Basket Get Email Updates
Search: Login
International Business Reports
Practice Areas Browse A-Z
NEW Aviation Finance & Leasing
Cartels & Leniency
Class & Group Actions
Construction & Engineering Law
NEW Consumer Protection
Corporate Recovery & Insolvency
NEW Derivatives
NEW Digital Business
NEW Digital Health
NEW Drug & Medical Device Litigation
Enforcement of Foreign Judgments
Environment & Climate Change Law
Financial Services Disputes
Foreign Direct Investment Regimes
Investor-State Arbitration
Lending & Secured Finance
Oil & Gas Regulation
Pharmaceutical Advertising
Public Investment Funds
Shipping Law
Telecoms, Media & Internet
Vertical Agreements and Dominant Firms
Compare & Research
IBR News
IBR Companies
GLG Events
Korea: Cybersecurity 2020
The ICLG to: Cybersecurity Laws and Regulations - Korea covers common issues in cybersecurity laws and regulations, including criminal activity, applicable laws, specific sectors, corporate governance, litigation, insurance, employees, and investigatory and police powers – in 32 jurisdictions.
ICLG.com > Practice Areas > Cybersecurity > Korea
Chapter Content Free Access
Specific Sectors
Investigatory and Police Powers
1. Criminal Activity
1.1 Would any of the following activities constitute a criminal offence in your jurisdiction? If so, please provide details of the offence, the maximum penalties available, and any examples of prosecutions in your jurisdiction:
Hacking (i.e. unauthorised access)
Under the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. (the "Network Act"), any person who infiltrates another's information communication network ("ICN") without authorised access or beyond the scope of authorised access is subject to imprisonment for not more than five years or a penalty of not more than KRW 50 million.
Similarly, under the Electronic Financial Transactions Act (the "EFTA"), any person who accesses an electronic financial system without authorisation is subject to imprisonment of not more than 10 years or a penalty of not more than KRW 100 million.
Denial-of-service attacks
Under the Network Act, any person who causes disruption of an ICN by intentionally disturbing network operations with large volumes of signal/data or superfluous requests is subject to imprisonment of not more than five years or a penalty of not more than KRW 50 million.
Also, under the EFTA, any attacks on electronic financial systems using programs such as a computer virus, logic bomb or email bomb with the intention of destroying data on, or disrupting the operation of, electronic financial systems is subject to imprisonment of not more than 10 years or a penalty of not more than KRW 100 million.
Under the Special Act On The Prevention Of Loss Caused By Telecommunications-Based Financial Fraud And Refund For Loss (the "Special Act on Financial Fraud") any person who causes other persons to input data or instructions into computers or other information processing units, or inputs data or instructions into computers or other information processing units by using other persons' data he or she acquires, for the purpose of telecommunications-based financial fraud, is subject to imprisonment of not more than 10 years or a penalty of not more than KRW 100 million.
Infection of IT systems with malware (including ransomware, spyware, worms, trojans and viruses)
Under the Network Act, any person who transmits or distributes malware that can damage, destroy, alter, falsify or disrupt the operation of ICN systems, data or programs, without a justifiable cause, is subject to imprisonment for not more than seven years or a penalty of not more than KRW 70 million.
Moreover, under the EFTA, any person who installs programs, such as a computer virus, logic bomb, or email bomb, for the purpose of destroying data of electronic financial infrastructure or obstructing the operation of electronic financial infrastructure, is subject to imprisonment for not more than 10 years or a penalty of not more than KRW 100 million.
Possession or use of hardware, software or other tools used to commit cybercrime (e.g. hacking tools)
Under the Network Act, any person who mutilates, destroys, alters, or forges an information and communications system, data, program or similar without a justifiable grounds, or conveys or spreads a program that is likely to interrupt the operation of such system, data, program or similar, is subject to imprisonment for not more than seven years or a penalty of not more than KRW 70 million.
Identity theft or identity fraud (e.g. in connection with access devices)
Under the EFTA, a person who forges or alters a means of access (i.e., means or information which is used to issue a transaction request in electronic financial transactions or to secure the authenticity and accuracy of users and the details of such transaction) is subject to imprisonment of not more than seven years or a penalty of not more than KRW 50 million. Moreover, any person who transfers or takes over a means of access, or borrows or lends a means of access in return for receipt, demand or promise of any compensation, is subject to imprisonment of not more than three years or a penalty of not more than KRW 20 million.
Under the Digital Signature Act ("DSA"), any person who steals or discloses another person's digital signature creating key (i.e., a sequence of bits used to affix a digital signature to an electronic message), or has an authorised certificate issued in the name of another person or supports such issuance, is subject to imprisonment of not more than three years or a penalty of not more than KRW 30 million.
Moreover, under the Network Act and the Personal Information Protection Act ("PIPA"), anyone who collects another person's information or induces the provision of another person's information through the ICN by deceptive means, or acquires personal information or obtains the consent for processing of personal information through an illegitimate means or method, is subject to imprisonment for not more than three years or a penalty of not more than KRW 30 million.
Electronic theft (e.g. breach of confidence by a current or former employee, or criminal copyright infringement)
Under the Unfair Competition Prevention and Trade Secret Protection Act, any person who acquires, uses, or leaks to any third party trade secrets for the purpose of making an improper profit or causing damage to a person who possesses trade secrets, is subject to imprisonment for not more than five years or a penalty of not more than KRW 50 million. If such act is considered a breach of fiduciary duty under the Criminal Act, the person is subject to imprisonment for not more than 10 years or a penalty of not less than KRW 30 million. Moreover, if an electronic theft implicates any copyright infringement, such act may result in imprisonment for not more than five years or a penalty of not more than KRW 50 million.
Any other activity that adversely affects or threatens the security, confidentiality, integrity or availability of any IT system, infrastructure, communications network, device or data
Under the Network act, any person who mutilates another person's information processed, stored or transmitted through an ICN, or infringes, misappropriates or divulges another person's secret, is subject to imprisonment of not more than five years or a penalty of not more than KRW 50 million.
Failure by an organisation to implement cybersecurity measures
Under the Network Act, information communications service providers ("ICSPs") must, when managing personal information of the data subject (i.e., the owner of the personal information), implement technical and managerial measures to prevent loss, theft, leakage, forgery or alteration of or damage to personal information (collectively, "leakage") and secure the safety of personal information. Failure to do so will be subject to a penalty of not more than KRW 30 million. If any leakage of personal information occurs due to the provider's failure to implement technical and administrative measures, such failure is subject to a penalty of not more than 3% of the sales revenue related to the violation, and imprisonment of not more than two years or a penalty of not more than KRW 20 million.
Moreover, under the EFTA, any financial company, electronic financial business or subsidiary electronic financial business that fails to comply with the standards determined by the Financial Services Commission ("FSC"), which is provided to ensure security and reliability of electronic financial transactions, is subject to a penalty of not more than KRW 50 million.
1.2 Do any of the above-mentioned offences have extraterritorial application?
There is no specific provision in the Network Act or PIPA that stipulates or implicates extraterritorial application of the above-mentioned offences. However, if the information collected and processed outside Korea is that of Korean users, the Korean regulatory authority may find that the Network Act or the PIPA is applicable to such case and impose necessary administrative fines or sanctions under the Network Act or the PIPA. Moreover, the Korean Criminal Act provides that the Act generally applies to aliens who commit crimes, including those provided by other Acts and subordinate statutes, against the Republic of Korea or its nationals outside the territory of the Republic of Korea. Moreover, the EFTA stipulates that, in principle, the Act applies to foreigners or foreign corporations.
1.3 Are there any actions (e.g. notification) that might mitigate any penalty or otherwise constitute an exception to any of the above-mentioned offences?
With respect to criminal prosecution of personal information leakage Incidents, the responsible party may be discharged from liability if the requisite safeguard measures (i.e., technical and managerial measures) under the Network Act have been properly implemented.
If the responsible party voluntarily reports such leakage Incident, the Korea Communications Commission ("KCC") may take it into account as a mitigating factor and reduce the amount of penalty to be imposed against the responsible party.
1.4 Are there any other criminal offences (not specific to cybersecurity) in your jurisdiction that may arise in relation to cybersecurity or the occurrence of an Incident (e.g. terrorism offences)? Please cite any specific examples of prosecutions of these offences in a cybersecurity context.
Under the Act on the Protection of Information and Communications Infrastructure (the "PICIA"), any person who disturbs, paralyses or destroys critical ICN infrastructure facilities such as electronic control or managerial systems related to national security, government administration, military defence, policing, finance, telecommunications, transportation and energy is subject to imprisonment for not more than 10 years or a penalty of not more than KRW 100 million.
2. Applicable Laws
2.1 Please cite any Applicable Laws in your jurisdiction applicable to cybersecurity, including laws applicable to the monitoring, detection, prevention, mitigation and management of Incidents. This may include, for example, laws of data protection, intellectual property, breach of confidence, privacy of electronic communications, information security, and import/export controls, among others.
In Korea, laws applicable to cybersecurity include: the Network Act; Protection of Communication Secret Act ("PCSA"); PICIA; Electronic Government Act ("EGA"); Act on Establishment of Infrastructure for Informatization of National Defence and Management of Informational Resources for National Defence; EFTA; Credit Information Use and Protection Act (the "Credit Information Act"); Act on the Protection, Use, etc. of Location Information; Act on Prevention of Divulgence and protection of Industrial Technology; PIPA; Act on Prevention of Divulgence and Protection of Industrial Technology; and Special Act on Financial Fraud.
2.2 Are there any cybersecurity requirements under Applicable Laws applicable to critical infrastructure in your jurisdiction? For EU countries only, please include details of implementing legislation for the Network and Information Systems Directive and any instances where the implementing legislation in your jurisdiction exceeds the requirements of the Directive.
Under the PICIA, the head of the organisation managing the critical ICN infrastructure facilities has an obligation to establish and implement managerial measures, including physical and technical measures (such as prevention, backup, recovery, etc.) to safely protect the facilities and data managed by the organisation.
Under the Network Act, companies that operate clustered information and communications facilities (i.e., business operators who operate and manage clustered information and communications facilities to render information and communications services on behalf of another person (e.g., Internet Data Centre)) are required to take protective measures to stably operate the information and communications facilities.
2.3 Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to take measures to monitor, detect, prevent or mitigate Incidents? If so, please describe what measures are required to be taken.
Under the "Standards of Technical and Managerial Safeguards for Personal Information" which have been adopted Notice pursuant to the Network Act, ICSPs are required to install and operate systems equipped with the following functions to prevent illegal access and intrusion Incidents via ICNs:
functions restricting unauthorised access to the Personal Data Processing System ("PDPS") by limiting access authority by internet protocol ("IP") address etc.; and
detect any illegal attempts to acquire personal data by analysing the IP addresses, etc. that accessed the PDPS.
Moreover, under the Network Act, if an intrusion Incident occurs (e.g., intrusion of an ICN or any other related information systems by using the means of hacking, a computer virus, logic bomb, email bomb, denial of service, high-powered electromagnetic wave, etc.), the ICSPs are required to analyse the causes of any intrusion Incidents and keep damage from intrusion at bay.
2.4 In relation to any requirements identified in question 2.3 above, might any conflict of laws issues arise? For example, conflicts with laws relating to the unauthorised interception of electronic communications or import/export controls of encryption software and hardware.
It is unlikely that conflict of law issues may arise in relation to the requirements identified in question 2.3 above. It should be noted, however, that the PCSA provides that interfering with transmission and reception of the telecommunications without the consent of the party concerned is a type of "wiretapping" under the Act, and that no person is allowed to wiretap any telecommunications without recourse to the PCSA, the Criminal Procedure Act or the Military Court Act.
2.5 Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents (including cyber threat information, such as malware signatures, network vulnerabilities and other technical characteristics identifying a cyber attack or attack methodology) to a regulatory or other authority in your jurisdiction? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; (b) the regulatory or other authority to which the information is required to be reported; (c) the nature and scope of information that is required to be reported; and (d) whether any defences or exemptions exist by which the organisation might prevent publication of that information.
Under the Network Act, all ICSPs or Collective ICN Facility Operators must report any "infiltration Incidents" to the Minister of Science and ICT or Korea Internet and Security Agency ("KISA").
In addition, all ICSPs (and providers of similar services) must report any loss, theft, or leakage of personal information, including (i) the items of personal information lost, stolen or leaked, (ii) the time of the occurrence, (iii) actions that can be taken by the data subjects, (iv) protective response measures taken by the personal information service provider, and (v) contact information of the department to which the data subject can make inquiries, to the KCC or KISA within 24 hours since the provider becomes aware of such Incident. The provider may report the Incident after the 24-hour period, only if the provider has a justifiable cause, in which case the provider must explain such cause to the KCC.
In addition, the EFTA requires that if an Incident, such as disturbance or paralysis of an electronic financial infrastructure facility, occurs due to an electronic infringement, the relevant financial company and electronic financial business must, without delay, inform the Incident to the FSC.
2.6 If not a requirement, are organisations permitted by Applicable Laws to voluntarily share information related to Incidents or potential Incidents (including cyber threat information, such as malware signatures, network vulnerabilities and other technical characteristics identifying a cyber attack or attack methodology) with: (a) a regulatory or other authority in your jurisdiction; (b) a regulatory or other authority outside your jurisdiction; or (c) other private sector organisations or trade associations in or outside your jurisdiction?
It is not prohibited by law to voluntarily share information relating to Incidents or potential Incidents when such information is not strictly required to be reported. However, the Network Act provides that submission of communication confirmation data (e.g., Internet log data, connection point tracking data) that is made pursuant to the PCSA must satisfy the requirements set forth in the PCSA (e.g., permission of a court).
2.7 Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents to any affected individuals? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; and (b) the nature and scope of information that is required to be reported.
Yes, under the Network Act, any ICSP who becomes aware of a personal information Incident as described in question 2.5 must notify the data subject of the leaked information, without delay, including the following: (i) items of personal information affected (e.g., leaked); (ii) the timing and circumstances of the leakage; (iii) the actions that can be taken by the data subject to minimise any damages resulting from the Incident; (iv) the protective response measures taken by the personal information service provider; and (v) the name and contact information of the department to which the data subject can make inquires or file a report.
2.8 Do the responses to questions 2.5 to 2.7 change if the information includes: (a) price-sensitive information; (b) IP addresses; (c) email addresses (e.g. an email address from which a phishing email originates); (d) personally identifiable information of cyber threat actors; and (e) personally identifiable information of individuals who have been inadvertently involved in an Incident?
The response to questions 2.5 to 2.7 do not differ, except for point (b) where submission of IP addresses, which are communication confirmation data as explained in question 2.6, must be made in accordance with the provisions set forth in the PCSA.
2.9 Please provide details of the regulator(s) responsible for enforcing the requirements identified under questions 2.3 to 2.7.
The Ministry of Science and ICT, the Ministry of the Interior and Safety, the Korea Communications Commission, Korea Internet and Security Agency, and the Financial Services Commission.
2.10 What are the penalties for not complying with the requirements identified under questions 2.3 to 2.8?
A failure to comply with the requirements specified in questions 2.3 to 2.8 may result in a monetary fine imposed by relevant regulatory authorities.
2.11 Please cite any specific examples of enforcement action taken in cases of non-compliance with the above-mentioned requirements.
In addition to a monetary fine, the regulatory authorities may require submission of any related articles and documents or enter the place of business of the person concerned to inspect account books and other documents. The regulatory authorities may also order the ICSP to take corrective measures as may be necessary to halt or correct the violation or announce to the public the fact that the provider has received the order to take such corrective measures.
2.12 Are organisations permitted to use any of the following measures to detect and deflect Incidents in their own networks in your jurisdiction?
Beacons (i.e. imperceptible, remotely hosted graphics inserted into content to trigger a contact with a remote server that will reveal the IP address of a computer that is viewing such content)
In Korea, there is no legislation or regulation prohibiting the use of beacons to detect and deflect Incidents in the organisations' networks.
Honeypots (i.e. digital traps designed to trick cyber threat actors into taking action against a synthetic network, thereby allowing an organisation to detect and counteract attempts to attack its network without causing any damage to the organisation's real network or data)
In Korea, there is no legislation or regulation prohibiting the use of honeypots to detect and deflect Incidents in the organisations' networks.
Sinkholes (i.e. measures to re-direct malicious traffic away from an organisation's own IP addresses and servers, commonly used to prevent DDoS attacks)
In Korea, there is no legislation or regulation prohibiting the use of sinkholes to detect and deflect Incidents in the organisations' networks.
3. Specific Sectors
3.1 Does market practice with respect to information security (e.g. measures to prevent, detect, mitigate and respond to Incidents) vary across different business sectors in your jurisdiction? Please include details of any common deviations from the strict legal requirements under Applicable Laws.
Market practice varies across business sectors because different laws apply depending on the business sector. For example, in the financial sector, the Credit Information Act requires credit information companies to implement certain statutorily prescribed technical, physical, and managerial security measures, including security measures for the use of cloud services and some unique regulations such as network separation to prevent a third party's unlawful access to the company's credit information computer system. With respect to the information communications sector, the Network Act stipulates specific technical and managerial security measures that ICSPs are required to implement in order to prevent the leakage of personal information. As such, when it comes to Governance, Risk Management, Compliance ("GRC") matters, practices vary depending on the industry. In particular, stricter audit and reporting requirements would apply to companies in the financial sector.
3.2 Are there any specific legal requirements in relation to cybersecurity applicable to organisations in: (a) the financial services sector; and (b) the telecommunications sector?
(a) In the financial sector, the EFTA sets forth the standards for ensuring safety with respect to the facilities, electronic apparatus and human resources, which must be implemented by financial companies, electronic financial business entities and subsidiary electronic financial business entities to ensure safety and reliability of the electronic financial transactions.
(b) With respect to the telecommunications sector, the Network Act requires that the following types of ICSPs must obtain a certification for their information protection management system: (i) common telecommunications business operators providing ICN services in Seoul Special Metropolitan City and any other Metropolitan Cities; (ii) companies that operate clustered information and communications facilities; and (iii) companies whose revenue generated in the sector of information and communications services in the previous year is not less than 10 billion won, or whose average number of daily users over the past three months is not less than one million.
4. Corporate Governance
4.1 In what circumstances, if any, might a failure by a company (whether listed or private) to prevent, mitigate, manage or respond to an Incident amount to a breach of directors' duties in your jurisdiction?
The Network Act requires that the CISO must be designated from the company's director-level employees (unless the ICSP or the like is a small business). If the CISO has reported issues relating to a potential Incident to the board of directors or representative director, and the directors have failed to properly respond to prevent the Incident occurring, such failure may amount to a breach of directors' duties.
4.2 Are companies (whether listed or private) required under Applicable Laws to: (a) designate a CISO; (b) establish a written Incident response plan or policy; (c) conduct periodic cyber risk assessments, including for third party vendors; and (d) perform penetration tests or vulnerability assessments?
(a) Under the amended version of the Network Act, in principle, all ICSPs (other than small business enterprises) must designate a director-level CISO and report such fact to the Ministry of Science and ICT. The CISO of a company that meets certain thresholds in terms of their assets or number of employees (e.g., the company's total assets at the end of the immediately preceding business year was at least KRW 5 trillion) may not perform any duties other than that of the CISO as prescribed by law. Any financial company or electronic financial business must also appoint a CISO, and the CISO may not perform any duties other than that of the CISO if the financial company or electronic financial business entity meets certain thresholds in terms of their assets or number of employees.
(b) Any personal information processor that processes personal information of 10,000 data subjects or more must establish a manual which provides information regarding the measures to be implemented in response to personal information leakage Incidents.
(c)/(d)
Under the EFTA, financial companies and electronic financial business must analyse and assess the vulnerability of electronic financial infrastructure, including the assessment on the information technology sector, at least once each business year. Moreover, under the PICIA, the head of the management organisation of the critical information and communications infrastructure must analyse and evaluate the vulnerabilities of the infrastructure every year.
4.3 Are companies (whether listed or private) subject to any specific disclosure requirements in relation to cybersecurity risks or Incidents (e.g. to listing authorities, the market or otherwise in their annual reports)?
Under the Network Act, the Minister of Science and ICT may order the ICSPs and the Collective ICN Facility Operators to do the following, if he or she finds that it is necessary to analyse the cause of the infiltration Incident:
(i) retain relevant material such as records of access to the ICN;
(ii) submit the relevant material to the infiltration Incident; and
(iii) allow physical access to the business site to investigate the cause of the Incident.
Moreover, the providers of critical information communications services and the Collective ICN Facility Operators must submit information regarding any infiltration Incident, such as statistics by type of intrusion cases, statistics of traffic of the relevant ICNs, and statistics of use by access channel, to the Ministry of Science and ICT and KISA.
4.4 Are companies (whether public or listed) subject to any other specific requirements under Applicable Laws in relation to cybersecurity?
Pursuant to the Network Act, the Minister of Science and ICT may issue a public notice of guidelines for protective measures for information and may recommend that ICSPs observe the guidelines. The Minister of Science and ICT may also recommend that anyone who intends to carry out an information and communications service business or telecommunications business of a certain size requiring a licence, permit, registration, or report to take protective measures in accordance with the preliminary examination standards for data protection (i.e., the "Public Notice on Preliminary Examination of Data Protection").
5. Litigation
5.1 Please provide details of any civil actions that may be brought in relation to any Incident and the elements of that action that would need to be met.
In the event that an Incident occurs due to the personal information processor's violation of the PIPA, the data subject may claim damages against the personal information processor. In this case, the personal information processor will be liable for damages unless it can prove that there was no wilful misconduct or negligence of the processor that caused the Incident. If the data subject incurs any damages caused by the Incident due to the personal information processor's wilful misconduct or gross negligence, the court may award up to treble damages. Also, the data subject may seek statutory damages up to KRW 3 million, if the Incident was caused by wilful misconduct or negligence of the personal information processor.
5.2 Please cite any specific examples of cases that have been brought in your jurisdiction in relation to Incidents.
In 2014, there was a personal information leakage Incident of over 100 million items of personal information stored by one of the major card companies in Korea being leaked. The victims of the leakage brought a claim against the company and the court awarded damages in the amount of KRW 10,000 to each of the plaintiffs for the leakage Incident. Moreover, in recent years, the amount of fines imposed against companies involved in a leakage Incident increased substantially, as it is shown in the case where an internet shopping site was required to pay an administrative fine of KRW 4.5 billion (approx. USD 3.8 million) for a leakage Incident.
5.3 Is there any potential liability in tort or equivalent legal theory in relation to an Incident?
The personal information processor may be found liable for a tort under Korean Civil Act, if the plaintiff proves that (i) there was a violation of relevant data protection laws by the processor of the personal information, (ii) the data subject has incurred damages due to the Incident, (iii) there is a causal relationship between the damage and the violation, and (iv) there has been wilful misconduct or negligence by the processor.
6.1 Are organisations permitted to take out insurance against Incidents in your jurisdiction?
Under the Network Act, ICSPs of a certain size must purchase liability insurance policy, join a mutual aid programme or accumulate reserves for compensation of damages to their users, if any. Moreover, under the Credit Information Act, financial companies and credit information companies must also take measures necessary to fulfil liability to compensate damage by purchasing insurance, joining a mutual aid programme, or accumulating reserves.
6.2 Are there any regulatory limitations to insurance coverage against specific types of loss, such as business interruption, system failures, cyber extortion or digital asset restoration? If so, are there any legal limits placed on what the insurance policy can cover?
No. As a reference matter, among the insurances mentioned in question 6.1 above, the insurance required under the Network Act is intended to ensure the ICSP's compensation of damages incurred by the user as a result of the ICSP's wilful misconduct or negligence amounting to a violation of the data protection/privacy provisions under the Network Act.
7. Employees
7.1 Are there any specific requirements under Applicable Law regarding: (a) the monitoring of employees for the purposes of preventing, detection, mitigating and responding to Incidents; and (b) the reporting of cyber risks, security flaws, Incidents or potential Incidents by employees to their employer?
(a) From the outset, an ICSP is required to implement technical/managerial security measures in order to ensure the security of its users' personal information. For example, access to the ICSP's personal information processing system must be limited to only those personal information managers necessary for providing services to users, and records on the grant, change, or termination of a personal information manager's access rights must be retained for at least five years. In relation to this, the ICSP must check/inspect the access records of the personal information processing system maintained by the personal information managers at least once a month, and retain the records for at least six months (one year under the PIPA).
(b) There are no statutory requirements for employees to report Incidents or potential Incidents to their employer. However, based on the Korean regulators' guideline titled "Manual for Responding to Personal Information Leakage Incidents", all employees are required to immediately report any Incidents or potential Incidents to the responsible data protection officer via email, phone or the like.
7.2 Are there any Applicable Laws (e.g. whistle-blowing laws) that may prohibit or limit the reporting of cyber risks, security flaws, Incidents or potential Incidents by an employee?
No. Rather, any person who believes that an act detrimental to the public interest has been, or is likely to be, committed may file a public interest report. An "act detrimental to the public interest" includes an act that is subject to penalties or administrative sanctions under the PIPA, Network Act, or Credit Information Act. Therefore, the reporting of an Incident by an employee is protected under the Protection of Public Interest Reporters Act.
8. Investigatory and Police Powers
8.1 Please provide details of any investigatory powers of law enforcement or other authorities under Applicable Laws in your jurisdiction (e.g. antiterrorism laws) that may be relied upon to investigate an Incident.
The following authorities have investigatory powers of law enforcement: National Intelligence Service; National Police Agency Cyber Bureau; Forensic Science Investigation Department of the Supreme Prosecutors' Office; Financial Supervisory Service; and KISA.
8.2 Are there any requirements under Applicable Laws for organisations to implement backdoors in their IT systems for law enforcement authorities or to provide law enforcement authorities with encryption keys?
No, there is no legislation or regulation in Korea that requires organisations to implement backdoors in the IT systems for law enforcement authorities or to provide law enforcement authorities with encryption keys.
Hwan Kyoung Ko
Kyung Min Son
Buy Print Edition £295
Buy Chapter PDF £100
Other Korea Chapters
Class and Group Actions
Testimonials Contact Us About Us Careers
The International Comparative Legal Guides and the International Business Reports are published by: Global Legal Group
The ICLG Series - In my practice as a commercial real estate risk manager at GE Capital and as a consultant to private equity clients in Europe I have used and can recommend GLG publications as a starting point for solutions to cross-border transaction hurdles. For practitioners, the publications are useful in the formation of an early and high-level understanding on each of the relevant topics and jurisdictions GLG covers. The information contained in the publications is credible, accurate as of the date of printing, and a reliable first-source when seeking the support of expert resources.
William Glennon, Managing Partner - UnderwritersTrust Transaction & Risk Management LLP
© 2002-2020 Copyright: ICLG.com | Our Privacy