Korea’s Most Recent Announcement on the Regulation of Behavioural Information

In late January 2024, the Personal Information Protection Commission (PIPC) of Korea organised a seminar to address “Policy Direction for Personalised Advertising” and to elucidate the forthcoming regulatory framework for online behavioural information processing. This event provided insight into the holistic stance of the PIPC regarding the processing of online behavioural information for personalised advertising purposes. It entailed the delineation of responsibilities for “advertising businesses” and “advertising media businesses”, potentially impacting companies that employ personalised advertising strategies. This would be a pivotal aspect in comprehending the regulation of behavioural information in Korea.

In Korea, the Personal Information Protection Act (PIPA), which serves as the fundamental legislation for data privacy, does not specifically define or regulate behavioural information separately. Furthermore, there are no other regulations below PIPA that address this issue. Instead, the PIPC has been operating under the Guidelines established and announced as far back as 2017, focusing on regulating personalised advertising and serving as the framework for regulating behavioural information-related matters thus far. Apart from this, the basic premise has been that if behavioural information is to be used in conjunction with personally identifiable information, data processors must obtain prior consent from the data subject, imposing an obligation on them to comply with PIPA.

However, the current market for personalised advertising differs from traditional advertising markets in that there are various ad tech companies acting as intermediaries between advertisers and web/app operators selling advertising space. Additionally, the nature of their operations is highly diverse. Furthermore, it is challenging for external parties to easily discern their processes for handling and distributing behavioural information. In response to this situation, the PIPC has expressed its determination to address the inadequate regulatory framework for behavioural information processing in Korea. They aim to achieve transparency and legality in the processing of behavioural information, thereby mitigating legal uncertainties and fostering a healthy advertising ecosystem.

The “Policy Direction for Personalised Advertising” assigns specific responsibilities and roles to advertising businesses and advertising media businesses. It particularly outlines obligations and recommendations separately. However, considering the prevailing practices in Korea, it can be deemed acceptable that ultimately, all recommendations are also considered obligatory to follow.

An advertising business refers to an entity that collects users’ behavioural information through its own or third-party websites, apps, etc, and delivers personalised advertisements on its own or third-party websites and apps.

Advertising media businesses refer to entities that provide advertising space to display personalised advertisements on their own websites, apps, or other platforms. If an advertising media business directly processes behavioural information, the same principles and guidelines applicable to advertising businesses apply.

However, if an advertising media business allows third-party collection tools to gather behavioural information, the following recommendations apply.

The PIPC has announced plans to conduct an online inspection on personalised advertising during the first half of this year. Additionally, the PIPC will conduct inspections in conjunction with the newly implemented privacy policy evaluation system starting from March this year. This initiative aims to ensure that advertising businesses and advertising media businesses properly disclose the collection and usage of behavioural information in their privacy policies.

The PIPC plans to establish an online behavioural information protection public-private consultation group in the first quarter of this year and is set to announce revised personalised advertising guidelines by the end of the year. In practice, these guidelines are expected to contain specific regulations regarding behavioural information and personalised advertising, imposing greater responsibilities on both advertising businesses and advertising media businesses. Therefore, it is crucial to carefully examine the content of the revisions once they are announced.