Limitation on Collection of Personal Information
Certification criterion
When collecting personal information, only the minimum amount of personal information necessary for the processing purpose shall be collected, and the provision of goods or services to the data subject shall not be refused on the grounds that the data subject has not consented to matters to which consent may be given optionally, and so forth.
Key checkpoints
- When collecting personal information, is only the minimum information collected within the scope necessary for its purpose?
- When collecting personal information based on the data subject's consent, is the data subject specifically informed of the fact that they may refuse to consent to the collection of personal information beyond the minimum necessary information?
- Is the provision of services or goods not refused on the grounds that the data subject does not consent to the collection of personal information beyond the minimum information necessary for the collection purpose?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.1.2 Limitation on Collection of Personal Information], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
When collecting personal information, only the minimum information shall be collected within the scope necessary for its purpose, such as a legal basis, compliance with legal obligations, or the conclusion/performance of a contract.
- Even when personal information is collected with the data subject's consent, or collected without the data subject's consent on the basis of a legal ground, compliance with legal obligations, or the conclusion/performance of a contract, only the minimum personal information necessary for that purpose shall be collected.
- Because the burden of proof regarding the minimum personal information rests with the personal information controller, the controller must be able to demonstrate that the information collected as mandatory is the minimum personal information necessary for providing the service, etc. (Here, minimum personal information means the information that is absolutely necessary for the essential functions of the relevant service.)
※ Minimum information (examples)
- The name, address, telephone number, etc. that a shopping company collects to deliver products to customers may be regarded as the minimum necessary personal information; however, requiring personal information unrelated to delivery, such as occupation or date of birth, exceeds the scope of minimum information.
- For a customer who has entered a prize event, requiring, in addition to the personal information necessary to notify them of the prize draw result, information concerning the privacy of their personal life such as the applicant's gender, number of children, or cohabitation status, as well as unique identifying information, exceeds the scope of minimum information.
- Information about a job applicant's career, major, or certifications may be regarded as the minimum information necessary to assess their work capability; however, information about family relationships, marital status, or place of origin (permanent domicile) exceeds the scope of minimum information.
When collecting personal information with the data subject's consent, the data subject shall be specifically informed of the fact that they may refuse to consent to the collection of personal information beyond the minimum necessary information.
- Notify the data subject by clearly distinguishing which information is the minimum necessary information and which is not, so that the data subject can easily identify it.
- Notify the data subject that, for information that is not the minimum necessary information, they may freely refuse consent without any hindrance to the use of the goods or services.
The provision of a service or goods shall not be refused on the grounds that the data subject does not provide personal information beyond the minimum information necessary for the collection purpose.
- Notify the data subject clearly and in a way they can recognize that the service may be used even if they refuse consent to optional items.
- Implement the system so that essential services such as membership registration can be used even if, during the membership registration process, the data subject does not consent to or does not enter optional information.
- ※ For details, refer to the "Easy-to-Understand Guide on Consent for Personal Information Processing (Personal Information Protection Commission)."
Related laws
- Personal Information Protection Act Article 16 (Limitation to Collection of Personal Information)
- Personal Information Protection Act Article 22 (Methods of Obtaining Consent)
Evidence (examples)
- Online personal information collection forms (website membership registration screen, event participation screen, etc.)
- Offline personal information collection forms (membership application form, etc.)
- Privacy policy
Nonconformity examples
- Where personal information is collected without the data subject's consent on the basis of the conclusion and performance of a contract, but personal information items that are not strictly necessary for the conclusion and performance of the contract are excessively collected
- Where consent to optional items is obtained from the data subject, but the fact that they may refuse to consent to the collection of the relevant personal information is not specifically communicated
- Where the membership registration form is set up to obtain separate consent by distinguishing mandatory and optional information, but it is not specifically communicated so that the data subject can recognize that membership registration is possible even without consenting to the optional information (for example, where the personal information entry form does not indicate whether each personal information item is mandatory or optional)
- Where, on the website membership registration screen, the process does not proceed to the next step or membership registration is blocked if the data subject does not consent to the optional items or does not enter the optional information
- Where excessive personal information, such as family details not directly related to the intended job position, is collected at the time of an employment contract
(Example image) Form for entering personal information at hiring
Photo Name Date of birth Address [illegible] Phone number Home phone E-mail Mobile phone Emergency contact (Callout: Collection of personal information such as family details is unnecessary at the time of an employment contract. This callout box covers the fourth row of the table above, and an arrow points to the red box below)
(Emphasis: the whole lower part, with the physical details, other, and family details sections, is enclosed in a red box)
Physical details Height Weight Blood type Eyesight Other Religion Hobbies Special skills Family details Relationship Full name Age Education Occupation Position Cohabitation status