Home | Databases | WorldLII | Search | Feedback Laws of the Republic of Korea

ENFORCEMENT DECREE OF THE ACT ON PROTECTION & UTILIZATION OF LOCATION INFORMATION, ETC.

Enforcement Decree of the Act on Protection & Utilization of Location Information, etc.

Amended in whole on Feb. 29, 2008. Presidential Decree 20670 Chapter 1 General Provisions

Article 1 (Purpose) This Decree is intended to provide for matters delegated from the Act on Protection & Utilization of Location Information, etc. and other details required for enforcement of such act. Chapter 2 Permission of the location information business, etc. Article 2 (Application for License) A person who intends to obtain a license in accordance with Article 5.1 of the Act on Protection & Utilization of Location Information (hereinafter "Act") may apply for such license in the name of representative of corporate entity already existing or of shareholders of corporate entity being incorporated. A person who intends to obtain a license shall submit the application for location information business license (including an electronic copy of such application) enclosed with each of the following documents (including electronic copies thereof) to the Korea Communications Commission (KCC):

1. Business plan

2. List of shareholders of corporation (applicable only to corporate entities being incorporated)

Government official who receives a license application in accordance with Paragraph 2 shall confirm a copy of corporate registry via joint use of administrative information set forth in Article 21.1 of the E-Government Act; provided, however, that, if applicant does not consent to such confirmation, such applicant shall be required to attach a copy of corporate registry to the application package.

- 2 -

Business plan set forth in Paragraph 2.1 above shall include information set forth in Exhibit 1.

Upon receipt of license application according to Paragraph 2, KCC shall notify applicant of its decision within 3 months from the date of submission. However, if it is not possible for KCC to give a notice within such time frame for an unavoidable reason, KCC may extend such time frame up to 2 months only once.

If extending the time frame according to the proviso to Paragraph 5, KCC shall notify in writing applicant of such extension and reason therefor.

Article 3 (Specific Review Criteria by Review Item) Specific review criteria by review item according to Article 5.3 of the Act shall be set forth in Exhibit 2.

KCC may define and publish matters relating to evaluation methods by specific review criteria set forth in Paragraph 1. Article 4 (Issuance of License Certificate, etc.) KCC shall record the following information in the location information business license register and issue license information business certificate when licensing a business according to Article 5.1 of the Act or changing such business according to Article 5.7 therein:

1. License number and license date

2. Company name and representative name

3. Type and description of location information business

4. Address of principal office

5. Equity capital or asset value

6. Description and location of major business facilities

7. License terms and conditions Location information business operator may describe a reason and request re-issuance of license certificate to KCC in case of loss of or damage to its license certificate.

Article 5 (Change Authorization) "Material matter prescribed in - 3 -

Presidential Decree" set forth in Article 5.7 of the Act shall mean each of the following:

1. Company name

2. Change to location information system (applicable only if change results in degradation of technological level of personal location information from the level effective at the time of initial licensing) A person who intends to obtain authorization of change to location information business according to Article 5.7 of the Act shall submit the location information business change authorization application (including an electronic copy of such application) enclosed with each of the following documents (including electronic copies thereof) to KCC:

1. Revised business plan

2. Other documents verifying applicable change Article 6 (Authorization of Assignment of Location Information Business and Merger of Corporation, etc.) A person who intends to obtain authorization of assignment of location information business according to Article 7.1 of the Act shall submit the location information business assignment authorization application (including an electronic copy of such application) enclosed with each of the following documents (including electronic copies thereof) to KCC:

1. A copy of assignment agreement document

2. Business plan A person who intends to obtain authorization of merger/divestiture (including demerger and the same is applicable below) of corporation that is a location information business operator according to Article 7.1 of the Act shall submit the location information business merger/divestiture authorization application (including an electronic copy of such application) enclosed with each of the following documents (including electronic copies thereof) to KCC:

1. A copy of merger/divestiture agreement document

2. Business plan Government official who receives an authorization application according to Paragraph 1 or 2 above confirms a copy of corporate - 4 -

registry of assignee or parties to merger/divestiture transaction via joint use of administrative information set forth in Article 21.1 of the E-Government Act; provided, however, that, if applicant does not consent to such confirmation, such applicant shall be required to attach a copy of corporate registry to the application package.

KCC shall issue location information business certificate upon authorization of assignment or merger/divestiture according to Paragraph 1 or 2.

Article 7 (Approval of Suspension/Termination of Location Information Business) A person who intends to obtain approval of suspension or termination of business in whole or in part according to Article 8.1 or 2 of the Act shall submit the location information business suspension or termination approval application (including an electronic copy of such application) enclosed with each of the following documents (including electronic copies thereof) to KCC:

1. Document that can verify scope of business to suspend or terminate and major facilities (applicable only to suspension or termination in part)

2. Document setting forth the plan to notify personal location information subject of such suspension or termination Article 8 (Notification of Location Information Business Suspension/Termination) A person who intends to obtain approval of suspension or termination of business in whole or in part according to Article 8.1 or 2 of the Act shall notify personal location information subject of each of the following information:

1. Description of business to suspend or terminate and reason therefor

2. Date of suspension or termination (including date of business resumption in case of suspension)

Location information business operator shall take the following actions if it intends to notify personal location information subject of suspension or termination according to Paragraph 1:

1. Notice to personal location information subject in writing, by e-mail - 5 -

or other means

2. Public notice for at least 30 days on its website Article 9 (Reporting of Location-Based Service Business) A person who intends to report location-based service business according to Article 9.1 of the Act shall submit the location-based service business report (including an electronic copy of such report) enclosed with each of the following documents (including electronic copies thereof) to KCC:

1. Business plan

2. Document that can verify the description of major business facilities and installation location thereof

3. Document that attests to the location information protection arrangement according to Article 16 of the Act

Government official who receives a report in accordance with Paragraph 1 shall confirm a copy of corporate registry or business registration certificate via joint use of administrative information set forth in Article 21.1 of the E-Government Act; provided, however, that, if reporter does not consent to such confirmation, such reporter shall be required to attach a copy of corporate registry to the report. Article 10 (Reporting of Change) "Material matter prescribed in Presidential Decree" set forth in Article 9.3 of the Act shall mean each of the following:

1. Company name

2. Location of principal office

2. Change to location information system (applicable only if change results in degradation of technological level of personal location information from the level effective at the time of initial licensing) A person who intends to report change to location-based service business according to Article 9.3 of the Act shall submit the location-based service business change report (including an electronic copy of such report) enclosed with each of the following documents (including electronic copies thereof) to KCC:

1. Revised business plan - 6 -

2. Other documents verifying applicable change Article 11 (Reporting of Assignment of Location-Based Service Business and Merger of Corporation, etc.) A person who intends to report assignment of location-based service business according to Article 10.1 of the Act shall submit the location information business assignment report (including an electronic copy of such report) enclosed with each of the following documents (including electronic copies thereof) to KCC:

1. A copy of assignment agreement document

2. Business plan A person who intends to report succession to location-based service business according to Article 10.1 of the Act shall submit the location information business succession report (including an electronic copy of such report) enclosed with document attesting to such succession (including electronic copy thereof) to KCC.

A person who intends to obtain authorization of merger/divestiture of corporation that is a location-based service business operator according to Article 10.1 of the Act shall submit the location-based service business merger/divestiture authorization report (including an electronic copy of such report) enclosed with each of the following documents (including electronic copies thereof) to KCC:

1. A copy of merger/divestiture agreement document

2. Business plan Government official who receives a report according to Paragraph 1 or 3 above confirms a copy of corporate registry or business registration certificate of assignee or parties to merger/divestiture transaction via joint use of administrative information set forth in Article 21.1 of the E-Government Act; provided, however, that, if reporter does not consent to such confirmation, such reporter shall be required to attach a copy of corporate registry or business registration certificate to the report. Article 12 (Reporting of Suspension/Termination of Location Information Business) A person who intends to report suspension or termination of business in whole or in part according to Article 11.1 or 2 of the Act - 7 -

shall submit the location-based service business suspension or termination report (including electronic copy of such report) enclosed with each of the following documents (including electronic copies thereof) to KCC:

1. Document that can verify the scope of business to suspend or terminate and major facilities (applicable only to suspension or termination in part)

2. Document setting forth the plan to notify personal location information subject of such suspension or termination The provisions in Article 8 shall be applied mutatis mutandis to location-based service business operator that intends to suspend or terminate its business in whole or in part according to Article 11.1 and 2 of the Act .

Article 13 (Reporting of Service Terms & Conditions) A person who intends to report service terms & conditions regarding tariff, collection, usage and disclosure of location information according to Article 12.1 of the Act (hereinafter "Service Terms & Conditions") shall submit the service terms & conditions to KCC at least 30 days prior to business launch.

A person who intends to report change to service terms & conditions according to the latter provisions in Article 12.1 of the Act shall submit the service terms & conditions to KCC 10 days prior to such change. Article 14 (Specific Criteria for Administrative Disposition, etc.) Specific criteria for administrative disposition according to Article 13.2 of the Act shall be as set forth in Exhibit 3.

KCC shall immediately publicize revocation of license or authorization, termination or suspension of business according to Paragraph 1. Article 15 (Penalty Imposition Criteria) "Location information business or location-based service business sales" mentioned in Article 14.1 of the Act shall mean annual average sales of immediately preceeding 3 years from the fiscal year when applicable location information business or location-based service business operator (hereinafter "Location Information - 8 -

Business Operator, etc.") committed a violation. However, if less than 3 years have passed since business launch as of the beginning of applicable fiscal year, such sales figure shall mean the sum equal to sales incurred until the end of such fiscal year converted to year-on-year average sales. Such sales figure shall also mean the sum equal to sales incurred from the date of business launch to the date of violation converted to year-on-year average sales, if business is launched in applicable fiscal year.

Type of violation subject to penalty according to Article 14.1 of the Act and penalty amount shall be as set forth in Exhibit 4. Each of the following shall be considered in determining penalty amount to be imposed according to Paragraph 2:

1. Description and severity of violation

2. Duration and frequency of violation

3. Profit incurred by violation Article 16 (Imposition & Payment of Penalty) When imposing penalty according to Article 14.1 of the Act, KCC shall examine and confirm violation in issue and notify in writing the violator of violation, penalty amount, appeal procedure and due date.

A person who receives a notice pursuant to Paragraph 1 shall pay penalty to an agency designated by KCC within 20 days from the date of notice; provided, however, that, if it is not possible to pay such penalty within a prescribed time frame due to natural disasters or other force majeure event, such penalty shall be paid in 7 days from the date when such event ceases to exist.

Article 17 (Extension of Penalty Due Date & Payment in Installments) If it is deemed to be difficult for a person who must pay penalty in excess of 300 million Korean won according to Article 14.1 of the Act to pay such penalty due in lump sum for any of the following causes, KCC may defer due date or allow for payment in installments. If required, KCC may require such person liable for penalty to provide collateral:

1. Natural disaster or fire has caused material damage to its assets - 9 -

2. Deterioration of business climate has jeopardized survival of business materially

3. Lump sum penalty payment is expected to degrade financial standing materially

A person who intends to have penalty due date deferred or make payment in installments shall submit the application enclosed with document verifying the cause of due date deferral or installment payment to KCC 10 days prior to original due date.

Penalty due date may not be deferred over 1 year from the date immediately following such due date.

In case of installment payment, intervals between each installment may not exceed 4 months and the number of installments may not exceed 3 times.

Article 18 (Additional Charge) Additional charge in Article 14.3 of the Act shall mean the sum equal to 6/100 of overdue penalty amount at annual interest rate.

Article 19 (Demanding of Additional Charge) Demand according to Article 14.4 of the Act shall be made in writing within 7 days after due date. If a demand note is issued according to Paragraph 1, due date for additional charge overdue shall be within 10 days from the date of issuance.

Chapter 3 Protection of location information

Paragraph 1 General provisions

Article 20 (Managerial/Technical Protection Arrangement of Location Information) Managerial arrangement according to Article 16.1 of the Act shall include the following:

1. Designation of location information manager

2. Hierarchical access authorization to each stage including location information collection, usage, disclosure, removal, and restriction of such - 10 -

authorization

3. Development of location information handling/management procedure and guideline setting forth obligations and responsibilities of location information handler

4. Preparation/maintenance of location information log recording location information disclosure

5. Regular in-house audit of location information protection arrangement Technical arrangement according to Article 16.1 of the Act shall include the following:

1. Identification and authentication to verify access authorization to location information and location information system

2. Encryption/firewall installation to block unauthorized access to location information system

3. Availability of electronic automatic logging system to record access to location information system

4. Installation and operation of security program to prevent intrusion into location information system

Article 21 (Examination of Location Information Protection Arrangement, etc.) Government official who examines details and record preservation status of technical/managerial arrangements according to Article 16.3 of the Act shall notify location-based service provider of each of the following 3 days prior to examination; provided, however, that this provision shall not be applied if examination is required urgently in response to actual violation of personal location information or specific appeal to such violation:

1. Justification and purpose of examination

2. Date of examination

3. Examiner's profile

4. Examination details Paragraph 2 Protection of personal location information Article 22 (Matters to be Prescribed in Service Terms & Conditions for Location Information Collection) "Matter prescribed by Presidential - 11 -

Decree" mentioned in Article 18.1.5 of the Act shall mean collection method of personal location information.

Article 23 (Matters to be Prescribed in Service Terms & Conditions for Personal Location Information Usage/Disclosure) "Matter prescribed by Presidential Decree" mentioned in Article 19.1.5 of the Act shall mean matters relating to notification according to Article 19.3 of the Act. Article 24 (Notification of Personal Location Information Disclosure) As for notification to be made according to Article 19.3 of the Act, location information business operator shall send a notice to applicable communication terminal from which personal location information is collected. However, if any of the following is the case, such notice may be sent to communication terminal or e-mail address prescribed in advance by personal location information subject:

1. If applicable communication terminal from which personal location information is collected is not equipped with a function to receive text, audio or video message

2. If it is requested by personal location information subject in advance that such notice may be sent to communication terminal other than applicable communication terminal from which personal location information is collected or e-mail address prescribed in advance. Article 25 (Request for & Disclosure of Location Information) Location-based service business operator shall request personal location information to location information business operator according to Article 20.1 of the Act, specifying the following:

1. Consent by personal location information subject

2. Scope and duration of personal location information Prior to disclosure of personal location information, location information business operator that receives a request in Paragraph 1 shall confirm consent by personal location information subject in advance. KCC may define and publicize specific details regarding personal location information disclosure procedure and method according to Article - 12 -

20.2 of the Act.

Article 26 (Notification of Business Assignment, etc.) Location information business operator, etc. shall take each of the following actions when notifying personal location information subject of business assignment, merger or succession according to Article 22 of the Act:

1. Notice to personal location information subject in writing, by e-mail or other means

2. Public notice for at least 30 days on its website Notice mentioned in Paragraph 1.1 above may be substituted by at least one announcement in two or more national daily newspapers (including local daily newspaper covering a specific area where most of personal location information subjects reside if that is the case) set forth in Article 12.1 of the Act on Freedom of Newspaper and Assurance of Its Function if contact information of personal location information subject is not known without negligence of location information business operator or natural disaster or other force majeure event exists. "Matter prescribed by Presidential Decree" mentioned in Article 22.3 of the Act shall mean each of the following;

1. Matters relating to rights and obligations of personal location information subject

2. Matters relating to managerial/technical arrangements for protection of personal location information

Paragraph 3 Rights of personal location information subjects, etc. Article 27 (Requirements for Consent on Location Information Use to Protect 8-year or less old Children) A person who intends to consent to collection, usage or disclosure of his or her child's personal location information to protect life or health of such child set forth in each sub-paragraph of Article 26.1 of the Act (hereinafter "8-year or less old Children, etc.") shall submit the written statement of consent enclosed with document verifying his or her capacity as a guardian of 8-year or less old child to location information business operator, etc. - 13 -

Written statement of consent mentioned in Paragraph 1 shall state the following and be signed or affixed with a seal by such guardian:

1. Name, address, birth date of 8-year or less old child

2. Name, address, contact detail of guardian

3. Fact that collection, usage or disclosure of personal location information is limited to protection of life or health of 8-year or less old child

4. Date of consent Chapter 4 Use of personal location information for emergency relief Article 28 (Determination of Emergency Situation) Emergency rescue agency that receives emergency rescue request according to Article 29.1 of the Act may confirm each of the following from the person requesting emergency rescue to determine emergency situation:

1. Name and contact details of person in need of emergency rescue

2. Name and contact details of person requesting emergency rescue and his or her relationship with the person in need of emergency rescue

3. Other matters necessary for determination of emergency situation

Article 29 (Special Phone Number Services) "Special phone number services prescribed by Presidential Decree" in Article 29.2 of the Act shall mean each of the following special numbers assigned according to the electrical communication number management plan pursuant to Article 36 of the Telecommunications Business Act:

1. Special number for reporting emergency incidents such as fire, life rescue, medical incident (excluding matters in Paragraph 2 below): 119

2. Special number for reporting maritime incident or other emergencies: 122

Article 30 (Alarm Broadcasting Method and Procedure) Emergency rescue agency that intends to request location information business operator to broadcast alarm according to Article 29.5 of the Act shall - 14 -

provide location information business operator with alarm broadcasting request (including an electronic copy of request) stating each of the following information:

1. Reason for requesting alarm broadcasting

2. Target area for alarm broadcasting

3. Alarm broadcasting time, duration and frequency

4. Other reference information for alarm broadcasting When requesting alarm broadcasting to location information business operator according to Paragraph 1, an emergency rescue agency shall make a request via location information system equipped with following devices:

1. Automatic logging device for alarm broadcasting request

2. Safety mechanism to prevent disclosure, alteration, damage of personal location information and unauthorized access Location information business operator that receives alarm broadcasting request according to Paragraph 1 shall broadcast alarm using location information system.

Chapter 5 Promotion of the infrastructure for use of location information, etc.

Article 31 (Scope of Research Organization, etc.) Research organization that KCC may engage in research and development projects according to Article 33.1 of the Act shall include the following:

1. National Information Society Agency according to Article 10 of the Information Society Promotion Framework Act

2. Institute of Information Technology Assessment according to Article 35.2 of the Information Society Promotion Framework Act

3. Korea Information Security Agency according to Article 52.1 of the Act on Information Communication Network Promotion and Information Privacy

4. Electronics and Telecommunications Research Institute according to Article 8.1 of the Act on Establishment, Operation and Promotion of Government-Invested Science and Technology Research Organization - 15 -

5. Other research organizations established to develop information network technologies and devices and designated by KCC Article 32 (Scope of Standardization) Scope of standardization according to Article 34.3 of the Act shall include the following:

1. Technologies relating to protection and authentication of location information

2. Technologies relating to collection, storing, management and disclosure of location information

3. Technologies relating to emergency rescue and other public services

4. Other foundational technologies relating to protection and use of location information

Article 33 (Projects Regarding Promotion of Location Information Use, etc.) KCC may implement the following projects according to Article 35.1 of the Act:

1. Research projects for improvement of legal and regulatory framework to protect location information and promote location information business and location-based service business (hereinafter "location information business, etc.")

2. Foundation creation project to promote location information business, etc. such as location information technology development and distribution projects

3. Pioneering/application technology projects and relevant research projects to develop location information business, etc.

4. Projects to improve and assess quality of location information business, etc.

5. Location information utilization framework development projects for public benefits such as development of technology and device for location information use for public purposes

6. Pilot project to utilize and distribute location information technology, device and application service with efficiency

7. Standardization project for protection, collection, use and disclosure - 16 -

of location information

8. Other projects necessary for protection of location information and creation of service environment

Article 34 (Operation of Location Information Deliberation Committee) Chairman of the Location Information Deliberation Committee according to Article 36.1 of the Act (hereinafter "Committee") shall chair the Committee and oversee its operation.

To administer its operation, the Committee shall have 1 secretary who is a KCC official designated by KCC Chairman.

Article 35 (Meeting of Committee) The Committee Chairman shall convene and chair the Committee meetings.

The Chairman shall notify each Committee member of meeting date, venue and agenda 7 days prior to meeting convocation. However, such notice may be given 1 day prior to meeting convocation if there is urgent agenda or unavoidable reason.

The Committee shall open with a majority of all Committee members and resolve by a majority of the attending members. The Committee may request relevant expert or head of expert agency to present opinion if it is deemed to be necessary for deliberation of each matter in Article 36.2 of the Act.

Article 36 (Allowance) Allowance may be paid to attending Committee members to the extent that the Committee budget allows. However, such allowance shall not be paid to a Committee member who is a government official attending in direct relation to his or her responsibilities.

Article 37 (Operation Rule) Matters necessary for Committee organization and operation but not specified herein may be determined by the Chairman upon resolution of the Committee.

- 17 -

Chapter 6 Penal provisions

Article 38 (Fine) When imposing fine according to Article 43.4 of the Act, KCC shall examine/confirm applicable violation and notify in writing an entity subject to fine of violation, appeal method and time frame. When imposing fine according to Paragraph 1, KCC shall allow such entity subject to fine to appeal orally or in writing within at least 10 days. If no appeal is made within the prescribed time frame, It shall be deemed that such entity will raise no appeal.

KCC shall consider motive and consequence of applicable violation in determining fine amount.

Fine shall be collected according to the government revenue collection procedure set forth in government treasury administration laws or regulations. Appeal method and duration shall be stated in fine invoice as well.

Provisions in Paragraphs 1 to 4 shall be applied mutatis mutandis to fine imposition according to Article 43.8 of the Act with "KCC" substituted by "Firefighting Headquarters Director or Fire Department Chief".Article 39 (Joint Use of Administrative Information) If details of attachment documents can be confirmed via joint use of administrative information according to Article 21.1 of the E-Government Act, such confirmation may substitute attachment documents prescribed for submission in Article 2.2, Article 5.2, Article 6.1-2, Article 7, Article 9, Article 10.2, Article 10 and Article 12.1.Addendum <20670, Feb. 29, 2008>Article 1 (Effective Date) This Decree shall take effect on the date of promulgation.

Article 2 (Relationship with Other Laws/Regulations) If other laws or regulations refer to the previous version of the Enforcement Decree or the Enforcement Rule of the Act on Protection and Utilization of Location Information, etc. or provisions therein and this Decree contains corresponding provisions herein, such previous provisions shall be deemed to be superseded by this Decree or provisions herein.