Research Report
A Study on Improvement of the System to Designate the Domestic Agent
Ⅰ. Backgrounds and Purposes
○ With the widespread of global online platform services, the number of citizens using services offered by overseas business operators is soaring. Thus, it is necessary to make it easier for citizens to contact overseas business operators to address difficulties in using the services and to enhance the enforcement of regulations in cases of violations of laws by overseas business operators or the occurrence of events.
- In this regard, the amendment to the Act on Promotion of Information and Communications Network Utilization and Information Protection (hereinafter the “Information and Communications Network Act”) first introduced the designation of domestic agents, followed in 2020 by the Personal Information Protection Act and the Telecommunications Act. It is noted, however, that the domestic agent schemes are inefficiently managed, practically avoiding the protection of domestic users.
- Consequently, the purpose of this study is to conduct empirical research on the organization and operation of domestic agent systems under the current laws and to examine the related issues, drawing ways in which the domestic agent system can be improved under the Information and Communications Network Act, the Personal Information Protection Act, and the Telecommunications Act, and ultimately enhancing the system’s efficacy.
Ⅱ. Major Content
▶ Background of the Introduction of Domestic Agents
○ The Information and Communications Network Act introduced the concept of domestic agents for the first time on September 18, 2018, and provided the following two reasons for its introduction:
- The amendment aimed at protecting users to ensure that domestic users of services offered by global business operators can effectively exercise their right to self-determination, such as a request for withdrawal of consent to provide personal information, a request for perusal, or a request for correction, as well as facilitating the enforcement of rules to force such business operators to swiftly submit data necessary for law enforcement by government agents.
- Furthermore, the media evaluated that such an introduction would be helpful to address reverse discrimination by establishing a minimal mechanism to regulate global business operators with no place of business or servers within the Republic of Korea.
○ The amendment partially achieves its goal of facilitating law enforcement as documents sent by the government are delivered and returned relatively quickly. Nonetheless, there is a suspicion that user protection is effective, so empirical research on this issue was conducted for the purpose of this study.
▶ The Current Legislation regarding Domestic Agent Designation
○ Article 35-5 of the Information and Communications Network Act, Article 31-2 of the Personal Information Protection Act and Article 22-8 of the Telecommunications Act
○ These provisions set up similar requirements and effects, so, for instance, consider the provisions under the Personal Information Protection Act for explanation.
- A person who is obliged to designate a domestic agent is determined by Presidential Decree by taking into consideration the total sales and the scope of retaining personal information, etc. In addition, a person who is required to submit relevant articles, documents, etc. if any accident or event that significantly hampers the stability of using information and communications services exists in violation of the Personal Information Protection Act is also subject to a duty to designate domestic agents.
- A domestic agent should have domicile or place of business in the Republic of Korea, and a business operator subject to a duty to designate a domestic agent should specify the name, address, phone number, and email address of his or her domestic agent in the privacy policy.
- A domestic agent is in charge of acting as a personal information controller, notifying or reporting the leak of personal information, etc., and submitting articles or documents, etc.
- Where a domestic agent violates the Personal Information Protection Act in relation to business affairs, such violation shall be deemed to have been committed by the personal information controller.
▶ Issues on the Designation of Domestic Agents and its Current Status
○ Under the Information and Communications Network Act, 33 business operators are required to designate domestic agents; there are 34 business operators under the Personal Information Protection Act. However, the majority of them are redundant, and only Rakuten is added under the Personal Information Protection Act.
- Under the Telecommunications Act, Meta Platforms and Google are required to designate domestic agents. In addition, they fall under the scope of designating domestic agents under the Personal Information Protection Act.
○ From April 2023 to May 2023, empirical research was conducted to examine whether a person who was designated as a domestic agent properly perform their business affairs of protecting users.
- The research was conducted from the perspective of general users, by confirming the address and contact number of domestic agents through the websites of the business operators subject to a duty to designate domestic agents and then making inquiries through email or direct phone calls.
- After asking the business operators with a duty to designate domestic agents under the Personal Information Protection Act about their privacy policy and whether they delete personal information when the users cancel their accounts, we analyzed how long it takes to respond and the details of their response.
○ The issues raised by this empirical research
- In 2023, many business operators appointed the same institutions as their domestic agents as they did in 2022.
- The websites neglected to provide all or a portion of the information on their domestic agents or they provided information that differed from what was reported to government agencies, such as the Personal Information Protection Commission, etc.
- Some provided information in English, but not in Korean, or did not display information on domestic agents in a location where general users could readily find it. This makes it difficult for general users to find such information.
- Others did not even provide the email address of their domestic agents or respond to the email; it took more than seven days to receive their response, or the email was sent in English.
- Some business operators responded to user inquiries with general rather than specific information by simply providing a link to their privacy statement or customer service center.
- Even if a few business operators sent an email, they added the following message: “For future inquiries regarding personal information, please contact the customer center, not a domestic agent.”
- As some of the users preferred direct phone calls over email, we also attempted direct phone calls with the subjects of this research. It was a case in which it was challenging to reach the responsible parties, leading only to automatic answering machines via ARS.
- Even if we made phone calls to domestic agents using their phone numbers, we were only connected to a general adviser, and requests to connect to a department in charge of personal information were denied.
○ Issues Related to the Legal Framework on the Designation of Domestic Agents
- The designation is not subject to review or permission. Thus, law enforcement by domestic regulatory authorities was not strict and there were few systematic regimes to enhance efficiency.
▶ Legislation on Overseas Countries on Designation of Domestic Agents
○ European Union
- Article 27 of the General Data Protection Regulation (GDPR)
○ German
- Article 5 of Telemediengesetz
○ Japan
- Article 10 of the Telecommunications Business Act
▶ Analysis of Focus Group Interview on Domestic Agent Designation
○ From May 10, 2023, to May 18, 2023, a focus group interview (FGI) was conducted in order to identify problems with the system for designating domestic agents and how to enhance such a system.
○ The questionnaires contained the following:
1. The background to introducing the system for designating domestic agents
2. The function and role of the system for designating domestic agents under specific statutes
3. Issues on the designation of domestic agents for certain institutions
4. Opinions regarding the current status of institutions that designate domestic agents
5. Efficacy of the amendments to the Telecommunications Act
6. Measures to improve the system for designating domestic agents under specific statutes
▶ Measures to Improve the System for Designating Domestic Agents
○ Improving criteria for designating domestic agents
- Under the Information and Communications Network Act and the Personal Information Protection Act, the requirements for designating domestic agents are based on the sales volume. However, the designation criteria must be based on the number of users and traffic requirements, as required by the Telecommunications Act.
- Netflix and Twitter were not included on the list of business operators required to designate domestic agents under the current Personal Information Protection Act, despite having a number of domestic users. Therefore, the modification of the designation criteria will include these business operators.
○ Introduction to the System to Report the Changes of Domestic Agents
- It was found that the information of domestic agents reported to the Personal Information Protection Commission differs from information found on the relevant websites. In this case, it is necessary to implement a system to report the change.
○ Introduction to Monitoring and Sanctions on the Performance of Domestic Agents
- According to the empirical research conducted by the Korea Legislation Research Institute (KLRI), even if domestic corporations were designated as domestic agents, they did not perform their duties of protecting personal information more faithfully.
- It is essential that domestic agents perform their duties effectively, regardless of whether they are domestic corporations. Domestic agents must be subject to monitoring and supervision by regulatory authorities in order to ensure that domestic agents faithfully perform their duties.
- Under the current laws, only penalties are imposed on overseas business operators who violate the designation of domestic agents. However, there is no sanction on the overseas business operators whose domestic agents fail to perform their duties. This needs to be revised.
- Although domestic agents respond to user inquiries, it takes a considerable amount of time and their responses are in English, causing inconvenience for the users. This clearly shows that they do not adequately protect users. Therefore, it is necessary to establish guidelines regarding when and how to respond to users inquires.
○ Establishment of Sanctions and Guidelines Regarding the Presentation of Domestic Agents
- According to the research conducted by the KLRI, fourteen out of thirty- seven business operators, fail to provide complete or partial the information on their domestic agents.
- In order to ensure that domestic adequately secure domestic users, an appropriate sanction on the violation of the provisions under the current laws on the presentation of domestic agents should be imposed, and guidelines for presenting domestic agents should be provided.
○ Developing Guidelines for the Duties of Domestic Agents
- Currently, overseas business operators recognize that their domestic agents play a role in connecting them with regulatory authorities in Korea, but do not comprehend other roles, such as protecting personal information and domestic users. Hence, it is necessary to outline the duties domestic agents.
Ⅲ. Expected Effects
○ Expected Contribution to Policy
- This study analyzes the issues and causes underlying the current system for designating domestic agents. It is anticipated that this study will contributes to amendments to legislation, including the Information and Communications Network Act, the Personal Information Protection Act, and the Telecommunications Act.