Legal Review of Law firm Veat's Personal Information Handling Policy Improvement Recommendations

Law firm Veat received a request from startup Company A (hereinafter referred to as "the client") to perform a legal review of the privacy policy revision.

Veat’s privacy team thoroughly analyzed various matters that could be applied to the privacy policy due to the revision of the “Personal Information Protection Act,” so that the client could comply with KISA (Korea Internet & Security Agency)’s recommendations for privacy policy improvement. 

In particular, Veat’s privacy team comprehensively analyzed the client’s privacy policy and confirmed whether all essential content, including collection items, information automatically generated and collected, and the rights and obligations of the information subject, were included. We also detailedly explained the reviewed items concerning missing parts related to overseas transfers and processing of pseudonymized information.

Veat’s privacy team provided advice on the overall direction of revising the privacy policy, considering the client’s specific operating methods, thereby supporting the client to process and manage personal information in a manner that is appropriate for their service and complies with the revised law.

How to reflect the revised “Personal Information Protection Act” of 2023.09.30?

The revised Personal Information Protection Act includes content integrating special provisions that applied to information and communication service providers as general obligations for personal information processors. Significant changes were particularly observed in areas such as dormant policies, overseas transfers, and safety obligation measures.

According to the revised Personal Information Protection Act, the privacy policy should clearly state the type and collection method of information so that the information subject can understand how their data is collected and used.

Also, in order to clearly define the rights the information subject has regarding their data, the information subject’s rights should be clearly stipulated in the privacy policy.

In particular, the revised Personal Information Protection Act is strengthening notification and management of overseas transfers in line with the increasing global data flows and the importance of information subject data protection. 

When collecting personal information, you must clearly inform the legally stipulated matters and properly obtain consent from the information subject. It may be difficult to recognize that consent to the 'privacy policy' alone constitutes proper consent for personal information collection.

The information subject has the right to choose and decide whether or not to use their information and whether to consent. 'Consent' means voluntary acceptance when processing personal information, and the information subject must be able to clearly know whether or not they consent. Therefore, when a data processor obtains consent for personal information processing, they must clearly inform each consent item so that the information subject can clearly understand and decide.

 Veat’s privacy team, comprising advisory lawyers of the Personal Information Protection Commission

Veat’s personal information lawyers comprehensively reviewed the client’s privacy policy in line with the revised Personal Information Protection Act and focused on providing suitable improvement suggestions for the client’s service.

Veat has provided systematic and practical advice based on a deep understanding of related laws such as the revised “Personal Information Protection Act,” “Act on Promotion of Information and Communication Network Utilization and Information Protection,” etc., to help the client’s personal information processors comply with the law and operate a safe business.

Veat’s personal information team, including partner lawyer Jo Eunbyeol, who serves as a member of the Information Disclosure Deliberation Committee of the Personal Information Protection Commission, and partner lawyer Baek Seungcheol, who holds the certification examiner qualification for the personal information protection management system (ISMS-P) and serves as an advisory lawyer for the Personal Information Protection Commission.

Veat’s personal information team is helping companies to operate their businesses positively by protecting them so that the company can manage personal information lawfully and safely, effectively manage and prevent legal risks related to personal information leakage, based on expertise in the personal information field.

If you have any questions about the privacy policy, please contact Law firm Veat, which has personal information lawyers.

Thank you.

Law firm Veat