[Consultation] Legal issues to check in advance when entering a global business]

A Company is establishing a U.S. subsidiary, B Company, and inquired Law Firm Veat regarding legal risks associated with the corporate structure between the Korean and U.S. entities, as well as regarding global service terms and conditions and personal information processing policies.

Law Firm Veat responded by conducting a legal risk review of the corporate structure between A Company and B Company, and drafted and provided global service terms and conditions, as well as reviewed B Company’s personal information processing policy regarding GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act).

GDPR (General Data Protection Regulation)

GDPR, enacted on May 25, 2018, is the personal information protection law of the EU (European Union). It focuses on strengthening the rights of data subjects and corporate responsibility, as well as clarifying the requirements for transferring personal information outside the EU.

CCPA (California Consumer Privacy Act)

CCPA, also known as the “California-style GDPR,” is a personal information protection law issued for California. It applies to organizations conducting business in California that meet one of the following three conditions: 1) annual total sales exceeding $25,000,000, 2) collecting or selling personal information of 50,000 or more consumers, households, or devices, 3) when consumer personal information sales generate more than 50% of the company’s annual revenue. While similar to GDPR, it differs in that it does not require the legality of personal information collection consent, etc.

Violations of GDPR can result in fines and administrative sanctions, with significant violations potentially incurring penalties of up to 4% of the company’s global annual revenue or €20 million, whichever is greater. Additionally, violations of CCPA can lead to fines imposed by the California Attorney General, and consumers have the right to seek compensation and class action lawsuits. While less comprehensive than GDPR, the CCPA’s penalty ceiling is unlimited, requiring global service companies to exercise particular caution.

Law Firm Veat has established a personal information protection team led by Partner 변호사 백승철 and Partner 변호사 조은별, who have been appointed as legal advisors to the Personal Information Protection Committee since 2020. Based on their experience providing comprehensive legal advice on GDPR and CCPA compliance, the firm offers legal advisory opinions to companies preparing for global services. If you require legal advice regarding GDPR and CCPA, please contact Law Firm Veat.

Thank you.