By Chan Sik Ahn and Sunmin Choi of HMP Law
One thing that may surprise many global operators of location-based businesses, for example any phone app that uses a person’s GPS data, when doing business in South Korea is that there is an obligatory permit and reporting system. In Korea, strict control on the dissemination of and access to personal information is already a well-known fact because of the Personal Information Protection Act (PIPA). Since one’s personal location information is highly vulnerable to abuse, leading to the risk of invasion of privacy or even security breaches, the Act on the Protection, Use, etc. of Location Information (Location Information Protection Act; LIPA) was enacted to prevent such potential abuse. This LIPA is legislation the likes of which cannot be found in other countries such as the United States, European Union or Japan, and businesses that use location information in Korea need to comply with both the PIPA and the LIPA.
The most important stipulation of the LIPA for operators of location-related businesses is that they must, depending on their business activities, obtain a permit from and/or report to the Korea Communications Commission (KCC). Most foreign operators, however, who want to conduct business in Korea do not even know the existence of this act, nor whether their business is subject to the permit and reporting system. In some cases, the operator may believe that they have complied with all the regulations in the PIPA and thus proceeds with business activities, unaware that they require a permit or are subject to reporting duties.
Accordingly, in this article, I will explain each type of permit and reporting, confirm the scope of the permit and reporting system that applies to location information business, and also the types are activities that are not subject to it.
1. Location information business (subject to a permit)
First, a permit for a location information business obtained from the KCC is a type of license, under which the licensee can actively collect a user’s personal location information, and provide said information to location-based service providers for business purposes.
Although many companies may think that they do not need to obtain a permit for their location-based service if they do not pass on the information to other operators but only use it for their own purposes, their services might be both subject to both permit and reporting at the same time.
An example: hypothetical Company A plans to collect and analyze the location information of customers visiting a certain department store and then, on the basis of that analysis, send customized coupons to those customers through a mobile phone application. If Company A collects location information on its own by such a service, without receiving data from a mobile phone network operator that is licensed to collect location information, Company A may be obliged to get a permit for location information services and also may need to report location-based services at the same time. A permit is needed because Company A collects location information actively and stores it on its servers, and analyzes it by itself for business purpose, and reporting is obligatory because Company A provides location-based services by giving customized coupons for business purposes as well.
In order to get permission to operate a location information business, a rather tricky process is involved, and a document packet spanning about 150 pages must be submitted, including basic details, business plans and technical specifications, along with supporting documents about the company itself and its financial status. In practice, because operators do not have separate servers used for storing location information only, it is often difficult to explain systems related to personal location information separately, or to describe specific technologies and facilities. In addition, the documents required by the KCC are readily available to domestic companies, but foreign operators need to pay attention, as the documents require notarization, and others require the affixing of an Apostille, which takes considerable time and energy to prepare.
In addition, the permit application itself is not easy to prepare and requires a preparation period of approximately 4 months or more, given that applications are received only during periods announced 4 to 6 times a year, and even after the application is submitted, the company must give a presentation before the judges explaining the structure of the business, how it encrypts its location information and its plans in the Korean market. Even if these procedures are carried out, if the total score of the assessment is 70 points or less, the permit may be denied. In short, if a non-Korean company intends to obtain approval for operating a location information business in Korea, it is necessary to thoroughly prepare the relevant documents and procedures.
2. Location-based service business (subject to reporting)
If Company B runs a location-based service such as a mobile phone application which uses personal location information and stores it on the company’s own server after receiving it from third party location information providers, Company B only needs to report its procedures to the KCC. However, even if Company B uses personal location information in its mobile phone application, it is not subject to a reporting obligation if that information is used only in the application and stored only within that particular users’ mobile phone. This is because in Korea, mobile phone carriers such as SKT, KT, and LG U+, have already received location information business permits from the KCC and can provide users’ location information under contract to application service providers. The mobile phone application is able to handle its users’ location information only within each user’s device by using a location-based API provided by such carriers. In other words, location information may not be subject to location-based service reporting if it is not sent to the operator’s server in any way.
Reporting of location-based service business can be sent to the KCC at any time, and involves about 40 pages of documents describing location information protection measures, including business plans and location information management guidelines. In such cases, the KCC confirms whether the reporting is appropriate after about a two-week-period. As mentioned above, it should be noted that it is necessary to both receive a permit and file a report if location information is stored on the operator’s server by itself and then provided only to that operator’s customers.
If a business does not fulfill its obligations vis-Ã -vis obtaining a permit or reporting a location information business, it may face a fine or other administrative penalty under the LIPA. Therefore, it is necessary for business operators who want to start a location-based business in the Korean market to thoroughly check whether the business is subject to such obligations.
It should be pointed out that regulations on location information are gradually easing in South Korea due to criticisms that they act as an entry barrier for businesses seen to be part of the Fourth Industrial Revolution, something that the government seeks to promote. With the revision of the LIPA this year, businesses that collect only location information of objects, not personal location information, have only been subject to the obligation to report to the KCC (in other words, no permit is needed), and support benefits have been added for small business owners or single creative companies. As yet, the process of obtaining a permit and/or reporting a location information business remains complicated, but further revisions of the Act may lead to further easing of regulations.
In addition, while it is not easy to obtain a permit for a location information business, once it has been approved, that company will be eligible to provide such data to other location-based service operators. This may then present an opportunity to use the license to do business under a new business structure.