"Small print regarding personal information provision, can you be penalized?"
Article posted in 2022-02-18 11:01:16 | VEAT
Article 59 of the “Act on the Protection of Personal Information” stipulates acts prohibited of those who process or processed personal information. Article 59(1) stipulates that acts of acquiring personal information or receiving consent for processing through false or other unfair means are prohibited. If those who process or processed personal information violate these prohibitions, they violate the Act on the Protection of Personal Information and may be sentenced to imprisonment of up to three years or a fine of up to 30 million won.
The Supreme Court has stated that considering the legal nature of the data subject’s right to self-determination of personal information, the legislative purpose of the Act on the Protection of Personal Information, the principles of personal information protection under the Act on the Protection of Personal Information, and the content of obligations that personal information processors must comply with when processing personal information, the ‘false or other unfair means’influence the data subject’s decision-making on whether to consent to the collection or processing of personal information.(Supreme Court Decision 2017. 4. 7. Decision 2016do13263)
Interestingly, the size of the 'font size' containing the consent-related information can also influence the judgment of whether a certain action constitutes false or other unfair means. In a specific case, A Company used an application form for a promotional event with consent-related information written in a font size of about 1mm. The Supreme Court found that this font was difficult for consumers to read and violated Article 22(1) of the “Act on the Protection of Personal Information that personal information processors must clearly inform data subjects of each consent item and obtain consent for each item when collecting personal informationAs such, when determining whether the “Act on the Protection of Personal Information” has been violated, it does not only separately and individually judge the act of acquiring personal information or receiving consent for processing but considers the illegality comprehensively, taking into account the entire process of obtaining consent.
The “Act on the Protection of Personal Information Enforcement Rule” newly established in 2017, Article 4, stipulates the method of displaying important contents when obtaining written consent.
1. The font size shall be at least 9 points or more and 20 percent or more larger than other contents to make it easy to see.
2. The color, boldness or underlining of the font shall be used to clearly indicate the content.
3. When the consent items are numerous and the important contents are difficult to distinguish clearly, the important contents shall be displayed separately from other contents to allow them to be easily identified.
As such, when obtaining consent for collecting or processing personal information, it is important to obtain substantial consent through the data subject’s clear awareness and carefully consider not only the content that must be included in consent-related information but also the method of writing it to avoid violating laws.
Law firm Veat provides services such as consulting on establishing personal information protection systems (ISMS, ISMS-P, etc.) to ensure that companies comply with personal information-related laws. Please feel free to contact Law firm Veat if you need legal review when obtaining consent for collecting or processing personal information.
Thank you.
Law firm Veat