Providing guidelines for the retention and processing of personal information of withdrawn members.

Law firm Veat provided legal guidelines to global store company A (hereinafter referred to as "the client") regarding the storage and handling of personal information of withdrawn members.

The client was experiencing the issue of how to handle the personal information of withdrawn members. In particular, they inquired about issues such as how much information needs to be retained and how it should be retained when obligated to retain personal information of withdrawn members according to individual laws, and whether it is possible to retain the personal information of withdrawn members by anonymizing it.

Law firm Veat’s E-Commerce Team comprehensively reviewed the client’s situation and conducted a broad legal review based on related laws and regulations, such as the “Personal Information Protection Act,” the “Act on Consumer Protection in Electronic Commerce, etc.,” (hereinafter referred to as “the Electronic Commerce Act”), and the “Act on Protection of Communications Secrets,” and presented the following key review items to clarify the legal obligations related to the handling of personal information of withdrawn members.

First, the principle is to immediately delete the personal information of withdrawn members, but if obligated to retain it according to other individual laws, they are obligated to store it separately from other information.

For example, the Electronic Commerce Act requires businesses to retain records of transactions, records of dispute resolution, and records of advertising, and we explained the need to separately store the transaction records of withdrawn members for a certain period to comply with this obligation.

Also, even if the information is anonymized, we emphasized the need to comply with the protection measures required by law for anonymized information due to the possibility of identifying a specific individual by combining it with other information.

Finally, Law firm Veat’s E-Commerce Team considered that the laws and regulations applicable to the retention of personal information of withdrawn members vary depending on the industry, and specifically reviewed the laws and regulations applicable to each industry to clearly explain the legal obligations that the client must comply with.

For example, in the healthcare industry, the “Medical Act,” the “Medical Devices Act,” and the “Pharmacist Act” may apply, and in the e-commerce industry, the Electronic Commerce Act, the “Act on Promotion of Information and Communication Network Utilization and Protection of Information,” (hereinafter referred to as “the Information and Communication Network Act”), and the “Telecommunications Business Act,” and other laws may apply depending on the industry.

Jo Eunbyeol, partner attorney at Law firm Veat, has served as a legal advisor to the Personal Information Protection Committee and has handled numerous personal information-related practical cases, and was officially recognized for his expertise when he was selected as an Outstanding Legal Advisor to the Personal Information Protection Committee in 2020.

Also, Law firm Veat’s Personal Information Protection Team is led by partner attorneys Baek Seungchul and Jo Eunbyeol, who hold the Certified Personal Information Management System (ISMS-P) certification examiner qualification, and is comprised of personal information experts, and we are helping clients resolve personal information legal issues with the most optimized solutions.