent is obtained under Article 15(1)1 (consent to collection/use of personal information)
2. Where consent is obtained under Article 17(1)1 (consent to provision of personal information to a third party)
3. Where consent is obtained under Article 18(2)1 (consent to use/provision of personal information beyond the purpose)
4. Where consent is obtained under Article 19, Subparagraph 1 (consent to a recipient's use/provision of the personal information beyond the purpose)
5. Where consent is obtained under Article 23(1)1 (consent to processing of sensitive information)
6. Where consent is obtained under Article 24(1)1 (consent to processing of unique identifying information)
7. Where consent to the processing of personal information is sought in order to promote or solicit the sale of goods or services

※ Indicate separately so that the data subject can clearly recognize the fact that they may choose whether to consent

When obtaining consent from the data subject for the provision of personal information to a third party, the relevant contents must be clearly notified, and the important matters prescribed by law must be clearly indicated so that they are easy to recognize.

• When obtaining consent from the data subject for the provision of personal information to a third party, the five statutory notification matters must be informed specifically and clearly, and consent must be obtained

  Matters to be notified when obtaining consent to provision of personal information to a third party (Personal Information Protection Act, Article 17(2))

  1. The recipient of the personal information
  2. The purpose for which the recipient uses the personal information
  3. The items of personal information to be provided
  4. The period for which the recipient retains and uses the personal information
  5. The fact that the data subject has the right to refuse consent, and, if there is any disadvantage resulting from the refusal of consent, the content of such disadvantage

• For the consent of the data subject to be lawful, all lawful requirements must be satisfied, such as the data subject's decision on whether to consent based on their free will, and the specificity and clarity of the content of the consent

  Conditions to be satisfied when obtaining the consent of the data subject (Enforcement Decree of the Personal Information Protection Act, Article 17(1))

  1. The data subject shall be able to decide whether to consent based on their free will
  2. The content for which consent is sought shall be specific and clear
  3. Wording that is easy to read and understand shall be used
  4. A method by which the data subject can clearly indicate whether they consent shall be provided to the data subject

  ※ However, this provision takes effect from September 15, 2024

• Pursuant to Article 22 (Methods of Obtaining Consent), Paragraph 2 of the Personal Information Protection Act, when obtaining consent to the processing of personal information in writing (including electronic documents under Article 2, Subparagraph 1 of the Framework Act on Electronic Documents and Transactions), the important matters must be clearly indicated so that they are easy to recognize, as follows

  Important matters to be clearly indicated (Enforcement Decree of the Personal Information Protection Act, Article 17(3))

  • The fact that the data subject may be contacted using the personal information for purposes such as the promotion or solicitation of goods or services, among the purposes of collection/use of personal information
  • Sensitive information, passport numbers, driver's license numbers, and alien registration numbers, among the items of personal information being processed
  • The retention and use period of the personal information (in the case of provision, the retention and use period of the recipient)
  • The recipient of the personal information and the purpose for which the recipient uses the personal information

  Method of indicating important content (Notice on the Method of Personal Information Processing, Article 4)

  • Ensure that the content is clearly indicated through font size, color, boldness, underlining, etc.
  • Where there are many consent items and it is difficult to clearly distinguish the important content, indicate the important content separately from other content so that it can be easily identified

  ※ For details, refer to the "Easy-to-Understand Guide to Consent for Personal Information Processing (Personal Information Protection Commission)"

When personal information is provided to a third party, it must be limited to the minimum personal information items appropriate for the purpose of provision.

• Upon provision to a third party based on consent: Only the minimum personal information items necessary to achieve the purpose of provision notified at the time of consent must be provided
• Upon provision to a third party based on statute: Only the minimum personal information items must be provided within the scope specifically stated in the statute or necessary to comply with the obligation under the applicable statute

In the process of providing personal information to a third party, it must be provided through safe procedures and methods so that personal information is not leaked/exposed, and the related records of provision must be recorded and retained.

※ Safe procedures when providing to a third party (examples)

• Clarification of the responsibility relationship regarding the assurance of safety between the provider and the recipient of personal information (contracts, etc.)
• Approval procedures related to provision to a third party (when provided by a person in charge)
• Encryption during the transmission or transfer process
• Application of measures to ensure safety, such as access control and access rights management
• Preservation of records of provision, etc.

※ Contents to be included in the records of provision to a third party (examples)

• The recipient
• The date and time of provision
• The personal information provided: identifying information of the data subject and personal information items
• The purpose or grounds of provision
• The provider (person in charge): including the approver where there is an approval procedure
• The method of provision: system linkage, email transmission, etc.
• Other necessary information

When allowing a third party to access personal information, it must be controlled in accordance with protective procedures to securely protect personal information.

• Secure authentication and access control measures so that only authorized persons can access
• Encryption measures to prevent eavesdropping in the transmission section
• Preservation of access records to ensure accountability, etc.

When personal information is additionally provided without the consent of the data subject, judgment criteria for the considerations such as relevance to the original purpose of collection, foreseeability, whether it infringes upon interests, and measures to ensure safety must be established and implemented, and when additional provision occurs continuously, this must be disclosed in the privacy policy and compliance with the criteria must be inspected.

Considerations upon additional provision of personal information (Enforcement Decree of the Personal Information Protection Act, Article 14-2(1))

1. Whether it is relevant to the original purpose of collection
2. Whether there is foreseeability regarding the additional use or provision of personal information in light of the circumstances of collection or the processing practices
3. Whether it unfairly infringes upon the interests of the data subject
4. Whether measures necessary to ensure safety, such as pseudonymization or encryption, have been taken