The Korea Communications Commission (KCC) issued a press release on February 7, 2017 announcing its publication of “Guidelines on Protection of Personal Information for Customized Online Ads.” The KCC has published the Guidelines in response to the increased use of information about people’s website visits/use to deliver customized online ads, without the users’ knowledge. The Guidelines will take effect this July, after promotional events and information sessions have been conducted to inform businesses and users. The following is a summary of the main points of the Guidelines:
“Customized online ads” refers to online ads that are customized based on the recipient’s interests, taste, and habits, which are ascertained from information about the user’s online activity (“Behavior Information”).
“Customized online advertiser” (“Advertiser”) refers to a business that collects Behavior Information through online media, and transmits customized online ads. Advertisers are classified into two types based on the kind of advertisements they deliver:
(i) Direct-ads: The Advertiser transmits customized online ads to users by utilizing Behavior Information directly collected from its business website. For example, an online shopping-mall operator that transmits customized ads to users by collecting their Behavior Information within the online shopping mall.
(ii) Third-party ads: The Advertiser either directly collects the Behavior Information of users of other businesses’ websites, or utilizes the Behavior Information of users of other businesses’ websites, and transmits customized ads to the relevant users on a third party website via its own ad platform. For example, an ad-platform business that transmits customized ads to users of a portal site, by collecting their Behavior Information from online shopping malls.
“Online advertising medium business” (“Media Business”) refers to a business that allows collection of Behavior Information via an online medium, including its own business website or apps, or transmits customized online ads. For example, portal businesses, online shopping malls, online game companies, online media businesses, etc.
According to the Guidelines, online service users should be informed that their Behavior Information is being collected/used so that they can be easily aware of such collection and use. In particular, businesses should inform users of: (i) the types of Behavior Information being collected; (ii) the method of collecting Behavior Information; (iii) the purpose of collecting Behavior Information; (iv) the preservation/use period for Behavior Information and how it will be processed thereafter; (v) the method of exercising the user’s right to control; and (vi) information related to customized online ads, including damages relief for users.
(i) In the case of direct ads, the above information shall be shown on the first page of the business’s homepage, or on the screen where ads are shown, so that users can easily check the information at any time.
(ii) In the case of third-party ads, the above information shall be shown on the inside or periphery of the ads.
(iii) Media Businesses shall likewise show the information, including the name of the Advertiser who is collecting/processing Behavior Information and the method of collecting the Behavior Information, on the first page of their homepage or on the screen where ads are shown.
Advertisers are to collect only the minimum degree of Behavior Information necessary for customized online ads.
Advertisers are not to collect Behavior Information for the purpose of customized ads from online services whose main users are children under the age of 14. Advertisers shall not provide customized ads to children whom they know to be under the age 14.
If Behavior Information directly collected by an Advertiser or Media Business is provided to a third-party Advertiser: (i) the person receiving the Behavior Information, (ii) the types of Behavior Information being provided, and (iii) the intended use of the person receiving the Behavior Information, and more, shall be shown in the first page of the business’s homepage or on the screen where ads are shown.
Note: If an Advertiser combines Behavior Information and personal identification information, the Advertiser shall clearly inform the user of such combination, the purpose of use, types of information being combined, preservation period, and more, and receive prior consent from the user.
Advertisers are to provide, and inform users of, one or more of the following control measures: (1) a means to directly decide whether to receive ads via an ad screen or relevant links; (2) a means to decide whether to receive ads by deleting/blocking internet logs and cookies from the user’s mobile device; or (3) providing links and information so that users can easily be directed to the webpages of certain relevant organizations, such as associations that provide an option to receive or block customized online ads.
Advertisers are to take safety measures necessary to prevent exposure or wrongful use of Behavior Information by referencing Articles 28 and 47-3 of the Act on the Promotion of Information and Communications Network Utilization and Information Protection, and the “Standards of Technical/Administrative Protection Measures of Personal Information” published by the KCC, to preserve collected Behavior Information for a minimal time period, and to destroy or safely separate/store it immediately after fulfilling its purpose.
Advertisers are to proactively inform users and clients of the Behavior Information being collected/used, privacy-protection measures, technology used for customized online ads, and the way to exercise the right to refuse; and they are to arrange damage relief options related to customized online ads.