Last review date: 17 January 2025
The amended APPI introduced a new definition for "Personal Related Data." "Personal Related Data" refers to data which cannot identify an individual by itself but can become personal information that can identify a specific individual once the data is transferred to a third party and combined with other data owned by such third party. Cookie data may fall under this definition, if the third party that receives cookie data (from the party which originally received cookie data) would combine this data with other data and identify a specific individual. In such a case, the transferring party must confirm that consent to such transfer has been obtained. The guidelines published by the PPC do not state that cookie information itself immediately falls under the definition of Personal Related Data. However, the guidelines state that a web browsing history information, which was collected using a device identifier such as cookie information, would fall under the definition of "Personal Related Data."
New Cookie Regulations start June 2023:
Amendments to the Telecommunications Business Act (Amended Regulations) on cookie information took effect on 16 June 2023 and impose general requirements on entities that transmit cookie information or other types of user information to third parties. The Amended Regulations capture a wider range of businesses, such as SNS platforms, various content sharing services, and certain online search tool businesses. For more details, read our client alert published in February 2023.
Last review date: 17 January 2025
Yes.
The APPI does not have any requirements on the use of personal information for direct marketing activities. However, please note that sending of marketing/promotional emails is regulated by separate laws, which are "The Act on Regulation of Transmission of Specified Electronic Mail" and "The Act on Specified Commercial Transactions." Under these laws, marketing/promotional emails or SMS/text messages may not be sent unless prior consent of the recipient is obtained.
☒ email marketing
☒ prior opt-in consent
☒ SMS/text message marketing
☒ prior opt-in consent
Only SMSs or text messages that use a phone number are subject to prior opt-in consent, while text messages that occur within a mobile app that does not need a phone number are not subject to prior opt-in consent.