Checking items needed when storing and processing personal information by entrusting to the cloud.

The Ministry of Science, ICT announced policies to improve the cloud security certification system and ease regulations on network separation in the financial sector through the 17th Information and Communications Strategy Committee.

This provides an opportunity to expand the use of cloud services across various industries and helps companies build more efficient and flexible IT infrastructure.

Many companies are reviewing domestic and overseas cloud transitions to take advantage of the benefits of cost savings and scalability through these cloud services.

Especially, if you are concerned about whether storing and processing personal information on a cloud server simply means renting a server or providing personal information to a third party, what legal obligations are related to personal information overseas transfer, and how to prepare for them, please refer to this article for answers.

◾Regarding Outsourcing When Using a Cloud Server

Generally, storing and processing personal information in cloud services is considered outsourcing. This is because the cloud service provider manages the data without directly using it or delivering it to a third party, simply renting out the server.

That is, responsibility for personal information processing still remains with the company using the cloud service.

◾Legal Definition Related to Personal Information Overseas Transfer

Overseas transfer of personal information refers to the act of transmitting or storing personal information collected in Korea to servers or third parties located overseas.

In the case of overseas cloud services, data is often stored and processed using data centers located overseas. This act falls under overseas transfer as stipulated in the “Personal Information Protection Act.”

The Personal Information Protection Act generally prohibits the provision (access), processing outsourcing, or storage overseas, but also stipulates several important requirements for the possibility of overseas transfer as an exception.

1) When separate consent for overseas transfer has been obtained from the information subject in advance, 2) When there is a special provision in laws, treaties, or other international agreements regarding overseas transfer of personal information, 3) When it is necessary for the conclusion and execution of a contract with the information subject.

In the case of being necessary for the conclusion and execution of a contract with the information subject, that is, when using overseas cloud services is essential for the contract, overseas transfer of personal information is possible without separate consent, but measures such as specifying items of personal information to be transferred in the personal information processing policy are necessary (Article 9, Paragraph 4, Clause 1(a)(3) of the Personal Information Protection Act).

Also, even if the cloud service provider has obtained personal information protection certification or other certifications designated by the committee and has built an environment that can implement the certification, the consent of the information subject may be exempted (Article 9, Paragraph 1(a)(4) of the Personal Information Protection Act).

However, separately from the exemption from consent, the cloud service usage company must verify that technical and administrative measures to prevent personal information leakage are effectively implemented, even if the cloud service provider has obtained certification. Thorough supervision is necessary. If problems arise in this process, the cloud service usage company may be held liable under the Personal Information Protection Act.

The issue of overseas transfer of personal information is a complex problem involving not only technical issues but also legal and administrative responsibility.

Law firm Veat has IT legal experts and personal information lawyers with extensive experience in advising on and resolving disputes related to the introduction of numerous cloud services, and provides legal advice to enable the safe and appropriate collection and storage procedures for personal information in relation to overseas transfer of personal information.

If you are a company introducing cloud services, please prepare a safe data management plan with Law firm Veat.

Thank you.

Law firm Veat