Shopping mall (e-commerce) companies should check personal information checklists at least once.

Generally, shopping malls collect and utilize customers’ personal information by registering membership and placing orders for goods and items, managing a large number of personal information. However, as the number of shopping mall users increases, doubts and concerns may arise about whether our company is properly managing personal information. The Law Firm Veat provides a ‘Personal Information Checklist’ to be checked periodically based on a standard shopping mall to address these concerns.

Do you have consent to collect and utilize personal information?

In order for a shopping mall company to collect personal information from information service providers, as stipulated in Article 39(3) and Article 15 of the Personal Information Protection Act, it must, as a rule, notify the items collected, the purpose of collection and utilization, and the retention period, and obtain consent. If it violates this, it may be sentenced to imprisonment for up to 5 years or a fine of up to 500 million won.

In particular, if the shopping mall uses personal information exceeding the scope of consent obtained from users or information subjects, it may be treated as ‘unintended use’ according to Article 71(2) and Article 18 of the Personal Information Protection Act, and may be sentenced to imprisonment for up to 5 years or a fine of up to 500 million won.

Do you have consent for third-party provision and delegation?

When providing personal information to a third party, it is necessary to notify the recipient, the purpose of utilizing the provided information, the retention period, the items provided, and the right to refuse consent, and obtain consent. In the case of a typical shopping mall, the third-party providers or delegators include courier companies for delivery, logistics centers for product management, companies handling customer service and complaint processing, and payment processing companies.

Recently, due to strengthened investigations by investigative agencies and sanctions by administrative agencies regarding the legitimacy of third-party provision, it is advisable to verify whether personal information is properly processed by third parties. If personal information is provided to a third party without obtaining valid consent, it may be sentenced to imprisonment for up to 5 years or a fine of up to 500 million won according to Article 71(1) and Article 17 of the Personal Information Protection Act.

Do you have consent for personal information deletion or inactive account management?

Under Article 39(6) of the Personal Information Protection Act, a shopping mall company must delete or retain personal information of users who have not used information services for 1 year (unless otherwise specified in other laws or the user’s request), and if it violates this, it may be subject to a fine of up to 300 million won according to Article 75(2) Item 4 of the Personal Information Protection Act.

Therefore, in the case of a shopping mall, it is necessary to operate a ‘Inactive Member System’ to delete or retain the personal information of users who have not used services for more than 1 year.

The Law Firm Veat’s Personal Information Protection Team conducts personal information protection-related advisory services and personal information protection system establishment consulting services to ensure compliance with personal information protection laws. In particular, partners Jo Eun-byol and Baek Seung-cheol are appointed as advisors to the Personal Information Protection Committee since February 2020, thereby enhancing their expertise in personal information protection.

Specifically, Law Firm Veat provides comprehensive advisory services, including the preparation of personal information consent forms, personal information handling policies, responses to on-site inspections by the responsible agency, and crisis response for leakage and disclosure incidents, for businesses providing services overseas, such as Europe and the United States, which are related to personal information and information protection.

If you have a personal information legal consultation need, please contact Law Firm Veat.

Key Case of Personal Information Legal Consultation

▶ Providing legal advice on consent forms for collecting personal information from minors to a company operating educational applications.

▶ Providing legal advice on consent related to collecting personal information during the hiring process for a startup company.

▶ Providing legal advice on ‘Agreement on Flexible Working Hours, Employment Contract, Employee Regulations and Personal Information Consent’ for a big data-based advertising agency.

▶ Providing legal advice on ‘Personal Information Handling Policy and Personal Information Consent’ for a bio/healthcare venture company.

▶ Providing legal advice on consent forms, online shopping mall terms of use, personal information handling policies, and personal information consent forms for a women’s clothing shopping mall.

▶ Providing legal advice on ‘Obtaining Personal Location Information’ related to an ICT-based startup providing location-based services.

▶ Providing various legal consultation services, including ‘Personal Information System Establishment Consulting’ for a consumer goods sales company operating both online and offline.