Personal Information Protection Act

As online services multiplied, how far a company could go with information collected at signup stayed vague. Emailing members with advertising was routine, and handing a list to a partner company was settled by one line in a contract. Users had no way to learn where their information had gone, and after a large breach they would find out from the news which fields had been stored about them.

Pagedeck stood in the same place once. Ravi wanted to send a feature announcement to the email addresses of 30,000 free users, and the same week Sofia wanted to pass a list of enterprise contacts to a partner's seminar invitation. Neither meant any harm; the addresses had come in at signup, so they read as ours. Grace stopped both and checked: the consent on the signup screen covered only what was needed to provide the service.

The Personal Information Protection Act (PIPA) pins that boundary down. It requires telling people what is collected and why before asking consent, and asking again before using the data beyond that purpose or handing it outside. It gives the person who supplied the data the right to see it, correct it, and delete it. The law is procedural more than prohibitive: little is banned outright, and most things require a recorded basis.

Every stage where personal information moves has to carry a purpose and a legal basis. There are five.

1. Collection — state what is collected, why, and how long it is kept, then obtain consent. Consent is split between fields genuinely required to provide the service and everything else. Refusing consent on an optional field can't be grounds for denying service, which is what keeps the split from being cosmetic.
2. Stricter categories — sensitive data such as health or beliefs, and unique identifiers such as the resident registration number, need separate consent or a specific legal basis. The resident registration number can't be collected at all without one, no matter how convenient it would be as an account key.
3. Use beyond the purpose, and transfers — using data outside the purpose it was given for, or handing it to another company, takes a fresh consent. Sending it abroad is its own case. Advertising is where this gets missed most: sending marketing messages requires separate marketing consent, and signup consent doesn't stand in for it.
4. Retention and deletion — once the purpose is met or the stated period passes, the data gets destroyed without delay. Leaving a departed member's address on an advertising list is a common violation, and one that shows up in the send list rather than in the database.
5. Rights of the data subject — people can view, correct, and delete their data and demand that processing stop. Which fields are processed for which purposes gets published as a privacy policy, and a policy nobody can find counts as no policy.

The breach procedure is in the same law. Once a leak is known, the affected people are notified and the regulator is informed, with a 72-hour deadline. Supervision and enforcement sit with the Personal Information Protection Commission, and a confirmed violation can draw a penalty of up to 3 percent of total revenue. Provisions that had applied only to online businesses were folded into this law in the 2020 amendment, so web services and offline businesses now read the same statute.

In marketing, the first thing it touches is the consent block on the signup screen. Required and optional get separated, and each optional item says in one line what it's for. Slipping marketing consent into the required block, or pre-checking it, is the pattern flagged most often in practice.

Three other places.

1. Building a send list — the query that pulls email addresses has to include marketing consent status. Pull straight from the full list and people who never consented are in it. Check that departed members and people who withdrew consent drop out too, since both states change after the original consent was recorded.
2. Adding advertising tools — tracking code on a site sends visit records to an outside company. Name that company and what gets sent in the privacy policy, and if it leaves the country, disclose that as well.
3. Setting retention periods — fix a period per purpose and make expired data delete itself. A process that relies on someone deleting by hand always slips, usually in the month it matters.

Scope is worth checking too. This law covers personal information processed in Korea, so serving European users means reading GDPR alongside it. GDPR is the European data protection regulation.

"We can't advertise to this list. They only consented at signup."

Service consent isn't a basis for sending advertising.

"Handing that list to a partner needs separate third-party transfer consent."

Moving data outside the original purpose takes its own consent.

"A departed member is still on the send list. Let's look at the deletion rule again."

Data past its retention period isn't being removed.

Pagedeck cleaned up three things after Grace stopped those two sends. Marketing consent became an optional item on the signup screen, the send-list query gained consent status and departure status, and the privacy policy named the outside companies behind the tracking code.

The sendable list went from 30,000 to 6,000. Ravi pushed back and changed his mind a month later. Open rates rose almost fourfold, so the number of actual clicks went up rather than down.

The most common belief is that consent at signup covers advertising too. Consent is one word, so it feels like one event. But consent holds per purpose. An address collected to provide a service is for service messages, and advertising is a different purpose. Leave that in place and the send list grows until complaints and fines arrive, and cleaning it up in a hurry takes the consenting users out along with everyone else.

The other common belief is that pseudonymized data can be used freely. Strip the name, swap in a number, and it looks like it stopped being personal information. But if combining it with other data can identify the person again, the law still applies. The purposes pseudonymized data may serve are also limited to what the law allows, such as statistics and research. Left alone, a team trusts that it's safe, merges it with outside data, and at the moment of merging has identifiable data again.