Use and Provision of Personal Information Beyond the Purpose

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [3.2.4 Use and Provision of Personal Information Beyond the Purpose], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

• Personal information must be used or provided only within the purpose consented to by the data subject at the time of initial collection or within the scope based on statutes.

  • It is prohibited to use or provide personal information beyond the scope notified to and consented by the data subject regarding the purpose of use/provision, or beyond the scope permitted for use/provision under the Personal Information Protection Act or other statutes.
    • ※ Examples of use/provision of personal information beyond the purpose
      • Using personal information entered to participate in a customer satisfaction survey, a promotional event, or a prize event, without prior consent, to send advertisements notifying the company's own discount sale events
      • A home shopping company providing customer information collected to deliver ordered goods, without the data subject's consent, to an affiliated condominium company to be used for sending condominium sales promotion materials

• When personal information is received from a personal information controller, it must be used or provided only within the scope of the purpose for which it was received.

  • A person who has received personal information is prohibited from using it for a purpose different from the purpose for which it was provided or received, or from providing it to a third party.

• When using or providing personal information beyond the scope of the collection purpose or the purpose for which it was received from a personal information controller, this must be limited to cases where separate consent is obtained from the data subject or where there is a legal basis.

  • Cases in which personal information may be used/provided for a purpose other than the intended purpose (except where there is a risk of unfairly infringing on the interests of the data subject or a third party)

• Matters to be notified when obtaining consent to use/provide personal information for a purpose other than the intended purpose

  1. The recipient of the personal information
  2. The purpose of use of the personal information (in the case of provision, the recipient's purpose of use)
  3. The items of personal information to be used or provided
  4. The period of retention and use of the personal information (in the case of provision, the recipient's period of retention and use)
  5. The fact that the data subject has the right to refuse consent, and the content of any disadvantage that may result from refusing consent, if any

• A person who has received personal information from another personal information controller must not use it for a purpose other than the purpose for which it was received or provide it to a third party, except in any of the following cases:

  1. Where separate consent has been obtained from the data subject
  2. Where there are special provisions in other statutes

• When providing personal information to a third party for a purpose other than the intended purpose, the organization must limit the recipient's purpose and method of use, etc., or request the recipient to prepare necessary measures to secure safety.

  • Limit the purpose of use, method of use, period of use, form of use, etc., for the recipient of the personal information
  • Request in a document (including electronic documents) that specific measures necessary to secure the safety of the personal information be prepared
  • Clarify the accountability relationship regarding safety-securing measures for personal information with the recipient of the personal information

• When a public institution uses personal information for a purpose other than the intended purpose or provides it to a third party, it must publish the necessary matters concerning the legal basis, purpose, and scope of such use or provision in the Official Gazette or on the internet homepage, etc.

  • Cases in which publication in the Official Gazette or on the internet homepage is not required when using/providing personal information beyond the purpose (exceptions)
    1. When using/providing beyond the purpose based on the data subject's consent
    2. When using/providing beyond the purpose for the investigation of crimes and the institution and maintenance of prosecution
  • Matters to be published in the Official Gazette or on the internet homepage
    1. The date of the use beyond the purpose, etc.
    2. The legal basis for the use beyond the purpose, etc.
    3. The purpose of the use beyond the purpose, etc.
    4. The items of personal information used beyond the purpose, etc.
  • Timing and period of publication in the Official Gazette or on the internet homepage
    1. Timing of publication: within 30 days from the date of use/provision beyond the purpose
    2. Period of publication: at least 10 days when publishing on the internet homepage

• When a public institution or the like uses personal information for a purpose other than the intended purpose or provides it to a third party, it must record and manage it in the register of use beyond the purpose and third-party provision.

  • In the case of a public institution, when personal information is used for a purpose other than the intended purpose or provided to a third party, it must be recorded and managed in the 'register of use of personal information beyond the purpose and third-party provision'.
    • ※ Matters to be recorded/managed in the 'register of use of personal information beyond the purpose and third-party provision' (Form No. 1 of the Notice on the Method of Personal Information Processing)
      1. The name of the personal information or personal information file used or provided
      2. The name of the institution using or receiving it
      3. The purpose of use or the purpose of receiving it
      4. The legal basis for the use or provision
      5. The items of personal information used or provided
      6. The date, cycle, or period of use or provision
      7. The form in which it is used or provided
      8. Where a request has been made to impose limits or to prepare necessary measures for the protection of personal information, the content thereof
  • Prepare procedures to systematically respond to requests by judicial or government agencies for the provision of personal information and other data (warrants, orders, requests for submission of data, etc.)
    • ※ Considerations when preparing procedures to respond to requests by judicial or government agencies for the provision of personal information and other data
      • Establish and implement response procedures such as the legal basis for provision, a request reception point (including the designation of a responsible organization and person in charge), requests via official documents (warrants, etc.), verification of the person in charge at the requesting agency, the principle of providing minimal information, internal reporting and approval procedures, and preservation of related records
      • Use safe procedures and methods so that personal information is not leaked/exposed during the provision process, and record the details of the personal information provided and keep it for a certain period, etc.