Q. Where personal information can be used out of purpose or provided to a third party in accordance with the Personal Information Protection Act, do "data subjects" include foreigners?
A. Yes, the data subjects of personal information include foreigners, where personal information is used for a purpose other than the intended one or provided to a third party, according to Article 18 (2) 3 of the Act.
Reasons
Article 18 (1) of the Act stipulates that a personal information controller shall not use personal information beyond the scope provided for in Article 15 (1), or provide it to any third party beyond the scope provided for in Article 17 (1) and (3). However, Article 18 (2) 3 of the Act states that a personal information controller may use personal information for other purpose than the intended one or provide it to a third party where it is deemed necessary explicitly for protecting, from impending danger, life, body or economic profits of the data subject or third party where the data subject or his/her legal representative is not in a position to express his/her intention, or prior consent cannot be obtained owing to unknown addresses of the data subjects. The terminology used in an Act should be interpreted and applied in a consistent manner unless there is a special reason not to, such as the presence of a clause stating otherwise. And considering that Article 2 Subparagraph 1 of the Act defines "personal information" as information relating to a living individual that makes it possible to identify the individual by his/her full name, resident registration number, image, etc. and Article 2 Subparagraph 3 of the Act defines "data subject" as an individual who is identifiable by the information processed hereby to become the subject of that information, it can be said that information on foreigners are also information relating to a living individual and the foreigner who is a subject of that information is a data subject as prescribed in the above Subparagraph 3. Also, Article 19 Subparagraph 4 of the Act includes alien registration numbers as prescribed by Article 31 (4) of the Immigration Act in the scope of personally identifiable information. Therefore, “data subject” in the parts excluding the items under Article 18 (2) of the Act and “data subject” in item 3 of the same Article include foreigners. In addition, Article 18 (1) of the Act protects the right of the data subject by restricting that a personal information controller shall not use personal information beyond the scope provided for in Article 15 (1), or provide it to any third party beyond the scope provided for in Article 17 (1) and (3). However, at the same time, Article 18 (2) of the same Act recognizes exceptions to restrictions on the out-of-purpose use and provision of personal information in inevitable cases where it is needed to achieve public good and administrative purposes. In the Article, one of the exceptions is where it is deemed necessary explicitly for protecting, from impending danger, life, body or economic profits of the data subject or third party where the data subject or his/her legal representative is not in a position to express his/her intention, or prior consent cannot be obtained owing to unknown addresses. If so, where the provision of personal information is required for protecting, from impending danger, life, body or economic profits of the data subject or third party, recognizing exceptions to restrictions on the out-of-purpose use and provision of personal information where the data subject is a foreigner protects the right of foreigners and also serves public good by protecting the life, body or economic profits of the third party. In this regard, irrespective of the need to strictly interpret the regulations to prevent a personal information controller’s subjective judgmentt on whether an exception should be recognized for protecting the data subject or third party’s life, body or economic profits, there is no reason to exclude foreigners from “data subject” in the parts excluding the items under Article 18 (2) of the Personal Information Protection Act and “data subject” in item 3 of the same Article.
*This article is extracted from Invest KOREA information center, 2021.
コメント