2002 International Conference on Personal Data Protection

1. 2002 International Conference on Personal Data Protection The Appropriate Remedies and Redress for Data Protection in Korea Whon-Il Park Asst. Prof. of Law, Kyung Hee University onepark@khu.ac.kr Korea Information Security Agency Seoul, November 28, 2002

2. Negative Aspects of the Information Society Case 1 Mobile Phone Co's VA service based on Customer's PI w/o his consent → Customer demanded refund and pecuniary compensation Case 2 Game site's admission of Children below 14 w/o Parents' consent → Parents demanded refund and withdrawal of children from the site Case 3 Client's complaints on the Internet shopping mall bulletin board → Shop owner disclosed her PI and jeopardized her security • In principle, the injured party submit complaints to Korea Consumer Protection Board (KCPB), or file suit for damages with the Court • Problems • - KCPB has little legal authority; otherwise, • - Civil action is onerous and inconvenient - Specific performance of the Violator is difficult to obtain

3. Protection of Personal Information = Citizen's right to Privacy under the Constitution Korea has two Comprehensive DP laws 1. In the public sector, Act on the Protection of Personal Information Maintained by Public Agencies since 1995 2. In the private sector, Act on Promotion of Information and Communication Network Utilization and Data Protection ("DP Act") since July 2001 • Under the DP Act, data subjects' PI is protected in line with OECD Guidelines → Any violation of the provisions of the DP Act by ISPs is strictly subject to sanctions and penalties as well as damages to the injured parties

4. ADR Mechanisms in Korea • Merits of ADR - Speed, convenience, low cost, consensual resolution - Court-like authority w/ knowledge and technological expertise • Demerits of ADR - How is it effective to resolve the disputes instead of civil action? - It needs legislative commitment and undertakings • Under the Framework Act on Electronic Transaction, the Electronic Commerce Mediation Committee has been established to resolve any kind of disputes arising from EC or e-trading. However, disputes related w/ DP or Privacy could not be settled like EC or consumer protection issues. → Any companies involved play the role as a supplier as well as a consumer

5. Personal Information Dispute Mediation Committee • PIDMC was established in Dec. 2001 under the DP Act • PIDMC is composed of up to 15 members - appointed/commissioned by Minister of Inf. & Comm. - among lawyers, IT engineers, professors, representatives from consumer protection organizations and IT businesses • PIDMC is supported by the Secretariat within KISA • Personal Information Dispute Mediation proceedings shall be conducted by the following mechanisms:

6. Plaintiff Defendant Transfer to other Authorities or Compromise Notice T Filing of Petition Defensive Opinion and Evidences T Fact Finding Parties’ Whereabouts unknown, Withdrawal of Petition Pre-Mediation Proposal for Agreement Mediation Public/Private Conferences Settlement Agreement Civil Lawsuit or Withdrawal Execution of Mediation Record T T T Note: T indicates the termination of mediation proceedings.

7. ADR is more adequate forum of dispute settlement in EC than Litigation. Why ? - EC is not carried out on the paper nor in a face-to-face relationship • Transactions are repeated and in bulk toward unspecified • majority customers - One's intention is expressed through C&C systems - Transactions usually take place cross the border → Both parties would agree to speedy and concise arrangement suggested by specialists with competent knowledge and technological expertise.

8. If and when Concerned parties are aware of preventive measures and redress, and low cost and speedy remedies are available, Then frequent disputes arising out of EC could be curtailed significantly • However, • DP violations occasionally give rise to individually trivial but • widely dispersed damages. • ADR would limit citizen's right to trial unless the mediation • effect is equivalent to the court decision.

9. Under the DP Act, mediation is not mandatory, both dispute • mediation and litigation are allowed. → The current mediation procedure supplements the judiciary system, and would not limit the citizen's right to trial. → Any dispute arising out of data protection may be resolved cumulatively by mediation and litigation. • The effect of mediation shall be contractual settlement, less effective than the court settlement.

10. DP disputes concern the right to privacy, fundamental human right, and have to be resolved ultimately in the court. → For a dispute mediation to have an identical effect with a court settlement, the following requirements should be satisfied: - the mediation body shall be neutral and independent - the mediation procedures shall be fair to both parties • the assertion and evidences of both parties shall be disclosed • in detail • the mediation shall be reasonable and comply with the • overall rule of law

11. If the applicant is notified of the "mediation failed" and the case closed, he/she could decide whether he/she file suit with the court. In the first-mentioned cases, PIDMC ruled that: Case 1Mobile Phone Co. should refund illegally charged rate to Customer and pay damages up to 500 thousand Won for Customer's sufferings. Defendant refused and the mediation failed. Case 2Game site should refund the fee and let the minor member withdraw from the site. Both sides agreed to the decision. Case 3Shop owner's disclosure of Customer's information violated the DP provisions and the shop owner should immediately delete PI and compensate damages up to 200 thousand Won. Both parties agreed and the case closed.

12. PIDMC attentively and independently hear both Plaintiff's claims and Defendant's assertion on a fair and equal footing. • PIDMC is believed to play as an unbiased learned umpire regardless of the amount of damages. → Thus data subjects may use all possible means of remedies and redress. What if one party would not accept the mediation? When the injured party could not go to the court, it is advisable that Defendant has nothing but to approve the mediation agreement by supporting Plaintiff to proceed the lawsuit and Violator should confront penalty or even criminal charges.