Indirect Collection of Personal Information

When personal information is received from a third party other than the data subject, it must be verified whether the information is collected/provided in accordance with lawful procedures, and it must be specifically stated through a contract that the responsibility for obtaining consent to the collection of personal information rests with the party providing the personal information.

When personal information is collected from publicly available media or places such as SNS or internet homepages, it may be used only within the scope in which the data subject's intent to consent is clearly expressed, or in which consent is deemed to exist under generally accepted social norms in light of the content displayed on the internet homepage, etc. (Article 6(4) of the Standard Personal Information Protection Guidelines).

Where necessary for the performance of a service contract, only the minimum personal information necessary for the performance and provision of the relevant service contract shall be collected, even with respect to personal information collected/generated by automatic collection devices, etc. during the service provision process (call records, access logs, payment records, usage histories, etc.).

• However, where such information is collected for the purpose of use unrelated to the performance of the service provision contract, it must be classified as an optional consent item and separate prior consent must be obtained (for example, where behavioral information collected through cookies is analyzed and used for individually tailored advertising, etc.).

Where the data subject makes a request regarding personal information collected from a source other than the data subject, the data subject must be immediately notified of the necessary matters.

• Matters to be notified upon the data subject's request

  1. The collection source of the personal information
  2. The processing purpose of the personal information
  3. The fact that the data subject has the right to request suspension of the processing of the personal information or to withdraw consent

• Unless there is a justifiable reason, notification must be made within 3 days from the date of the data subject's request (Article 9(1) of the Standard Personal Information Protection Guidelines).

• Where the data subject's request is refused because the notification may harm the life/body of another person, etc., the grounds and reasons for the refusal must, unless there is a justifiable reason, be notified within 3 days from the date of the data subject's request (Article 9(2) of the Standard Personal Information Protection Guidelines).

  ★ Grounds for refusing to notify the collection source of personal information (Article 20(4) of the Personal Information Protection Act)

  1. Where the personal information for which notification is requested is included in a personal information file that falls under any of the subparagraphs of Article 32(2) of the Personal Information Protection Act (personal information files exempt from registration and disclosure, such as those related to national security, diplomatic secrets, criminal investigations, or those classified as confidential under other statutes)
  2. Where the notification may harm the life/body of another person, or may unjustly infringe on the property and other interests of another person

When processing personal information collected from a source other than the data subject, where the type/scale of the personal information, etc. meets the legal requirements, the necessary matters must be notified to the data subject.

• Notification obligation requirements and methods

Field	Value
Conditions under which the notification obligation is imposed	Where personal information is received from another personal information controller based on the data subject's consent to the provision of personal information to a third party pursuant to Article 17(1)1 of the Personal Information Protection Act
Requirements for personal information controllers on whom the notification obligation is imposed	A controller processing sensitive information or unique identifying information concerning 50,000 or more data subjects A controller processing personal information concerning 1,000,000 or more data subjects ※ (Criteria for calculating the number of data subjects) Based on the daily average over the immediately preceding 3 months as of the end of the previous year
Matters to be notified	The collection source of the personal information The processing purpose of the personal information The fact that the data subject has the right to request suspension of the processing of the personal information or to withdraw consent
Timing of notification	Within 3 months from the date the personal information was received However, where personal information is received and processed periodically two or more times a year, within the scope of the data subject's consent obtained pursuant to Article 17(1)1 with respect to the matters under Article 17(2)1 through 4, the data subject must be notified within 3 months from the date the personal information was received, or notified at least once a year counting from the date such consent was obtained
Notification method	A method by which the data subject can easily confirm the notified content, such as in writing/e-mail/telephone/text message, etc. A method of notifying through a notification window so that the data subject can easily become aware of it in the course of providing goods and services
Exceptions to notification	Where the personal information for which notification is requested is included in a personal information file that falls under any of the subparagraphs of Article 32(2) Where the notification may harm the life/body of another person, or may unjustly infringe on the property and other interests of another person ※ However, this applies only where it clearly takes precedence over the rights of the data subject under this Act
Other	The notification of matters concerning the collection source, etc. of personal information under Article 20(2) of the Act may be provided together with the notification of the use/provision details under Article 20-2(1) of the Act The record of having notified the collection source to the data subject shall be retained/managed until the personal information concerned is destroyed (the fact of notification to the data subject, the timing of notification, and the method of notification)

• This obligation to notify the collection source of personal information applies only to personal information collected from a personal information controller that provided personal information with the data subject's consent pursuant to Article 17(1)1 of the Personal Information Protection Act. Therefore, it does not apply to personal information collected from a party that provided personal information with consent obtained under the Credit Information Use and Protection Act, or to personal information received under statutes (Commentary on Personal Information Protection Statutes and Guidelines/Notices).

• Where the information collected by the personal information controller does not include personal information such as contact details by which the data subject can be notified, notification is not required.

The record of having notified the collection source to the data subject must be retained/managed until the personal information concerned is destroyed.

• Information to be retained/managed regarding the notification of the collection source (Article 15-2(4) of the Enforcement Decree of the Personal Information Protection Act)
  1. The fact of notification to the data subject
  2. The timing of notification
  3. The method of notification