Collection/Use of Personal Information for Marketing Purposes

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.1.7 Collection/Use of Personal Information for Marketing Purposes], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When intending to process personal information in order to promote goods or services to the data subject or to solicit sales, the organization must inform the data subject so that it can be clearly recognized and obtain separate consent.

• Prohibited: stating the purpose as "provision of supplementary services", "provision of affiliate services", and the like while actually collecting personal information for "promotion and marketing" purposes
• Personal information collected for product promotion or marketing purposes must be clearly distinguished from information collected for other purposes, with consent obtained before collection
• Implement the consent form so that it is easy to recognize by clearly indicating the fact that the personal information may be used to contact the data subject for purposes such as promotion of goods or services or solicitation of sales (clearly indicating such content through the size, color, boldness, or underlining of text)

When transmitting advertising information for commercial purposes using an electronic transmission medium, the organization must obtain the recipient's explicit prior consent, and must confirm the recipient's consent to receive regularly every 2 years.

• An "electronic transmission medium" refers to mobile phones, landline phones, fax, messengers, email, bulletin boards, and the like
• To transmit advertising information for commercial purposes, the recipient's explicit consent to receive must be obtained by document (including electronic documents) or verbal means

※ Concept of advertising information for commercial purposes

• Advertising information for commercial purposes refers to (1) information about the sender and (2) the content of goods or services the sender will provide, transmitted by the sender for the purpose of obtaining economic benefit. A person who causes the transmission is also included as a sender
• In principle, all information that a person engaged in business sends to customers constitutes advertising information
• Because the reason for existence of a for-profit corporation is the pursuit of profit, in principle all information transmitted to customers constitutes advertising information for commercial purposes; for a non-profit corporation, whether information is advertising for commercial purposes is judged according to the nature of the information transmitted
• Even if it is not a promotion of specific goods or services, if the information sent to the recipient amounts to promotion of the sender's image, it may be regarded as advertising information
• Even if the main information is not advertising information, if advertising information is included incidentally, the whole constitutes advertising information

※ Exceptions to advertising information for commercial purposes

• Information whose purpose is to facilitate, complete, or confirm a transaction previously concluded with the recipient

• Explanations, warranties, product recalls, safety or security related information regarding goods or services used or purchased by the recipient

• One-time information sent at the customer's request (quotations, and the like)

• Information the recipient applied for by paying monetary consideration (newsletters, stock information, livestock product trading information, and the like)

• Guidance and confirmation information related to the recipient's purchase or use of goods or services provided by the sender

• Consent for the purpose of promoting goods or services / soliciting sales under Article 22(1)7 of the Personal Information Protection Act corresponds to consent for the sender to collect/use the recipient's personal information in order to transmit advertising information, while consent under Article 50(1) of the Network Act corresponds to consent to receive the advertising information the sender sends; therefore the two consents must be distinguished and obtained separately

• Advertising information (app push advertising) must not be transmitted merely because a smartphone app (application) has been downloaded and installed; when the app is first executed, the recipient's consent to receive advertising information must be confirmed and obtained before advertising is transmitted

• However, where an exception based on a transaction relationship applies, advertising information may be transmitted without obtaining consent to receive

※ Exceptions to consent to receive advertising information transmission based on a transaction relationship

• Where a person who collected contact information directly from the recipient through a transaction relationship for goods and the like intends to transmit advertising information for commercial purposes, within 6 months from the date of the transaction, regarding goods and the like of the same kind that the person handles and that were traded with the recipient

• Where a telephone-solicitation seller under the "Act on Door-to-Door Sales, etc." verbally notifies the recipient of the source of collection of the personal information and makes a telephone solicitation

• A person who transmits advertising information having obtained the recipient's consent to receive must confirm whether consent to receive is maintained every 2 years from the date consent to receive was obtained

  • Since this imposes an obligation to notify the person who consented of the fact that they consented to receive, there is no need to obtain re-consent
  • If the recipient does not express any intention, the intention to consent to receive is deemed to be maintained as is
  • Matters to be notified to the recipient when confirming whether to receive
    1. The sender's name
    2. The date of consent to receive and the fact of consent to receive
    3. The method of expressing the intention to maintain or withdraw consent to receive

When a recipient expresses an intention to refuse receipt of, or withdraws prior consent to, advertising information for commercial purposes transmitted via an electronic transmission medium, the transmission of advertising information for commercial purposes must be stopped.

• Even where there is a transaction relationship, if the recipient expresses an intention to refuse receipt, transmission of advertising information is prohibited
• Withdrawing membership can also be regarded as an expression of intention to refuse receipt, so advertising information must not be transmitted to a recipient who has withdrawn membership
• Unless the recipient has specifically set a scope when withdrawing consent to receive or expressing an intention to refuse receipt, its effect applies not only to that particular advertisement but to all advertisements sent by that sender

When transmitting advertising information for commercial purposes, the sender's name, the method of refusing receipt, and so on must be specifically stated.

• Matters to be notified together when transmitting advertising information for commercial purposes using an electronic transmission medium
  1. The sender's name and contact information
  2. Matters concerning measures and methods enabling the recipient to easily express an intention to refuse receipt or to withdraw consent to receive
  • ※ Comply with Annex 6 of the Enforcement Decree of the Network Act (matters and methods to be stated for advertising information for commercial purposes)
• During nighttime hours (from 9 PM to 8 AM the following day), transmission of advertising information for commercial purposes using an electronic transmission medium is prohibited
  • To transmit advertising information during nighttime hours, separate consent to receive is required
  • However, for email, nighttime transmission is possible even without separate consent
  • ※ For details, refer to the "Guide to the Network Act for the Prevention of Illegal Spam"