Obligation to Designate Domestic Agent under Network Act in Korea

July 5, 2020
Privacy & Data Protection

Background

As various global online services have emerged and been widely used, a number of cases where an overseas business entity has to process personal information of the Korean nationals has increased dramatically.

 

Enactment of Article 32-5 of the Network Act

In order to assist the Korean nationals to contact the information and communication service supplier without any difficulties such as any language barrier and to encourage information and communication service suppliers without any domestic presence for their compliance, Article 32-5 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. (the “Network Act”) has been enacted on 18 September 2018, which requires certain overseas internet service providers to appoint domestic agents responsible for personal information protection. Further to this, the Enforcement Decree to the Network Act (the “Enforcement Decree”) was then enacted on 19 March 2019, which sets criteria used to determine which service providers may be subject to the domestic agent requirement.

 

Criteria

According to the Act and its Enforcement Decree, if a telecommunication service provider or any similar service provider without any domestic address or a place of business in Korea meets any one of the following criteria, it is then required to designate a domestic agent:

  • A person or an entity whose total revenue for the previous year was KRW 1 trillion or more;
  • A person or an entity whose revenue for the previous year from the information and communications service sector was KRW 10 billion or more;
  • A person or an entity who had one million or more average daily users whose personal information was under the custody or management of the person or the entity for the most recent three-month period, as of the end of the previous year; or
  • A person or an entity who (i) has committed, or has the risk of committing, personal information intrusion; and (ii) was requested by the Korea Communications Commission (“KCC”) to submit information pursuant to Article 64, Paragraph (1) of the Network Act.

 

Duties of Domestic Agents

In case that the telecommunication service provider or any similar service provider is obliged to designate a domestic agent, then the domestic agents are responsible for duties as provided under the Network Act, such as:

  • Duty to manage personal information;
  • Duty to inform, notify and explain to users of any loss, theft, leakage, forgery, or alteration of personal information; and
  • Duty to submit relevant items or documents pursuant to request from the Minister of the Ministry of Science and ICT (“MSIT”) or the KCC, on behalf of the entity it represents.

 

In case a domestic agent fails its duties, the telecommunication service provider that has designated such an agent will be deemed to have violated the relevant regulations.

 

Administrative Fines

Pursuant to Article 76 of the Network Act, in case that a service provider fails to designate a domestic agent despite of its obligation will be subject to an administrative fine of an amount not exceeding KRW 20 million.